[Music]
Remember the message.
The future is not set.
[Music]
I'm going to take the mic off. Oh,
that's loud. All right. You want to fix
the volume a little bit? Is it good?
It's really loud up here.
All right. I'll keep talking for a
minute. Okay. So, the welcome to the
coveted 900 am speaking slot after the
party last night, which I did not go to
because I'm speaking at 9:00 am.
However, this is a great show.
Obviously, Cypher Con's a lot of fun.
Thank you all for coming at 9:00 a.m. I
truly appreciate it. I know it's early
for many of us. Not me because I went to
bed early because I was responsible this
year, unlike previous See, thank you.
Thank you. I appreciate that. In my
younger days, I would have definitely
gone to the party and things would have
been rough, but that's okay. So, I am
talking today about something I
absolutely love and it is where are all
the young hackers? So, as many of you
see, I'm not a young person. However,
one of the things that comes up a lot
when I talk to some of my fellow geyser
friends is they'll say some stuff like,
"Where are all the young people? Why
aren't there young hackers? When we were
young, like you had to beat people off
with a stick. There were hackers
everywhere. We were all about this stuff
and I thought about this a lot. I do
some podcasting and we'll kind of talk
about some of the things I do, but I I
put a ton of work into this. I'm like,
where are the young people? Like, why
don't we see young people doing a lot of
this stuff? And it kind of occurred to
me that there are young people. There
are a lot of young people, but they're
not doing the kind of things we do. I
kind of feel like this is the ultimate
old man yells at cloud where it's like,
why aren't the young people doing what I
want them to do? But they're doing a lot
of really cool stuff. And so this talk
is kind of a combination of two of the
things I love, which is hacking and
video games. And so we're going to talk
a lot about hacking video games. And
it's in the context of speedrunning,
which I love to. And I'll explain all
that in just a moment. But first, who am
I? My name is Josh Pressers. I have a
couple podcasts. One is called the Open
Source Security Pod. Well, it's just I
rebranded it to open source security
now. It's a long story, but it's open
source.io. I'm at Josh Breers on like
all the social platforms. I love talking
to people about hacking and open source
and speedrunning and security about
anything. So, by all means, like reach
out. It's a ton of fun. Like LinkedIn,
whatever. Pick a pick a platform. You'll
find me there. And seriously, like reach
out. One of the things I'm always
looking for is like guests to talk about
open source stuff, security stuff. If
you have ideas, let me know. We were
talking earlier about imagine being in
charge of AM for two million users.
blew my mind. Anyway, okay. So, the
other thing I do is forcon I have a
podcast called Hacker History. I am
always looking for guests for Hacker
History. Obviously, hackerhistory.com.
It is the Ciphercon HackerHistory
podcast. Everyone here has a story to
tell. Now, all of you just thought, but
nobody wants to hear my story. Every
guest I have had has told me those exact
words on the show. So, listen to the
episodes. They're amazingly fun.
Everyone has a story to tell. reach out.
I would absolutely love to hear your
story. Trust me, they want to hear your
story. It's so much fun. It is like the
best show in the in the whole world. And
I should also preface. The show starts
with me saying, "Tell me your hacker
story." That's it. It's your story. I
don't get to tell you what your story
is. Only you can tell your story. But
it's super fun. It's super super fun.
Excuse me. Okay. So, we're going to
start by explaining speedrunning.
Do I'm not going to ask everyone to
raise their hands because that's stupid.
But so speedrunning is this idea in
video games to beat it as fast as
possible, right? It seems easy enough.
We've many of us have played, probably
all of us have played video games at
some point and we all remember, you
know, playing some game and getting
really good at it, right? But there are
people that take it to the next level.
So on the screen, this is the
leaderboard for Super Mario Brothers. Us
old folks all remember Super Mario
Brothers on the NES. And you could see
like the guy who's won it four minutes
and 54 seconds.
Most of us remember beating Super Mario
Brothers probably in a couple of hours.
Like 4 minutes and 54 seconds. This guy
on the top actually his name is Nipsski.
