Making a Speedrun Timer in D(bradley.chatha.dev)
bradley.chatha.dev
Making a Speedrun Timer in D
https://bradley.chatha.dev/blog/linux-speedrun-timer-dlang/post/
4 comments
Very cool post! I enjoy anything that has to do with game hacking, and it's nice to see D, a language I don't have a ton of experience with. Just one note you/the author may be curious about:
> Notably a process_vm_writev syscall also exists, however it adhears to memory page protections - so if I wanted to inject data into a write-protected memory page, it’d fail.
You can work around this by convincing the process to re-mmap() the read-only section with PROT_WRITE. One way I've done this is by building a shared library with __attribute__((constructor)) that gets LD_PRELOADed into the game binary, though you have to be careful with the timing (e.g. your library may start running before the game has allocated the mapping you're looking for). That said, if you've done this, you are also free to just allocate your own memory rather than having to look for unused portions of it.
> Notably a process_vm_writev syscall also exists, however it adhears to memory page protections - so if I wanted to inject data into a write-protected memory page, it’d fail.
You can work around this by convincing the process to re-mmap() the read-only section with PROT_WRITE. One way I've done this is by building a shared library with __attribute__((constructor)) that gets LD_PRELOADed into the game binary, though you have to be careful with the timing (e.g. your library may start running before the game has allocated the mapping you're looking for). That said, if you've done this, you are also free to just allocate your own memory rather than having to look for unused portions of it.
Ah nice - I had considered using LD_PRELOAD to do something similar (seeing if I could use mprotect on the mapping), but it felt like too much of an extra complication at the time.
I'd definitely consider giving it a try though if I the code injection becomes too annoying to keep track of doing it the ptrace 8-bytes-at-a-time way.
I'd definitely consider giving it a try though if I the code injection becomes too annoying to keep track of doing it the ptrace 8-bytes-at-a-time way.
Apparently the Deus Ex speedrun records are about 33 minutes (https://www.speedrun.com/dx). Meanwhile, I remember spending hours scouring that Statue of Liberty map.
"I semi-recently played through the original Deus Ex, and enjoyed my time with it so much that I felt like getting into speedrunning it, which ended up with me having to create a custom speedrun timer that “injects” itself into the game in order to implement features such as auto-splitting and load time removal.
This article details the rough journey I went through. It’s not super well structured, but I was sorely lacking resources such as this when I was implementing the more complicated parts of the timer, so I wanted to share my experience.
This is basically a detailing of “baby’s first game hack” as none of the techniques I’ve used here are advanced, and are more basic building blocks for injecting your own stuff into another process, but resources like this article were severely lacking/hard to find in my experience, so I imagine this will still be useful to someone.
If you read this entire thing then I’m afraid to say you have a fatal case of nerdism (welcome!)."