CHOWDER: The POWDER roguelike mod (0.6.0) 6/15

[Rashdolphin]

I have scoured the internet, and have found neither hacks or the password. BTW, Jeff is still messing with it but has not posted a new version because of the minority of changes that he is making.

[Cygni]

I'll send a copy of the original to my father (he works in cybersec) he might be able to figure something out. Also, is Jeff the OP?

[HxD]

I'll send a copy of the original to my father (he works in cybersec) he might be able to figure something out. Also, is Jeff the OP?

This game is a mod of Jeff's orignal game using the source code. You can find the untouched clean version of the game here (no vore, etc.): http://www.zincland.com/powder/index.php

I found this in creature.cpp

Code: Select all

   
if (rand_hashstring(glbAvatarName) == 3939879139u)
   {
       glbWizard = true;
   }
   else
   {
       glbWizard = false;
   }

I also found this in rand.cpp

Code: Select all

unsigned int
rand_wanginthash(unsigned int key)
{
    key += ~(key << 16);
    key ^=  (key >> 5);
    key +=  (key << 3);
    key ^=  (key >> 13);
    key += ~(key << 9);
    key ^=  (key >> 17);
    return key;
}

unsigned int
rand_hashstring(const char *s)
{
    unsigned int   hash = 0;
    if (!s)
   return hash;
    while (*s)
    {
   hash *= 37;      // Stolen from Perl.
   hash += *s;
   s++;
    }
   
    return rand_wanginthash(hash);
}


It seems like it uses something like: http://burtleburtle.net/bob/hash/integer.html ?

main.cpp has stuff for stress test mode:

Code: Select all

if (rand_hashstring(glbAvatarName) == 0x7a51ad9b)
       glbStressTest = true;


[Rashdolphin]

Jeff is the creator of the game, and i hope your father can find a loophole.

[HxD]

Jeff is the creator of the game, and i hope your father can find a loophole.

The easiest thing to do would be to donate any amount of money here to get the passwords: http://www.zincland.com/powder/index.ph ... ame=donate

The program could be edited to have a fix password without any hashing, but that would require editing the source code.

[Cygni]

It seems to be C++ so decompiling it shouldn't be too difficult. And if it's just a password, it should be written in the code. I'll let you guys know what he says. But if the creator is still around, I guess you can donate a penny or something

[HxD]

It seems to be C++ so decompiling it shouldn't be too difficult. And if it's just a password, it should be written in the code. I'll let you guys know what he says. But if the creator is still around, I guess you can donate a penny or something

No need to decompile unless you want the v2 mod source.

Unmodded Source code is located here http://www.zincland.com/powder/release/ ... src.tar.gz

As for the passwords, read my post above. From my understanding, the player name gets hashed and the game checks the hash against 3939879139u for Wizard Mode and 0x7a51ad9b for stress test mode. The unhashed password wouldn't be in plain text for obvious reason.

[Skeiron]

The original game is a passion project by one guy, who gave the game and source code away for free, and only leaves these features out behind a donation of literally any amount of money. And you want to go and get your dad who happens to be a cybersecurity professional to perform some morally and legally grey activities to extract that one portion of the game for free? Sorry but that is pathetic. Just pay the guy.

[nyanyan]

I don't get the big deal about wish, really. You want those features?

Polymorph: Find a wand or piss off one of the gods, might just get ya changed.

Skip a level: Find a hole.

Monsters: There is a spawn monster wand.

Leveling: Punch things.

Getting wish is just an easy-ish way out, not really what a rogue-like is meant to have. They're supposed to be punishing. I have yet to beat any of the rogue-likes I've played, but I still enjoy every single one.

Now, to keep this from snowballing, how 'bout a random thought: I find a polymorph wand to be the best item you can get in a run, just about. Hit yourself and you have a chance to become ALL POWERFUL!!!! (results may vary) or you can use it on an enemy for a less scary enemy (though, upon defeat, they return to normal), etc.

My best runs have been Wizard/Polymorph runs. If you get a good enough morph, you can almost 1-shot everything up to 11 or so, eat things which seem to instantly die (most of the time) and you usually have MUCH better stats...though...becoming a snake/bug is a small problem.

[WHTB]

The hashes are *really* easy to defeat. The second part, the "rand_wanginthash" function, can be reversed by brute forced in under a minute, because it just uses the 32-bit range. After that you can worry about just the string part without having to do the second part each and every time.

I just brute forced the password out of boredom. But really, you have the source. You can just modify it to give yourself whatever godlike powers you want. Or even change the password itself. You can change the hard coded hashes, or just change the entire authorization check entirely so you don't even need a password.

Edit: By this point I've actually discovered two passwords that work for Wizard Mode, and seven passwords that work for Stress Test mode, because the hash function has so many collisions.

[HxD]

The hashes are *really* easy to defeat. The second part, the "rand_wanginthash" function, can be reversed by brute forced in under a minute, because it just uses the 32-bit range. After that you can worry about just the string part without having to do the second part each and every time.