He plays on a keyboard on an emulator.
And he's like crazy good. It's
unbelievable.
Excuse me. So what happens though is you
want to go fast, but there's different
ways to play the game, right? So, anyone
who's played like Super Mario Brothers,
you probably remember the warp zones
where you can go in the warp pipe and
you can skip to levels, you know, three,
four, five, whatever. It just depends on
the warp pipe. And so, we can see on the
screen it says like any% and warpless
and what is it? Warpless Allstars.
There's these categories people use,
right? So, it's not just about beating
the game as fast as you can. There's
different ways to beat the game. And so,
naturally, you can imagine there's like
just beat it as fast as possible.
There's you have to beat it fast, but
you can't use a warp zones. Like All
Stars is just a variant of the game
because there's the original cartridge.
And there are people who are like, "Oh,
you can only play on an NES with an
original cartridge." Then there's people
who say, "Oh, we're going to play the
Super Nintendo one." There's people on
emulators. There's all these categories,
right? And so the point is like, "We're
just going to go fast. We're going to
figure out what to do." But sometimes
going fast isn't the goal. There's also
this category they call low percent. So,
this is a picture of Link staring at a a
rupee. This is Link from The Legend of
Zelda. This one is uh Skyward Sword. And
if you look at the top of the screen, it
says low percent in one day, 4 hours,
and 27 minutes. So, the point of this
kind of speedrun is to just get as few
items as absolutely possible. So, if you
can beat it with, let's say, 10 items in
two hours, but someone can beat it with
nine items in one day, they win, right?
Because that's the point. Now, what's
crazy about the speedrun and why I
absolutely love it is I think 16 hours
is spent looking at that rupee because
what these people figured out is there's
a minor bug in the game that as you look
at the rupee links, and this is like one
of those screens like, "Oh, you found a
rupee." like press A to continue. While
he's looking at it, he's moving at a
very, very slow pace, like
infantestimally small, but it doesn't do
collision checks. So, if he just stares
at it for like 16 hours, he eventually I
think it's eight hours, he goes through
the wall and then they it's basically a
bug that they found to solve the game.
And it's it's crazy crazy things like
this. And we're going to cover a whole
bunch of wild things that these people
have solved. This is really just my
excuse to talk about video games for an
hour. Thank you for coming to my video
game talk. But uh it's so much fun. So
kind of the I want to start out with
this question like are speedrunners
hackers? And I have a suspicion this is
not a controversial topic where some
people might say oh they're just playing
video games. But I mean fundamentally
right they wear they love they love
hoodies. We all love hoodies. I took
mine off because it's kind of warm up
here. But we all get it right. You're
not a hacker if you don't have a hoodie.
You got to put it up when you're
hacking. They all have handles. If you
watch speedrunners playing video games,
like they're all on Twitch and YouTube
and things like that, they all have
handles and they have awesome handles
and I love it. Like they're so good. One
of my favorite people to watch his
handle is oats and goats. Like touche. I
love that so much. Right? And the thing
is, but at the end of the day, these
folks are making computers do things
they were never meant to do. I mean,
that's what we do, right? Actually, I've
got like we all got our badge. I I
hacked my badge, right? It says, "Hack
the planet now." Like, because it's fun.
Actually, if anyone wants me to hack
their badge and put a message on it,
I'll totally I'm happy to do that. Come
find me afterwards. It's very easy. It's
just Python. It's It's so much fun. Uh
actually, also in the Discord, there is
a badge shenanigans channel where like
all the code and people have done a ton
of work. So, if you're interested in it,
like go check it out. But anyway, okay.
So, are video game speedrunners hackers?
I of course put probably up here just to
be controversial, but we're going to
pretend no. Okay. So, they're doing
games really fast. And I want to kind of
think about this in two two contexts
where there's people who just beat the
game really fast. Like in the Super
Mario Brothers example at the very
beginning, that guy Nipski, he's just
really good. Like he still knows things
and we'll show some of that off. But
fundamentally, he's just playing the
game fast. As fast as he can, but there
are speedrunners that do crazy things.
