Just something that might be useful to others. I couldn’t find a copy of this anywhere else online. This should contain every point on the map. If anyone finds any more, please let me know!
I recently bought the game LISAon Steam, and the humor approach is fascinating. Unfortunately, this approach involves being incredible vague, or outright obtuse, at telling you what is going on, or what is going to happen if you do something. The very first choice you have in the game is whether to choose “Pain” mode or “Normal” mode. It doesn’t tell you anything beyond that. Unfortunately, I interpreted this as “Normal” and “Easy”, and so I chose the former “Pain” mode. One of the “features” of pain mode is that you can only use save points once, and there are only 36 of them in the game, spread very far apart. After I was a few hours into the game, and I realized how much of a bother this was going to be, especially because it meant I had to play in possible multi-hour chunks, not knowing when I would get to stop. I didn’t feel like replaying up until that point, so I decided to do some save game file hacking, as that is part of the fun for me.
DO NOTE, this method involves deleting some of the data in the game file, specifically a bunch of boolean flags, which might cause some events in the save to be “forgotten”, so they will reoccur. At the point of the game I was at, the few deleted flag actions that I encountered didn’t affect anything big or of importance. One example of this is the long-winded character repeats his final soliloquy when you enter his map.
So, to switch from “Pain” mode to “Normal” mode in the save file, do the following:
Your save files are located at %STEAM_FOLDER%/steamapps/common/LISA/Save##.rvdata2
Backup the specific save file you want to edit, just in case.
Open that save file in a hex editor. You might need to be in steam offline mode for the edit to stick.
Search for “@data[”. Immediately following it are the hex character “02 02 02”. Delete them and in their place, add the hex character 0x73 (“s”).
Following the “s” character that you just added are 514 bytes that are either “0”, “T”, or “F”, and then a colon (“:”)
Keep the first 110 of these bytes, and then delete everything up to the colon (which should be 404 bytes).
Back in May of 2007 one of my friends got me onto Second Life, the first and only MMORPG I’ve touch since my Ragnarok days. While Second Life had a strong pull for me due to its similarities to The MetaVerse in Snow Crash, my favorite book, I was of course more drawn to playing with the Engine and seeing what I could do with it.
I felt no real need to delve into the code or packet level of the client as it was open source, so I stayed mostly on the scripting level side of things in the world. IIRC I did find at least a dozen major security holes, but I unfortunately cannot seem to find logs of my research :-(.
I do however remember at least 2 of the security holes I found:
While an avatar could not pass through solid walls normally, if an object was visible that allowed “sitting” beyond the walls, the user could issue the sit command on that object which transported the avatar past the barriers.
While there were optional restrictions on areas pertaining to if/where an object could be placed, once an object was placed somewhere, it could be “pushed” to almost any other location no matter the restrictions. When an object was pushed into another area beyond where it was placed, it was still inventoried as being in the originally placed location, but could interact with the world at the location it was actually at. Objects could even pass through solid barriers if the proper push velocities were given. The only way at the time to combat this was to have whole private islands as blocking anonymous objects. This security hole opened up multiple other security holes including:
If a user “sat” on the object, they could get to anywhere the object could.
These objects could be used to interact with the immediate world around them, including repeating private conversations in a private area.
I had also at the time planned on writing an application that allowed hijacking and reuploading any encountered texture or construct, which was trivial due to the open nature of the system. I never did get around to it for two reasons. First, I got distracted by other projects, and second, because it could have seriously destabilized the Second Life economy, which was built around selling said textures and constructs. I actually liked what Second Life was trying to accomplish and had no wish of making Linden Lab’s life harder or ruining the experiment in open economy.
I was however able to find a few pieces of my research and scripts that I figured I could post here. First, I do not recall what I did to find this, but the entire list of pre-defined “Last Names” was accessible, and IIRC the proprietary last names could be used for character creation if you knew how to access them (not 100% sure if this latter hack was available). Here was the list as of when I acquired it in 2007. I had the list separated into two columns, and I think they were “open” names and “proprietary” names. Each name is followed by its identifier.
