Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

Question

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting weaknesses/vulnerabilities with RCE" and write something about it. Gathering the information, was the easy part, as with a little bit of google scholar search and references in papers I came up with a broad palette of papers. "Program Slicing", "Taint Analysis", "Fuzzing", "Symbolic execution" ...

Now in addition to collecting the information and writing a paper, I have to make a little implementation. What exactly my implementation does, I have to decide on my own. It can be anything, as long as it has to do with detecting weaknesses and vulnerabilities with reverse code engineering. Now my problem: I never actually did any reverse code engineering. I have no idea what "implementation" I could make (with my little(no) practical knowledge of RCE). With my instructor I talked about detecting vulnerabilities in games as my studies have to do with games engineering and games are an interesting topic for me. However when searching for scientific papers about detecting vulnerabilities in games I couldn't find anything. Most of the search results in scholar had to do with legal affairs and the rest had to do with anything in RCE, but games. Also with normal google searching I couldn't find anything useful (papers/tutorials), but only news or descriptions of RCE in general and so on. I tried several combinations of different words like "game(s)", "vulnerabilities", "weaknesses","reverse code engineering".

Now I don't know if I just have the wrong way of searching, in this case, or if the stuff I search, really is hard (impossible?) to find.

That's why i came here to ask you, if you know any good sources. Tutorials and/or scientific papers about detecting vulnerabilities in games?

Maybe there is no information about that on the internet. Maybe (I don't know this) it could even be, that the task of detecting vulnerabilities in games is too demanding for someone with almost no knowledge in RCE and that I shouldn't even try to do this. Then I would have to program something else (easier). But then again, I wouldn't know what to do. A program slicing algorithm? I have no idea of the difficulty level of certain implementations. Therefore if you can give me any hints on what else (beside games) would be apropriate implementing, I would be grateful to hear. Additionally links to good tutorials about implementing the alternative would be nice.

I work on windows (99% of the time) and I am able to use Java, C++, C, C#, Python and Haskell.

I really appreciate any help you can provide.

Answer 1

The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.

As discussed here, "Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering... Typically you don't need to analyze the entire program, but only the entrypoints for user-input."

In the context of games, the entrypoints are typically network data (server-to-client, client-to-client, and if you have access to the server binaries then client-to-server (and server-to-server if supported)), saved game files, non-executable mods like "skins", etc.

For example, here's a game vulnerability that I discovered and reported several years ago:

• Advisory
• Presentation

Though RCE was required to develop the exploit, the vulnerability was found without RCE. Nonetheless, you can see this as an example of a game containing a security vulnerability.

With regard to finding vulnerabilities in closed-source products, there are countless papers, tutorials, and books available. The Shellcoder's Handbook is one that comes to mind.

Answer 2

This is a good (maybe starting to show its age) book Exploiting Online Games: Cheating Massively Distributed Systems.

It has a general intro on game hacking, sections on reversing and exploiting. You'll find all you need there. You don't seem to be required to do binary reversing for your project. It sounds like any project on figuring out how a client or server works will do - even if they are in Lua :)