Kyushu Security Conference 2017 Intro of GameSec

Intro

https://www.slideshare.net/linecorp/cedec2017-line

Exercises: A (Windows)

Exercises: A is a practice for Windows.

A-1

Download the game from the following URL. https://1drv.ms/u/s!ApYX-BnkUapSgn5WJXimDkruijNl

Install dnSpy on your computer. https://github.com/0xd4d/dnSpy https://ci.appveyor.com/project/0xd4d/dnspy/branch/master/artifacts

A-2

Find the method to process player's damage and death by reversing/analyzing an algorithm of the game downloaded in A-1.

Hint: Assembly-CSharp.dll/BlueIce/PlayerHealth

A-3

Modify the game file(downloaded in A-1) that a player never die against attack of penguin(enemy). After that, check the game file if the modification has been applied by playing it.

A-4

Find other cheat.

A-5 (extra)

Decrypt this game's DLL. https://1drv.ms/u/s!ApYX-BnkUapSgwysIzWYT-5FTvm-

Exercises: B (Mac)

Exercises: B is a practice for Mac.

B-1

Download the app from the following URL. https://1drv.ms/u/s!ApYX-BnkUapSgw3q5Whm9hkAglv1

Install Hopper on your computer: https://www.hopperapp.com/

B-2

Count up to 200,000,000 on the app(downloaded in B-1).

Hint: $ objdump -d HelloWorld-desktop > disassemble_code

Hint: _ZN10HelloWorld12onTouchBeganEPN7cocos2d5TouchEPNS0_5EventE:

B-3

Hack the score of this app on Web Site. You can check your score from the following URL, if it is in top10. https://cedec.seccon.jp/cedec2017/

B-4

What is the maximum score that can be registered on this site(URL of B-3)?

B-5 (extra)

Achieve over 1000 combo in this game. http://cedec.seccon.jp/camp2017/ http://www.challenge3.shop/ https://1drv.ms/u/s!ApYX-BnkUapSgwbhEQQ0Z0Sq0rzc

for Next Stage

2016: http://1drv.ms/u/s!AtaQw-wbmFVpey-cWSc8e4RQJlQ

2017: http://cedec.seccon.jp/Two0lnaNa/