April 20, 2006

How to hack Xonix game

Xonix32 is an adaptation of the classic X-Windows game "Xonix" for the Win32 platform. You can download the game from http://dl.winsite.com/files/986/ar2/winnt/games/xonix060.zip. It is very interesting game. If you haven't tried till now just try it.

If you observe the directory which it is installed, you will find a file hiscores.dat. In this file it is storing all the high scores. Let start our game. Get any good hex editor. I used Hex workshop. Open the hiscores.dat file in hex editor. If you haven't played the game then by default the file looks as shown in below figure.
If you haven't worked with any hex editor before then continue this para otherwise you can skip it. Left hand portion (selected as red) shows the byte numbers. Middle part shows (selected as blue) the actual data in the file and right hand side shows the ascii value of that data in the file. If the software is storing directly your name and score in the file then you can observe that in the right hand side.

We can't gues any thing from this file. First play the game and make some score. Save the previous file before playing. I played the game and i scored 900 and i entered my name as "AAAAA". Open the file now and the file will look like this. Since it is not directly storing we can't find AAAAA in the right hand side portion. So it is doing some sort of encryption before storing the scores.If you observe three or four such files, you can find that, it is storing the score in the first 40 bytes. Xonix stores only 10 maximum score entries so each entry shoule be 4 bytes long. Now change the first two bytes to "0000". This we are doing to find out the XOR value. (usually they will XOR before storing data. To find the XOR value we are putting 0000). Save the file and open the Xonix and see the high scores. It will show your score as 21845 instead of 900 !. Means it is XORing 900 with 21845 and storing the result. We finally found the XOR value.

Now we will check whether what we found is correct or not. Let say we want to make our score 10000. The hexa decimal of 10000 is 2710. XOR this with 5555 (hexa decimal of 21845 is 5555) and you will get 7245. Since our machines are based on x86 architecture, it will store first low order byte and then it will store the high order byte. (This is called little endian format). So replace first byte with 4572. Now the file will look like this.

Make sure that you first close the Xonix before modifying the file. Otherwise those values will not get updated. Now save the file and open the Xonix. Now it will store your score as 10000!!!. Finally we have done. Similarly with some experimentation you can find out that it is storing the names also in the following portion of the file and each entry is 18 bytes long. Repeat the above procedure for names also.

All these i have done just for fun. Any way Xonix is open source program and you can find out this by seeing the source code. Thanks to Abhijit. With his suggestion only i cracked it.

1 comment:

  1. K S Sreshti12:43 PM

    Smart piece of work.
    Creates interest to crack the codes.

    ReplyDelete