I just brute forced the password out of boredom. But really, you have the source. You can just modify it to give yourself whatever godlike powers you want. Or even change the password itself. You can change the hard coded hashes, or just change the entire authorization check entirely so you don't even need a password.

Edit: By this point I've actually discovered two passwords that work for Wizard Mode, and seven passwords that work for Stress Test mode, because the hash function has so many collisions.

>Doesn't know how to brute force the function due to lack of integer hash understanding
>Never coded in C++
>Realizes modifying a compiled binary (since the author of the mod didn't provide source) would be hard without learning assembly and debugging
>Hopes WHTB will show us the passwords without question

[WHTB]

>Realizes modifying a compiled binary (since the author of the mod didn't provide source) would be hard without learning assembly and debugging

That actually raises a ton of red flags in my mind. If this were a game under the GPL, then it would be a violation of that license. I checked the license that comes with the code (in the COPYING file) and found out that the author of the original POWDER is not actually okay with distributing modified versions of the game, unless they're so much modified that it doesn't even resemble the original game anymore...

The license file says...

Code: Select all

1) This is *NOT* an Open Source license.  This code is not "free".

2) You can redistribute the UNCHANGED source non-commercially.

3) You can modify the source to port to other platform or get it to
   compile on your system. ("The above rights include the right to
   make such modifications as are technically necessary to exercise
   the rights in other media and formats.")  You may also publish the
   resulting changes to the source.
   a) You are not required to publish the changes, but I encourage you
      to provide them to me to roll into the main POWDER baseline.

4) You may *NOT* "fork" the POWDER distribution.  But...
   a) You can extract "samples" from the distribution.  These samples
      can be used commercially.  The samples must not constitute a
      substantial part of your new work.  For example, you could lift
      the Line of Sight routines for your roguelike and merge it into
      whatever new license you wish.
   b) You can "mash up" the code.  Think "total conversion" - a result
      which a player would not recognize the similarities to POWDER.


[HxD]

>Realizes modifying a compiled binary (since the author of the mod didn't provide source) would be hard without learning assembly and debugging

That actually raises a ton of red flags in my mind. If this were a game under the GPL, then it would be a violation of that license. I checked the license that comes with the code (in the COPYING file) and found out that the author of the original POWDER is not actually okay with distributing modified versions of the game, unless they're so much modified that it doesn't even resemble the original game anymore...

The license file says...

Code: Select all

1) This is *NOT* an Open Source license.  This code is not "free".

2) You can redistribute the UNCHANGED source non-commercially.

3) You can modify the source to port to other platform or get it to
   compile on your system. ("The above rights include the right to
   make such modifications as are technically necessary to exercise
   the rights in other media and formats.")  You may also publish the
   resulting changes to the source.
   a) You are not required to publish the changes, but I encourage you
      to provide them to me to roll into the main POWDER baseline.

4) You may *NOT* "fork" the POWDER distribution.  But...
   a) You can extract "samples" from the distribution.  These samples
      can be used commercially.  The samples must not constitute a
      substantial part of your new work.  For example, you could lift
      the Line of Sight routines for your roguelike and merge it into
      whatever new license you wish.
   b) You can "mash up" the code.  Think "total conversion" - a result
      which a player would not recognize the similarities to POWDER.


"2) You can redistribute the UNCHANGED source non-commercially." The source is compiled, so it shouldn't matter. It also doesn't say that you cannot distribute modified source (unless mean 4, but one can argue the meaning of fork).

Also, who is going to care anyway? Why did you also ignore everything else but that line? *cough*passwords plz :c*cough*

[WHTB]

"2) You can redistribute the UNCHANGED source non-commercially." The source is compiled, so it shouldn't matter. It also doesn't say that you cannot distribute modified source (unless mean 4, but one can argue the meaning of fork).

Also, who is going to care anyway? Why did you also ignore everything else but that line? *cough*passwords plz :c*cough*

It doesn't have to say that you cannot distribute modified source because you are already not allowed to without explicit permission under copyright law. Any permissions it doesn't give you are permissions you do not have. In here the only way you are allowed to distribute binaries are as a port to some system, and does not cover gameplay alterations. It's a bad, ambiguous license that was actually adapted from a Creative Commons license designed to allow musicians to sample from music that was placed under the license. That original license was so flawed that it was retired by the Creative Commons people and they don't recommend using it anymore: http://creativecommons.org/licenses/sampling+/1.0/ .

Everyone else who got the passwords has managed to keep them a secret so far. I won't be the one to spill the beans. I will, however, leave a sha256 checksum of a file with the code to do the cracking, in case I need to verify this later.

Code: Select all

86167706441587efde8be2d5ade7682e2e63c13523643615cfb85c6c50ea9caa  main.cpp


[darkevilme]

So. The game has an intensely unpleasant visual aesthetic and ui, modding it might be morally questionable and modding it requires so much dependency archeology that it's difficult to do. This project just might be ill conceived. just a thought.