The second piece I was able to find was a script I used to alert me via email whenever one of my friends signed on. I have unfortunately not tested this script before posting it as I no longer have Second Life installed or wish to waste the time testing it, but here it is none the less. ^_^;
//Users to watch
key DetectPersons=[ //List of UIDs of users to watch. (Real UIDs redacted)
"fdf1fbff-f19f-ffff-ffff-ffffffffffff", //Person 1
"f0fffaff-f61f-ffff-ffff-ffffffffffff" //Person 2
];
//Other Global Variables
integer NumUsers;
integer UsersParsed=0;
list UserNames;
list Status;
default
{
state_entry()
{
NumUsers=llGetListLength(DetectPersons); //Number of users to watch
//Get User Names
integer i;
for(i=0;i<NumUsers;i++)
{
llListInsertList(UserNames, [''], i);
llListInsertList(Status, [0], i);
llRequestAgentData(llList2Key(DetectPersons, i), DATA_NAME);
}
}
dataserver(key requested, string data)
{
//Find User Position
integer i;
for(i=0;i<NumUsers;i++)
if(llList2Key(DetectPersons, i)==requested)
llListReplaceList(UserNames, [data], i, 1);
if(++UsersParsed==NumUsers)
state Running;
}
}
state Running
{
state_entry()
{
llOwnerSay((string)UserNames);
llOwnerSay((string)Status);
llSetTimerEvent(30);
}
timer()
{
llRequestAgentData(DetectPerson, DATA_ONLINE);
}
dataserver(key requested, string data)
{
if(data==IsOnline)
return;
IsOnline=data;
if(data=="0")
return;
string Message="The user you are watching '"+UserName+"' signed on at "+llGetTimestamp();
llEmail(EMAIL_ADDRESS, "User Signed on", Message);
llOwnerSay(Message);
}
}
Of course all this research was from 2007 and I have no idea what is capable now. I do really hope though that they at least updated the client’s interface because it was incredibly clunky. Also, Second Life has always been a neat experiment, and I hope it still is and continues to keep doing well :-).
Ugh. It’s been a month today since I made my last post here. Things have just been way, way too busy! I’ll try to pick up on the content regularity, once again. I should be able to handle at least a few weeks worth of semi-regular updates ^_^;.
I’ll keep today’s post short and simple :-).
Chrono Trigger for the Nintendo DS was released a few weeks ago, which came relatively shortly after the release of Final Fantasy IV for the DS. I should mention Chrono Trigger is one of my all time favorite games. I’ve played it more time than I can count, and was very happy for a port to the DS. Yay :-).
It’s pretty much the exact same as the original, not like the 3D updates that were the Final Fantasy ports. It has all the typical “Extras” systems added on to game ports these days like keeping track of the monsters you’ve fought (bestiary) and items you’ve collected, game art, cutscene replaying, game music jukebox, maps of all the levels, etc. It also has a few GUI updates, 2 new areas, a pokemon type fight-your-friend-over-the-DS-with-a-monster type system, and last but definitely not least, a great new translation.
The new translation is probably the best thing about the port. Tom Slattery did a wonderful job on it, though to his credit (according to Wikipedia ^_^; ) Ted Woolsey was only given 30 days to do the original translation. The new levels are all pretty lame :-\ but oh well. I still haven’t finished going through most of them because they involve a lot of annoying back-and-forth between time periods, and bad level design.
The main thing I wanted to mention was a single line of translation that really made me smile. If you take Ayla to Robo’s extra side quest, at one point she says “What you say?” ... Any of you nerds out there should know what that references :-).
Anywho, yeah, Chrono trigger is awesome. And now back to your regularly scheduled mostly technical posts... ^_^;
Never rely solely on information you receive from untrusted sources
One of the most laughable aspects of client/server* systems is client side based security access restrictions. What I mean by this is when credentials and actions are not checked and restricted on the server side of the equation, only on the client side, which can ALWAYS be bypassed.
