0

I bought a game, "They are billions", and I'm trying to edit a savegame on my singleplayer campaign to change some vars (cheating because im very bad player). But the file is a password protected zip.

All i can saw is that the zip is AES protected.

I have downloaded x64bg to try to debug the moment when the program accesses the file with a password, but the truth is that I am totally new to debuggers and it is the first time that I have used a debugger.

Any idea on how can i get the password for the savegame file?

My interest is mainly in learning how to do it rather than in obtaining the password itself.

Thanks for all

2
  • If the developer wasn't handling the password very secret I would try to just dump the process memory to a file right after saving or loading a savegame. Then use strings on the memory dump and the resulting string list as input to a ZIP brute force password breaker. May work or not but it is a relative simple approach and therefore good as a first try. – Robert May 8 at 16:36
  • Thanks, I did, but unfortunately the zip cracker didn't find the password in the memory image dictionary. – Quasart May 10 at 15:13
1

I don't work with Windows and haven't used x64bg, but I can try to give some general guidance that should apply regardless of platform and toolset.

When reverse engineering, there often will be very many unknowns and only a few knowns, so stick with what you know. It may also be useful to use your debugger in tandem with a disassembler/decompiler for static analysis, as it may help you orient yourself.

A very important function of the debugger is going to be the "breakpoint". As the name implies, it will break execution at the point you specify. This is how you can stop the program and introspect memory/variables at points of interest.

If the binary is not stripped and you can see function names, you'll want to look for any functions that sound relevant to the operation of interest. Maybe you'll get lucky and there is a function called loadSaveGame or extractZip. If so, try setting a breakpoint on this function and step through it by hand once execution is suspended. Static analysis could be really helpful here; even if you don't have function names, you could look for standard library functions being called and break on them, such as open. You may even see the filename in disassembly if it is hardcoded. Or, perhaps you could identify the ZIP library in use and trace/break in places where it is called.

If you need help using any particular functions of your debugger, there are likely plenty of resources out there to help with that, or a question on Stack Exchange may be appropriate. It may be worth writing your own simple program and running a debugger on it to gain some experience.

0
1

Finally i found the passwords using a disassemble like multithr3at3d say.

If anyone is interested on how i do:

  • Download dnsSpy from https://github.com/dnSpy/dnSpy
  • Open the game binary and ionic.Zip.dll in dnsSpy
  • Mark a breakpoint on ionic.zip on class ZipCrypto in method ForRead
  • Start debugging (F5)
  • When the game starts on debugging and the execution pause on breakpoint, check the name of the file on zipEntry e. The password is on var password.

You can get the savegame password and the passwords for other files like ZXRules.dat. On ZXRules.dat you can change game unit parameters. Remember to zip the xml with same password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.