I'm not saying that the OP shouldn't create more vore material of a gameish bent. That'd be hypocritical of me...but..why modding THIS game to do it?

[HxD]

"2) You can redistribute the UNCHANGED source non-commercially." The source is compiled, so it shouldn't matter. It also doesn't say that you cannot distribute modified source (unless mean 4, but one can argue the meaning of fork).

Also, who is going to care anyway? Why did you also ignore everything else but that line? *cough*passwords plz :c*cough*

It doesn't have to say that you cannot distribute modified source because you are already not allowed to without explicit permission under copyright law. Any permissions it doesn't give you are permissions you do not have. In here the only way you are allowed to distribute binaries are as a port to some system, and does not cover gameplay alterations. It's a bad, ambiguous license that was actually adapted from a Creative Commons license designed to allow musicians to sample from music that was placed under the license. That original license was so flawed that it was retired by the Creative Commons people and they don't recommend using it anymore: http://creativecommons.org/licenses/sampling+/1.0/ .

Everyone else who got the passwords has managed to keep them a secret so far. I won't be the one to spill the beans. I will, however, leave a sha256 checksum of a file with the code to do the cracking, in case I need to verify this later.

Code: Select all

86167706441587efde8be2d5ade7682e2e63c13523643615cfb85c6c50ea9caa  main.cpp


You clearly know more than me on that topic, so I'll stop.

Now, as for the sha256 checksum..... Google came up empty. I guess it's a specific main.cpp out of the million cpp files in the world. Rip me.

[WHTB]

Now, as for the sha256 checksum..... Google came up empty. I guess it's a specific main.cpp out of the million cpp files in the world. Rip me.

It's the one I wrote from scratch (except for copy+pasting and tweaking the hash functions) to crack the hashes. I just put the checksum up in case I need to prove it existed at the time I made the post, if I have to post the actual code later. =P

[blackrock215]

I'm back. There's been a bit of debate here since I last checked in, so I'll go ahead and respond to everything in turn...

As for the summoned creature bug - I didn't think of that, good catch. I'll look at fixing that in 0.0.3.

Not sure what's the deal with the main download, it just says 'unpublished.' I suppose the backup download will have to do until then.

There's not much I can do about the UI as of now, as not only is my understanding of the code not advanced enough to allow serious transformations of the UI, but the UI is currently some of the most spaghetti code in the entire program.

And as for the whole 'wishing' thing, chill out guys, I reintroduced it to the game. It was a simple one line transplant in the code. I'll push it, along with a few misc fixes, tonight as v0.0.2.

And I'll agree that releasing the game is a legal gray area. Dark gray. Probably edging toward black. The game's so old the licence it was protected under is now depreciated, and since this is both non-commercial and such a fringe mod I was hoping nobody would mind. I suppose if it's an issue I'll drop the downloads but I'd probably keep working on it, in my off time, even if it was taken down.

Why this? Honestly, I wanted to see if I could. I played POWDER extensively on my phone and pc way back when and when I realized that the source code was available I thought I'd give it a crack. I'd seen a lot of the games other people'd modded and thought to myself 'I could probably make a mod like that." This was the proof of concept, I guess.

[HxD]

I'm back. There's been a bit of debate here since I last checked in, so I'll go ahead and respond to everything in turn...

As for the summoned creature bug - I didn't think of that, good catch. I'll look at fixing that in 0.0.3.

Not sure what's the deal with the main download, it just says 'unpublished.' I suppose the backup download will have to do until then.

There's not much I can do about the UI as of now, as not only is my understanding of the code not advanced enough to allow serious transformations of the UI, but the UI is currently some of the most spaghetti code in the entire program.

And as for the whole 'wishing' thing, chill out guys, I reintroduced it to the game. It was a simple one line transplant in the code. I'll push it, along with a few misc fixes, tonight as v0.0.2.

And I'll agree that releasing the game is a legal gray area. Dark gray. Probably edging toward black. The game's so old the licence it was protected under is now depreciated, and since this is both non-commercial and such a fringe mod I was hoping nobody would mind. I suppose if it's an issue I'll drop the downloads but I'd probably keep working on it, in my off time, even if it was taken down.

Why this? Honestly, I wanted to see if I could. I played POWDER extensively on my phone and pc way back when and when I realized that the source code was available I thought I'd give it a crack. I'd seen a lot of the games other people'd modded and thought to myself 'I could probably make a mod like that." This was the proof of concept, I guess.

I like the current UI of the program since it gives it that old, retro feel. c:
As for Wizard Mode, I already got it to work on my end by editing the exe. No special passwords needed.

I wouldn't care about that license too much, but if you really want to, you could make a patch file that could modify the original game to become your mod. Check out lunar ips or something similar for more information.

[ekadragon]

As a question for the person working on this mod, I have to ask.... are you intending on making it implemented so enemies can do more than one kind of vore (CV, UB, AV, absorb etc) to the player and for the player to be able to make a choice which they want done to them if they offer themseleves? I saw in your Q&A about posting about it, but I figure that having the question readily able to be referenced in your topic would help.