To briefly explain why it is basically insane to trust a client computer; ANY multimedia, software, data, etc that has touched a person’s computer is essentially now their property. Once something has been on or through a person’s computer, the user can make copies, modify it, and do whatever the heck they want with it. This is how the digital world works. There are ways to help stop copying and modification, like hashes and encryption, but most of the ways in which things are implemented nowadays are quite fallible. There may be, for example, safeguards in place to only allow a user to use a piece of software on one certain computer or for a certain amount of time (DRM [Digital Rights Management]), but these methods are ALWAYS bypassable. The only true security comes by not letting information which people aren’t supposed to have access to cross through their computer, and keeping track of all verifiable factual information on secure servers. A long time ago at an IGDA [International Game Developers Association] meeting (I only ever went to the one unfortunately :-\), I learned an interesting truth that hadn’t occurred to me before from the lecturer. That is, that companies that make games and other software [usually] know it will sooner or later be pirated/cracked**. The true intention of software DRM is to make it hard enough to crack to discourage the crackers into giving up, and to make it take long enough so that hopefully people stop waiting for a free copy and go ahead and buy it. By the time a piece of software is cracked (if it takes as long as they hope), the companies know the majority of the remainder of the people usually wouldn’t have bought it anyways. Now I’m done with the basic explanation of client side insecurities, back to the real reason for this post.
While it is actually proper to program safeguards into client side software, you can never rely on it for true security. Security measures should always be duplicated in both client and server software. There are two reasons off the top of my head for implementing security access restrictions into the client side of software. The first is to help remove strain on servers. There is no point in asking a server if something is valid when the client can immediately confirm that it isn’t. The second reason is for speed. It’s MUCH quicker if a client can detect a problem and instantly inform the user than having to wait for a server to answer, though this time is usually imperceptible to the user, it can really add up.
So I thought I’d give a couple of examples of this to help you understand more where I’m coming from. This is a very big problem in the software industry. I find exploitable instances of this kind of thing on a very regular basis. However, I generally don’t take advantage of such holes, and try to inform the companies/programmers if they’ll listen. The term for this is white hat hacking, as opposed to black hat.
First, a very basic example. Let’s say you have a folder on your website “/PersonalPictures” that you wanted to restrict access to with a password. The proper way to do it would be to restrict access to the whole folder and all files in it on the server side, requiring a password be sent to the server to view the contents of each file. This is normally done through Apache httpd (the most utilized web server software) with an “.htaccess” file and the mod_auth (authentication) module. The improper way to do it would be a page that forwarded to the “hidden” section with a JavaScript script like the following.
if(prompt('Please enter the password')=='SecretPassword')
document.location.href='/PersonalPictures';
The problem with this code is two fold (besides the fact it pops up a request window :-) ). First, the password is exposed in plain text to the user. Fortunately, passwords are usually not as easy to find as this, but I have found passwords in web pages and Flash code before with some digging (yes, Flash files (and Java!) are 100% decompilable to their original source code, sans comments). The second problem is that once the person goes to the URL “/PersonalPictures”, they can get back there and to all files inside it without the password, and also give it freely to others (no need to mention the fact that the URL is written in plain text here, as it’s the same as with the password). This specific problem with JavaScript was much more prevalent in the old day when people ran their web pages through free hosting sites like Geocities (now owned and operated by Yahoo) which didn’t allow for proper password protection.
This kind of problem is still around on the web, though it morphed with the times into a new form. Many server side scripts I have found across the Internet assume their client side web pages can take care of security and ignore the necessary checks in the server scripts. For example, very recently I was on a website that only allowed me to add a few items to a list. The way it was done is that there was a form with a textbox that you submitted every time you wanted to add an entry to the list. After submitting, the page was reloaded with the updated list. After you added the maximum allowed number of items to the list, when the page refreshed, the form to add more was gone. This is incredibly easy to bypass however. The normal way to do this would be to just send the modified packets directly to the server with whatever information you want in it. The easier method would be to make your own form submission page and just submit to the proper URL all you want. The Firebug extension for Firefox however makes this kind of thing INCREDIBLY easy. All that needs to be done is to add an attribute to the form to send the requests to a new window “<form action=... method=... target=_blank>”, so the form is never erased/overwritten and you can keep sending requests all you want. Using Firebug, you can also edit the values of hidden input boxes for this kind of thing.
