Summary

Game Hacking Fundamentals aims to introduce the tools and essential techniques used while hacking video games.

The module starts by covering theories on approaching game hacking and an introduction to the de facto standard Game Hacking toolkit, Cheat Engine. The second section covers a lot about video games in memory and how to find and modify game values, the most common approach to Game Hacking. The third section will look at identifying data structures in memory and using them to identify related data in memory. The fourth and final section will look at debugging a video game, as well as changing how the video game functions at a core level.

Overall outcomes from the module:

How to formulate an approach to a target and execute a series of actions to achieve a goal
Understanding how video games and programs exist in program memory and how to locate and modify values to affect the game
How to debug a video game and inject your own code
How to identify a data structure in memory as well as how to dissect the data structure

Important Requirements:

This module is paired with a video game; you will require a laptop or a desktop computer with a GPU (Graphics Card). The Intel HD 4600, AMD HD 6570 or GeForce 9600GT should be considered the bare minimum to get playable performance out of the game. You can try resizing the game to smaller dimensions if you are experiencing crippling performance.
If you want to run it in a Virtual Machine, VMWare Player is preferred over VirtualBox for Virtualization on Windows and Linux and Parallels on ARM Macs. Be sure to enable GPU Acceleration in the VM settings where applicable.

The Intro to Assembly Language Module is an incredible module. Before embarking on this module, we highly recommend going through that module to understand what assembly is and how programs function at a low level. If you dont want to do the whole module, we recommend giving a quick read through the Registers part in the Registers, Addresses, and Data Types section, as well as the Basic Instructions and Control Instructions sections. You do not need to understand how to code in assembly, but understanding what registers are and how the assembly instruction set functions will be critical to the Game Hacking process.

Introduction

A new type of content for HackTheBox (HTB) Academy, the big question that many of you might ask is, "Why Game Hacking?". The simple answer is that it is a highly accessible pathway into the world of information security. The more detailed explanation is that there is an incredible amount of overlap between techniques, information and tools you are exposed to via Game Hacking and the far more intimidating infosec world. Because of this goal, these modules will focus on specific techniques and tools that apply to infosec and will not be a general 'how-to hack video games' path.

A great example is utilising memory searching techniques to look for a health value in a video game. Once you find it, you can modify it to become immortal, for instance. Extrapolate the same technique to find unprotected flags in HTB challenges, leading to a possible unintended method for solving them. Looking at a real-world example, how about extracting privileged information from memory, such as passwords or credit card information?

How about intercepting and modifying data sent between a video game and a server using an extremely well-known tool, Burp Suite, using the same techniques that will be used when pen-testing virtually every website?

Those are the types of overlaps we are talking about. What you learn from these modules will stand you in good stead when moving into the wider world of information security.

This, and future modules, will focus heavily on the Windows Operating System. Windows has, by far, the most mature and established Game Hacking environment and still dominates the PC gaming market by OS share. The games provided with each module and/or section should be runnable within a virtual machine if Windows is not your primary operating system.

It should be noted that there are a few requirements though:

You will require a laptop or a desktop computer with a GPU (Graphics Card). The Intel HD 4600 Integrated Graphics, AMD HD 6570 or GeForce 9600GT should be considered the bare minimum to get playable performance out of the game. You can try resizing the game to smaller dimensions if you are experiencing crippling performance, by grabbing and dragging the corners of the running process.
If you want to run it in a Virtual Machine, VMWare Player is preferred over VirtualBox for Virtualization on Windows and Linux and Parallels on ARM Macs. Be sure to enable GPU Acceleration in the VM settings where applicable and install VMWare Tools if using VMWare Player.

What is Game Hacking

Game hacking is a process that involves modifying a game's code, data, or mechanics to gain an unfair advantage over other players or to access content that is not ordinarily available. While some people engage in game hacking for fun or as a hobby, others use it to cheat and gain an advantage in online multiplayer games, which can ruin the experience for other players.

This can include cheating tools such as aimbots, wallhacks, and speed hacks, which allow players to automatically aim at opponents, see through walls or move faster than expected. Other forms of game hacking may involve modifying the game's code to create custom mods or to remove limitations imposed by the game's developers.

Game hacking can be considered a subset of information security (infosec), specifically in offensive security or "red teaming." In this context, game hacking is used to identify vulnerabilities in a game's code and can help game developers improve the security of their software.

In addition, some game developers employ security experts to help identify and prevent cheating in their games, which can be seen as information security. Furthermore, as online gaming becomes increasingly popular, game hacking can significantly threaten the security and privacy of players' personal information.

Therefore, game hacking is one aspect of the broader field of information security, as it involves identifying and exploiting vulnerabilities in software systems.

