So, as promised, here's the story on how I cracked the trade code generator for Animal Crossing on the GameCube. Set the Wayback Machine to 2002/3 (I forget the exact year).
Näytä tämä ketju
-
This ended up giving rise to a forum dedicated to trying to crack the code, called Project Hyrule. The idea was that they could minimize the search space by minimizing data changes, coming up with a set of trade codes for all items, sent to "Link" in "Hyrule".
Näytä tämä ketju
In retrospect, knowing what I know about the trade code algorithm, it was destined to fail - but their hearts were in the right place. They also had a subforum for trying to crack the code programmatically, but the knowledge base was just not there.
-
-
Posts in the subforum included gems like "My big brother knows QBASIC, maybe he can help?" Again, in retrospect, it makes sense. Most of these people were kids in their early teens or even younger. I therefore decided to strike out on my own.
Näytä tämä ketju -
The first bit of useful info that I knew was that, being a port of an N64 game, the entire game was resident in RAM at all times. It never accessed the disc except on boot-up. Thus my goal became to get a dump of RAM from a running GameCube.
Näytä tämä ketju -
This was easier than one might expect, as I had a copy of Phantasy Star Online and a Broadband Adapter, so running trojan code was relatively easy. Legendary Gameshark hacker "Parasyte" came through in a clinch, and whipped up a quick utility to dump the full RAM space.
Näytä tämä ketju -
My next port of call was the
@dolphin_emu folks - yes, it was in development even then. One of their senior devs, Costis, was kind enough to whip me up a custom build that let me load this RAM image, disassemble code, and manually set register contents.Näytä tämä ketju -
The last key to the puzzle was Nintendo themselves, as they left the linker .map file on the disc when it was authored. I therefore had the address of every function in the game, and, well, those "mMpswd" functions sure look like "password", don't they?
Näytä tämä ketju -
This kicked off a 2-3 month period where I did little other than go to university, take my courses, get home, and work on painstakingly translating every function, instruction by instruction, into pseudo-C code.
Näytä tämä ketju -
After having every function reversed, I converted it into proper C. It required a good bit of debugging - fortunately, I had Dolphin to check my results against on a per-function basis - but at the end of it all, I was able to generate arbitrary trade codes.
Näytä tämä ketju -
It's now time for some info on the algorithm itself. It comprises many, many layers of obfuscation. A 21-byte buffer is assembled consisting of 8 bytes for the town, 8 bytes for the player, 2 item bytes, 2 info bytes, and a checksum byte.
Näytä tämä ketju -
These 21 bytes are subjected to a transposition cipher, a substitution cipher, random bit shuffling, being shifted like a massive barrel shifter, a cut-down version of RSA encryption, and finally converted into 28 6-bit characters and printed on-screen.
Näytä tämä ketju -
In summation, there was no way that this sort of algorithm could be brute-forced, simply due to the sheer number of transforms applied to the data. But it wasn't designed to withstand a university student with a surfeit of time and a working debugger. ~Fin
Näytä tämä ketju
Keskustelun loppu
Uusi keskustelu -
Lataaminen näyttää kestävän hetken.
Twitter saattaa olla ruuhkautunut tai ongelma on muuten hetkellinen. Yritä uudelleen tai käy Twitterin tilasivulla saadaksesi lisätietoja.