AJAX (Asynchronous JavaScript and XML - A tool used in web programming to send and receive data from a server without having to refresh a page) has often been lampooned as insecure for this kind of reason. In reality, the medium itself is not insecure at all; it’s just how people use it.
As a matter of fact, the majority of my best and most fun Ragnarok hacking was done with these methods. I just monitored the packets that came in and out of the system, reverse engineered how they were all structured, then made modifications and resent them myself to see what I could do. With this, I was able to do things like (These should be most of the exploits; listed in descending order of usefulness & severity):
Duplicate items
Crash the server (It was never fixed AFAIK, but I stopped playing 5+ years ago. I just put that it was fixed on my site so people wouldn’t look for it ^_^; )
Warp to any map from any warp location (warp locations are only supposed to link to 1 other map)
Spoof your name during chats (so you could pretend someone else was saying something - Ender’s game, anyone? ^_^)
Use certain skills of other classes (I have up pictures of my swordsman using merchant skills to house a selling shop)
Add skills points to an item on your skill tree that is not yet available (and use it immediately)
Warp back to save point without dying
Talk to NPCs on a map from any location on that map, and sometimes from other maps (great for selling items when in a dungeon)
Attack with weapons much quicker than was supposed to be allowed
Use certain skills on creatures from any location on a map no matter how far they are
Equip any item in any spot (so you could equip body armor on your head slot and get much more free armor defense points)
Run commands on your party/guild and in chat rooms as if you were the leader/admin
Rollback a characters stat’s to when you logged on that session (part of the dupe hack)
Bypass text repetition, length, and curse filters
Find out user account names
The original list is here; it should contain most of what I found. I took it down very soon after putting it up (replacement here) because I didn’t want to explicitly screw the game over with people finding out about these hacks (I had a lot of bad encounters with the company that ran the game, they refused to acknowledge or fix existing bugs when I reported them). There were so many things the server didn’t check just because the client wasn’t allowed to do them naturally.
Here are some very old news stories I saved up for when I wrote about this subject:
Just because you don’t give someone a way to do something doesn’t mean they won’t find a way.
*A server is a computer you connect to and a client is the connecting computer. So all you people connecting to this website are clients connecting to my web server.
**“Cracked” usually means to make a piece of software usable when it is not supposed to be, bypassing the DRM
Whenever I need to take a break from working to help clear my mind, there are a few types of “repetitive” or short games I enjoy to play.
One of these is Freecell, a solitaire game that comes with XP, and also came with some versions of Windows 98. I really enjoy it because it is a game of pure reason, with no random chance. You know where all the cards are from the beginning and every game is winnable (theoretically at least... I’ve heard there are 2 combinations of the million possibilities in the Windows version that are unwinnable). When I was playing it a lot, I used to easily be able to win dozens of games in a row in under 2 minutes per game. My goal for this game for a long time has been to win 100 games straight without a loss. I have so far clocked in at ~80 as a record IIRC. Always with the stupid mistakes!
Another fun game I discovered in a computer blow-off class my senior year of high school was Icy Tower. I just picked it back up a few weeks ago, and it’s horribly addicting! I really like it because it’s about 90% skill and 10% randomness. Games that require quick reflexes and sharp hand eye coordination have always been one of my favorite genres, and Icy Tower is full of this. I’ve often found myself while playing the game wishing I could come up with a good idea like it, as programming something of its nature would be incredibly fun. I recently made a high score that I was pretty proud of until I noticed the world high score boards for the game, which are pretty insane (I am linking to a thread instead of the official high score board because the latter is badly programmed and incredibly slow). I can’t help but think a lot of those people cheated... but anywho, the game allows you to save replays of your games, and the file for my high score game is here, and I included a video of it below (more for demonstration of the game ^_^; ). Videos will be uploaded as soon as I get my video card replacement for my laptop, due in later this month, as my current one is failing, but you might as well download the game and play it some, and could watch the better rendered replay there anyways... not that anyone has any reason too watch it, but still XD.
