caustik's blog

gnireenigne

autoblitz + source code

161 Comments »

Since some folks have expressed interest in trying this bot for themselves, I decided to share the source code and binary :)

It’s not perfect, but you can tweak the source code (for example, changing how long rp_thread::sleep() is called, and where), and probably get some better performance. If you’re up for a challenge, you can also try to improve the code that decides on the next move! (if you do, it’d be great if you shared the changes!).

Anyway, here is the zip file. [ autoblitz-export.zip ]

The binaries are in the export directory. You will be asked for a “hWnd” (window handle), which can be found using the program “Spyxx” which comes with visual studio.

Game playing AI bot

20 Comments »

Every once in a while a silly idea grips you and you decide “Screw it, I’m going to do it”.

That happened with me with a game called Bejeweled Blitz on Facebook. My friends online have been competing for high score for the past few weeks. I got to thinking…”How hard would it be to write a program to automate playing this game..?”.

This is the result of that question. It took a few days at a few hours per day. Probably about 6 hours combined time. Right now the bot is able to play pretty well. It can do better than I can most the time (although my high score currently beats the bot’s high score). With some improvements, I expect that will dramatically change.

Anyway, here’s a video of the program in action.

[youtube=http://www.youtube.com/watch?v=WRqGzqnip-w]

Update:

The autoblitz bot just scored 258,400.

http://i42.tinypic.com/1zmi2yp.jpg

Smiley Chat

3 Comments »

smileychatt1

text made out of smileys. kthx.

Cxbx Update (Smashing Drive in-game)

2 Comments »

Updated the official Cxbx site, with an update from shogun: http://caustik.com/cxbx/

Amazon EC2 SSH from Blackberry

2 Comments »

Why Not?

Cxbx Progress

78 Comments »

There was some amount of activity in a private branch in the Cxbx project recently..

I have been talking to a developer, Martin, who has spent some of his extra time fiddling with Cxbx. He was able to get some teaser screenshots from Battlestar Galactica. The game displays the menu, and even some in-game. I won’t get into too many details, but here are a couple screenshots.

Battlestar Galactica - menu 2 Battlestar Galactica - menu 3

Battlestar Galactica - in-game (fullscreen) Battlestar Galactica - in-game (windowed)

I have not started to work on Cxbx on a regular basis — but I think this progress is very motivating, and it is tempting me to boot back up my development setup and take another look after a very long absence.

Many thanks to Martin for the contributions and for allowing me to post about his progress. Cheers.

Chumby Antics

4 Comments »

I have been working at Chumby for a few months now. If you have never heard about Chumby – basically, it is a small squishy wifi-internet connected device with a touchscreen and some other nifty hardware features. So, I am around Chumby devices pretty often, obviously, since it is my full time job.

Sometime’s I goof off a little..

This is a video of a small application I made on the Chumby. You touch the screen, and a small blob of “lava” follows your finger around. You basically get the sense of smearing the blobs around the touch screen.

[googlevideo=http://video.google.com/videoplay?docid=-3183080343701099686&hl=en]

And this is a funny video of a Chumby with two USB dogs humping it.

[googlevideo=http://video.google.com/videoplay?docid=-2315250673640190670&hl=en]

Function Hijacking via Export Directory

6 Comments »

I have been working on a contract that has necessitated the use of function hooking. Basically, I need to intercept an arbitrary program’s usage of a system dll library in order to interject my own logic, and interact with the objects produced by that binary.

There is a nice tool created by Microsoft Research, called Detours. This is basically an API which helps you to perform binary function interception and instrumentation. This API is fairly robust and well thought out, and I use it in this project. However, there is certainly a fair amount of missing functionality.

While testing my application against a popular product that uses the “unicows” library, I stumbled across a very interesting situation during which the Detours method of function interception will not apply.

Basically, unicows has it’s own custom version of GetProcAddress build in. This custom code crawls through the in memory PE header and obtains function offsets by hand. This means that, for dynamically loaded function addresses, using the Detours functionality I am unable to intercept functions loaded at run-time.

So, in order to properly intercept these functions, it was necessary to create an additional API from within Detours. This function needs to crawl through the PE header, and replace the Export Directory entry for a given API with the virtual address of the function you wish to be called, instead. The function will also return the original virtual address, so that you can call that function within your intercepted version.

The new code is here: DetourReplaceExport.txt

So, now I have a working solution for hijacking an API which is linked dynamically using a non-standard GetProcAddress. Yays!

Ignignokt / Megaman Laser Etches

6 Comments »

Hehe. Last night we used bunnie‘s laser etcher to put Ignignokt on a Treo cell phone. Classy. Also, I got megaman on mine.

Here is a video of the etching of Ignignokt in progress:

[youtube=http://www.youtube.com/v/Q1u3H6NpbHQ]

Windows Genuine Advantage hacking

13 Comments »

Windows has a great new feature which helps notify you when you may have inadvertently pirated your copy of the operating system. This feature is really handy, because sometimes people will slip and fall and accidentally steal a copy of Microsoft Windows.

Windows Genuine Advantage will detect this situation and provide you with valueable feedback so that you may address the issue by going out and buying a new copy of the operating system and reinstalling.

Here is a screenshot of WGA in action:

Now, I greatly appreciate this information. I for one would immediately take corrective action if my copy of Windows was actually pirated.

Fortunately, sometimes your situation is a little different. Maybe an innocent user has, one way or another, lost possession of their original product key. Tornado, earthquake, fire, air raid, black holes and ninja stars are some possible ways this could occur.

What do you do in this situation? Now, it seems rather silly to go buy another product key – just because you lost yours. It’s a simple misunderstanding.

Luckily, Microsoft was polite and left the binaries for WGA lightly protected. This means you can easily go in and inform WGA that you have, in fact, purchased your copy of Windows.

There are programs out there to make this modification for you. I took a slightly different approach, however, and decided that I would like to keep the warning message bubbles. I just wished to slightly modify the contents of those messages.

Now, whenever I come back to my computer – and sometimes just at random moments – WGA gives me a few words of appreciation. What used to be a depressing accusation of guilt, is now replaced with a friendly greeting! How nice.

The change is simple. Just pop open the WGA app in your favorite hex editor or resource editor, and search for the original messages. Replace with a message of your choice, and voila – your own personal motivational notification program.

c:\WINDOWS\system32\WgaTray.exe

Next, just open up task manager and kill the process “WgaTray.exe”. Don’t worry, it is such a user-friendly program that it will automatically restart itself!