Like crazy things. The amount of
knowledge these people have,
mind-blowing. Wait until you see some of
the examples that are coming. And I want
to start with Super Mario Brothers. Is
it gonna play?
Will the internet take pity on me today?
Ah, it does. Okay. So, in this example,
you've got Mario doing his business,
right?
Okay. Mario disappears because it's
actually recording at 30 frames a
second. And so, every other frame,
Mario's gone. But something special just
happened. They took damage while they
hit the axe at the end of level 14. Now
they go to level 21. And you're going to
see normally in Super Mario Brothers,
you'd go from fire Mario to small Mario
and they just collected a mushroom and
became small Mario. So you know
something crazy is going on, right? And
you're going to see in just a minute
they're going to be small fire Mario.
And the reason I kind of bring this up
is these are bugs that these game these
speedrunners use. See, now we're small
Mario. Like it's such a crazy bug. Small
fire Mario, like a normal person would
see this and not think twice about it,
but they can go faster because small
Mario can go through holes big Mario
can't. So this is one of the examples
where you've got that. There's another
bug, Legend of Zelda. Most of us have
run into like bizarre benign bugs that
we might not think twice about, but
these folks love it. Like this is an
example where you can wrap link around
the screen.
And the speedrunners obviously use this.
Sometimes they use it just to go really
fast cuz if you need to go across the
screen, it's faster to do the screen
wrap than it is to walk across the
screen. Which is funny because you'll
watch these speedrunners playing on like
Twitch and something and they're like,
"Oh, this trick saves two frames." A
frame is 1/60th of a second. So they
saved what? 1/30th of a second by doing
a trick. And to them that matters
though, so it's really funny. And then
my final like quick example of just
weird bugs is Super Metroid. If you ever
played this one, you're not supposed to
be able to go through that gate. Except
you can. It's hard to do. Like, this is
a trick I can actually do. Funny enough,
I can do all the tricks I just showed
you, and that's why I pick them. I also
pick games I really like, which is part
of the fun of giving a talk about video
games is I get to decide what we're
talking about. Okay, so these are just
some examples of these like seemingly
benign tricks that these people have
found that do interesting things. Right
now, as a good hacker, I'm going to say,
but those aren't security bugs. Those
are just stupid, boring bugs that don't
mean anything, right? That's not
hacking. That's just bugs. That's
letting me play the game fast.
So, this one's kind of a doozy. This is
Super Mario World. This is a Super
Nintendo game that came out what, like
93, 92, somewhere in there.
So, what's happening here is if you look
at the screen, there are numbers. Okay,
those are memory locations are printing
to the screen. This is a hack ROM. The
point of this is so the person playing
can figure out how to do this. What they
are doing right now, they are writing
shell code into the memory of a Super
Nintendo by placing characters in
strange places. And you probably saw
when that Yoshi was gotten. That's not
normal at all. Right? There was that
strange block appeared. So like this is
the kind of crazy stuff these people had
to figure out, though. Like you can see
all those numbers are changing. this the
the the player is doing completely
bizarre and ridiculous things that no
normal video game player would do,
right? But this is an example where they
are playing this game, they are filling
the memory with the code they need and
then they're going to hit a bug in a few
minutes that's going to let them jump to
the shell code they are writing right
now. Like this is mindboggling. We think
of shell code in the hacker world and
we're talking about payloads, right?
Where we're going to add shell code to a
request. We're going to have someone
open an image file that's going to
deliver a payload. Their payload is
freaking Koopas on a screen. Like, it is
bananas. It's so much fun. This like
these bugs are so crazy and so cool.
It's just It's so much fun. And we're
almost done. Let me see. I can move my
mouse over it. We can make this go
quicker
just so we can get past it. Oh, no. Here
it is. It's coming. All right. Ah, damn
it. Nope. Takes too long.