Oh, the memories of the good old days of gaming! When video games were far and few between, and could be made by one to a handful of people. Yesterday’s post [Video Game Nostalgia] touched on some old games I played when I was but a lad. I decided for today I’d drag out a lot of the old stuff, see what I still had for curiosity sake, and take a picture :-).
All of the software packages are DOS applications (except the Windows upgrades, obviously, and Visual Basic), most everything says for the “IBM/TANDY” :-).
On a silly side note, I had the bad habit of calling PCs (Personal Computers) “IBM Compatibles” (as opposed to Apples) until like 1998, heh.
From left to right, top to bottom:
My dad’s TRS-80 Model 100. The story goes that when he used to have to get up at night to take care of my older sister when she was a baby in ’82, he used it to instant message friends on CompuServe over its 300 baud modem while rocking her back to sleep or such. I also played with a TRS-80, which also belonged to my dad, at my grandfather’s house one summer, and did some programming on it in Basic when I was ~12 :-).
Microsoft Paintbrush (1985-1986 - Yes, this was once a program you actually had to buy. The manual is a pretty and colorful little neatly bound ring-binder too ^_^).
So a comic [Gunnerkrigg Court] that I enjoy and read daily [updates MWF] recently referenced Metal Gear Solid, which finally made me decide to play through the series.
For reference, whenever I bring up games from here on out, it’s usually to talk about encountered problems, which I will usually provide fixes for, or technical aspects of the game. I’m not qualified, or funny enough, to want to review games; and that is not the purpose of my postings here.
The first thing I wanted to mention is a fix for a graphical problem. As the game is rather “old” (released in 2000 for Windows), it can be incompatible with modern systems. One of the options it uses in hardware mode is 8-bit textures, which is no longer supported, though for the life of me I can’t see why a hack could be made in the video card drivers for this problem. Because of this, the game only allows you to run in software mode. After a lot of digging and searching, in which every place said the same thing (it’s not fixable), I finally founda hacked executable [Metal Gear Solid v1.0 [ENGLISH] No-CD/WinXP+Vista+GeForce+ATi Fixed EXE] made by a kind sole to fix the problem.
Another problem which really frustrated me was a “puzzle” in the game referring to looking for information on the “back of the CD case”. I had just received an “optical disk” in the game, however, it appeared to be a floppy disk and no matter what I did I couldn’t find the required information with the item. I figured it must have been a bug and finally gave in and looked it up online. It turns out they meant the actual CD case the game came in had a number [radio frequency] written on the back of it - “140.15”. I can only assume they did this as a means of “copy protection” to frustrate anyone who didn’t actually buy the game. Unfortunately, I acquired the game without a CD case so I was frustrated by this myself.
This kind of system reminded me of the very old days of gaming in which some games asked you to input a certain word from a certain paragraph on a certain page of the manual to enter the game, or asked questions with answers found in the manual. One of the games I had that did the former was Teenage Mutant Ninja Turtles [1989] for DOS. I have fond memories of playing this and a (monochrome? [green and black :-) ] IIRC?) version of Muppet Adventure: Chaos at the Carnival [1989] (Dear Thor! heh) [also a DOS game] as they were, IIRC, two of my first video games, though I got many others around that time. Both games had later released NESports too.
My real favorite childhood games however, which are still both cult classics, were Doom, which got me into the design aspect of making games, and most importantly, ZZT, which is what really got me started on programming in 1991 at the age of 5. I still have the original floppy disks for ZZT too :-). ZZT was more scripting than programming though, and I didn’t start real programming until I got into QBasic in 1993. I might release some of my creations for these games one of these days for nostalgic sake ^_^;. I also remember thoroughly enjoying Star Trek: 25th Anniversary for DOS in 1992 :-). I was a nerd even as a kid! ^_^; This game also had copy protection I had forgotten about. As Wikipedia tells:
The game had a copy-protection system in that the player was forced to consult the game’s manual in order to find out which star system they were supposed to warp to on the navigation map. Warping to the wrong system would send them into either the Klingon or Romulan neutral zones, and initiate an extremely difficult battle that often ends with the destruction of the Enterprise.