Sign Up / Log In to Unlock the Module

Please Sign Up or Log In to unlock the module and access the rest of the sections.

Relevant Paths

This module progresses you towards the following Paths

Software Assessor and Application Testing

Helpful skills for learning to read and write various programming languages and common weaknesses.

Hard

225 Sections

Required: 2100

Reward: +460

14 Modules included

Vulnerability Assessment

Easy

17 Sections

Reward: +10

This module introduces the concept of Vulnerability Assessments. We will review the differences between vulnerability assessments and penetration tests, how to carry out a vulnerability assessment, how to interpret the assessment results, and how to deliver an effective vulnerability assessment report.

Introduction to Bash Scripting

Easy

10 Sections

Reward: +10

This module covers the basics needed for working with Bash scripts to automate tasks on Linux systems. A strong grasp of Bash is a fundamental skill for anyone working in a technical information security role. Through the power of automation, we can unlock the Linux operating system's full potential and efficiently perform habitual tasks.

Introduction to Python 3

Easy

14 Sections

Reward: +10

Automating tedious or otherwise impossible tasks is highly valued during both penetration testing engagements and everyday life. Introduction to Python 3 aims to introduce the student to the world of scripting with Python 3 and covers the essential building blocks needed for a beginner to understand programming. Some advanced topics are also covered for the more experienced student. In a guided fashion and starting soft, the final goal of this module is to equip the reader with enough know-how to be able to implement simple yet useful pieces of software.

Intro to Assembly Language

Medium

24 Sections

Reward: +20

This module builds the core foundation for Binary Exploitation by teaching Computer Architecture and Assembly language basics.

Web Service & API Attacks

Medium

13 Sections

Reward: +20

Web services and APIs are frequently exposed to provide certain functionalities in a programmatic way between heterogeneous devices and software components. Both web services and APIs can assist in integrating different applications or facilitate separation within a given application. This module covers how to identify the functionality a web service or API offers and exploit any security-related inefficiencies.

Command Injections

Medium

12 Sections

Reward: +20

Command injection vulnerabilities can be leveraged to compromise a hosting server and its entire network. This module will teach you how to identify and exploit command injection vulnerabilities and how to use various filter bypassing techniques to avoid security mitigations.

SQL Injection Fundamentals

Medium

17 Sections

Reward: +10

Databases are an important part of web application infrastructure and SQL (Structured Query Language) to store, retrieve, and manipulate information stored in them. SQL injection is a code injection technique used to take advantage of coding vulnerabilities and inject SQL queries via an application to bypass authentication, retrieve data from the back-end database, or achieve code execution on the underlying server.

Attacking Common Applications

Medium

33 Sections

Reward: +20

Penetration Testers can come across various applications, such as Content Management Systems, custom web applications, internal portals used by developers and sysadmins, and more. It's common to find the same applications across many different environments. While an application may not be vulnerable in one environment, it may be misconfigured or unpatched in the next. It is important as an assessor to have a firm grasp of enumerating and attacking the common applications discussed in this module. This knowledge will help when encountering other types of applications during assessments.

Introduction to C#

Easy

21 Sections

Reward: +10

Introduction to C# aims to provide a solid foundation to understand and work with C# code. Covering the crucial foundations and more intricate concepts, providing a comprehensive depth of knowledge in C#.

Stack-Based Buffer Overflows on Linux x86

Medium

13 Sections

Reward: +10

Buffer overflows are common vulnerabilities in software applications that can be exploited to achieve remote code execution (RCE) or perform a Denial-of-Service (DoS) attack. These vulnerabilities are caused by insecure coding, resulting in an attacker being able to overrun a program's buffer and overwrite adjacent memory locations, changing the program's execution path and resulting in unintended actions.

Stack-Based Buffer Overflows on Windows x86

Medium

11 Sections

Reward: +10

This module is your first step into Windows Binary Exploitation, and it will teach you how to exploit local and remote buffer overflow vulnerabilities on Windows machines.

JavaScript Deobfuscation

Easy

11 Sections

Reward: +10

This module will take you step-by-step through the fundamentals of JavaScript Deobfuscation until you can deobfuscate basic JavaScript code and understand its purpose.

Secure Coding 101: JavaScript

Hard

17 Sections

Reward: +200

Learn how to improve your JavaScript code's security through Code Review, Static/Dynamic Analysis, Vulnerability Identification, and Patching.

Game Hacking Fundamentals

Medium

12 Sections

Reward: +100

This module serves as an introduction to fundamental Game Hacking concepts. You will learn how to find and change memory values in a running game as well as explore other tools and techniques.