I've lost my mouse. Uh,
all right. Whatever. We're going to
watch it now. Nope. Nope. I lo it. No, I
didn't. Whatever. We'll just keep
watching. So, okay. So, what's going to
happen in just a minute? Like all this
stuff, right? All that all that code at
the top. That is the shell code that's
being written.
And now the important thing that's going
to happen right here is they are going
to collect a coin
while Yoshi eats it. And now it jumps to
the end. that that is they just executed
their payload. That is what we just saw.
It's amazing. And I've got another good
example of this right here. Ocarine of
Time. This is a Zelda game that came out
on the Nintendo 64 long ago. Now,
something crazy is going to happen here.
They're going to change the camera view
and then they're going to wander off.
This is an example of these people have
no source code. They are hacking the
crap out of this stuff. Here it is. So,
the camera just locked. Link is now
wandering off the screen because you
know what happens in old video games
when you wander off the screen. Things
despawn because he didn't have a lot of
memory. And you're gonna see he's going
to be holding an invisible pot
momentarily. That invisible pot
is the game thinks he's holding
something but he's not. And so it does
all this crazy stuff and he just warps
to the end of the game. This one is
really important because in Ocarine of
Time, they've done a ton of research
into understanding how they can modify
the memory of the game. And that's going
to be really important right here. So,
this is one of my favorite video game
examples. And this one's complicated to
explain, so I'm going to do my best. For
us geysers who own Nintendo 64s, there
was this thing called the memory
expansion pack. Okay. The Nintendo 64
had four megabytes of memory. Yeah. Four
megabytes, not gigabytes, megabytes.
Okay.
There was an expansion pack that's in
the lower left that you could put into
your Nintendo 64 to give it 8 megabytes
of memory. Holy crap, that was bananas,
right? I know. 8 megabytes. What are we
going to do with that? So, here's what
happens. There's a game called Paper
Mario, which is a super fun game. If
you've never played, you should totally
play it. Like, it's a great game. Paper
Mario, they found in Paper Mario, they
can exploit a bug to make it jump to an
arbitrary location in memory. But you
know what they can't do? They can't
write shell code in Paper Mario. They
have not figured that out yet. But you
know what they can write shell code in?
They can write shell code in Ocarina of
Time. So what these people do? They play
Paper Mario until they get to the point
where they can exploit their bug. Then
they put in they save their game. They
put in Ocarina of Time. They use the
glitch just like the one we saw where,
you know, they're holding invisible pots
and doing all this stuff. They use that
glitch to write code onto the expansion
pack because you know what makes the
expansion pack special is most games
don't expect it to be there. So they
don't clear that memory. So then they
take out Ocarina of Time. They put in
Paper Mario. You got to do the cartridge
swap pretty quick because you got to,
you know, the memory has to keep holding
that that data because obviously it
degrades. So now Paper Mario starts. It
wipes the normal 4 megabytes of memory.
It does not wipe the 4 megabytes on the
expansion pack. Then in Paper Mario,
they start playing it again and they
jump into the shell code they wrote in
Ocarine of Time. Like the amount of
complexity in this these sort of attacks
is completely ridiculous. And what makes
it really cool, one of the things that
all these speedrunners do, they all work
together on this where like one person
finds one bug, another person says, "Oh,
I think we can combine these bugs to do
this stuff." and they use Discord and
they work together and they communicate
and is absolutely bananas. And of
course, this is a speedrun so people
keep track of it. That's what I've got
in the lower right is the leaderboard
for this particular speedrun. And this
is something humans are doing. When they
first did this, they were like using
emulators and stuff to figure it out.
But I have watched a speedrun at a
charity marathon where a human being did
this for real and they got it and it was
amazing. And it was like terrifying
because they're like, "This only works
like 50% of the time when I, you know,
try to do it at home." But they got it
and it was, it's ridiculous, though.
Like, who freaking figured this stuff
out, you know? And so this is like as
hacker as it gets.