I got back from a couple day trip to Dallas last night. Man do I hate that drive, especially when it’s raining so hard you can barely see 6 feet in front of you, which seems to happen almost every time any of my friends or family make that drive (from Dallas to Austin or vice versa).
I just now beat Final Fantasy 4 DS too, yay. I was thoroughly happy with the remake they did of the game this time around, of which it had only one or two trifle annoyances of no real consequence, which is surprising for me as I always seem to find heavy fault in everything remade that I held dear as a child. The new game plus feature, as far as I can see, is pretty worthless though, as all it leaves you with is the augments, which I didn’t even use anyways. The cut scenes were all excellent, especially the opening credits pre-rendered cinematics, which I have included below. Now all I really have to wait for is the Chrono Trigger remake they are doing for the DS!!! :-D
I also finished the Eragon books again over the weekend, so with all of that sidetracking stuff out of the way I will be getting back to regularly posting stuff here as promised.
Final Fantasy IV DS Opening High Quality Stolen from YouTube, owned by SquareSoft
Final Fantasy IV DS Characters Art
Owned by SquareSoft, Image from GamesPress
The only time when having too much money is a problem
I had meant to write this post back when I beat “Zelda: Twilight Princess” a few days after it and the Nintendo Wii came out in 2006, but never got around to it, and the idea of writing about a game that came out long ago seemed rather antiquated. The initiative to write this post popped up again though as I just finished replaying “Zelda: Ocarina of Time” (N64).
I have been a really big Zelda fan for a very long time, and have played most of the series. I got to a GameStop ~8 hours, IIRC, before they started preordering the Wii to make sure I could play Twilight Princess as soon as it came out, as I was very anxious to play it. It was a good thing I did too, because when the Wii actually came out, they were next to impossible to acquire. I knew of many people having to wait in lines well over 15 hours to get one soon after the release, and they were still rarities to attain well over a year later.
While I really enjoyed Twilight Princess, I was very frustrated by a rupee and treasure problem. “Zelda” (NES) and “Link to the Past” (SNES) had it right. Whenever you found a secret in those games it was something really worth it, namely, a heart piece (increased your life meter), or often even a new item. Rupees (in game money) were hard earned through slaying enemies, only rarely given in bulk as prizes, and you almost always needed more. As I played through Twilight Princess, I was very frustrated in that almost every secret I found, while hoping for something worth it like a heart pieces, was almost always a mass of rupees. There were at least 50 chests I knew of by the end of the game filled with rupees that I couldn’t acquire because I was almost always maxed out on the amount I could carry. What’s even worse is that the game provided you a means to pretty much directly pinpoint where all heart pieces were. These problems pretty much ruined the enjoyment of the search for secret treasures in the game. You could easily be pointed directly to where all hearts were, new game items were only acquirable as primary dungeon treasures, and the plethora of rupees was next to worthless.
So, as I was replaying Ocarina of Time, I realized how unnecessary rupees were in that game too. There are really only 2 places in the whole game you need rupees to buy important items; one of which is during your very first task within the first few minutes of the game. The only other use for rupees is for a side quest to buy magic beans which takes up a small chunk of your pocket change through the game, but besides that, there is no point to the money system in the game as you never really need it for anything. What’s even more a slap in the face is that one of the primary side quests in the game just rewards you with larger coin purses to carry more rupees, which again, you will never even need to use.
While these games are extremely fun, this game design flaw just irks me. Things like this will never stop me from playing new Zelda games however, or even replaying the old ones from time to time, especially my by far favorite, Link to the Past, as they are all excellent works. I would even call them pieces of art. Miyamoto forever :-).
I am a big fan of many SquareSoft games, namely, Final Fantasy 4 (US2), Final Fantasy 6 (US3), and Chrono Trigger. I played all of these on the Super Nintendo many many years ago, and still replay them from time to time through emulator.
I recently recalled that re-releases of these games on the PlayStation consoles included cut scenes, so I decided to look them up. I figured these would be of use to anyone in my boat who is a fan of the old school games but never got to see these.
I included the original links to these videos, which contain author credits, in the title. All videos were found on YouTube, and of course, owned by SquareSoft.