One of my other favorites is for us old
folks, there's a game called Dragon
Warrior, which many of us had because
Nintendo gave them away for free when
you subscribed to Nintendo Power back in
the day. Yeah, you know, right. I still
have my copy. The battery is probably
long dead. But when you play this game,
it's like a traditional Japanese RPG,
right? Except what's missing from this
one. There's no battle. The guy hasn't
fought anyone yet, right? Normally, you
take like four steps and a bad guy
appears and then you have to fight him.
This is an example of where the
speedrunners, these people have figured
out how to manipulate the random number
generator in the game. You'll see like
he's walking in weird ways. They pause
sometimes. They might go around in a a
way that doesn't make sense. They're
manipulating the random number
generator. This is a human being. Like
if you if you see this, this is a
speedrun marathon called Games Done
Quick. That guy on the screen on the
left, he's actually playing this. Like
this is a human doing this. They have
figured out how to do this. And they
practice like crazy.
It is ridiculous. Like at this point, if
any normal person had done this, you'd
probably have had to fight more than 10
monsters. And now what makes it even
crazier is they're going to fight a
monster, but it's a special monster that
gives them a 100 experience. So they're
going to go from like level one to level
five. And they're going to do this a
bunch of times. Like this is one of the
insane examples
and there's so many. My other favorite
Tetris. So I don't know how many of you
kind of pay attention to this scene. If
you do, you'd have heard about Tetris
recently. We got a hand up. Awesome.
Yes.
Yep. Well, the rolling is the new one,
but there is hyper. Yes. Okay. So the
gentleman just said that he's been
paying attention to Tetris and he
learns. So normally when a normal person
plays, you get to like level 9 or 10 and
it really goes really fast and you kind
of die, right? But these players have
there's a concept called hypertapping
where they just tap the buttons really
fast and they could get up probably
around level 100 give or take with
hypertapping. And now there's a new one
called rolling which I'm not going to go
into, but they can play Tetris on the
NES functionally forever almost except
they can't. Okay. So, and and I'm going
to skip to this one first. So, what
happens in Tetris? Well, we'll start
here. Once you get to a certain point,
the game has bugs. They didn't assume
anyone would ever get past about level
30, give or take. And so, the game
starts to fall apart. And we're talking
NES, like 2 kilobytes of memory, right?
You've got it's an 8bit system. The
integers are 255 is the largest integer
you can have, right? An unsigned
integer. So, there's all these weird
bugs that start to happen once you get
to a certain point. Like, you can see on
the left and the middle, well, all of
them except the last one. The colors
look weird. Those aren't normal Tetris
colors because you know what? They don't
have color palettes once you exceed I
think it's level 128 because no one's
ever going to get there. We don't need
to program that, right? And what else
happens that's crazy is once you get to
a certain point, the game has bugs that
will crash the game. That's called the
kill screen. And in fact, someone got to
that. I think you have to go to it's
like level
I want to say it's like 180 somewhere in
there. I don't remember exactly the
level, but anyway, once you get to a
certain point, the game will crash if
you do certain things because what
happens is there are the game is not
expecting you to be this far. It's not
expecting your score to be as high as it
is. And so if you like clear two lines
on certain levels, it'll crash. If you
clear one line on a certain level, it'll
crash. If you're holding the down button
on a certain level, it'll crash. And
these people built a spreadsheet. This
is available on the internet. Like you
can just go look this up. This is a
spreadsheet that explains every single
crash condition in the game of Tetris.
Like this goes on for like 50 levels
worth of data in a spreadsheet. Someone
went through and figured out every
possible way you can crash this game.
Now, in some instances, the goal was to
crash the game. There is a speedrun for
that, to play until you crash, right?
It's it was called the kill screen. And
we thought that was beating Tetris.
Okay, we thought that was the end. But
then, of course, because these hackers
are nuts. They figured out that if you
can get to level 255,
it rolls over to zero, right? So, you go
from level 255 to zero, and the game
basically restarts. But you have to make
it through all of this. Now, of course,
you can write a a a computer program to
do this for you, but instead they just
patched Tetris to fix all these bugs so
a human could then do this. And a human
has done this. It takes like three hours
of playing. It's completely nuts. There
are tons of YouTube videos that go into
detail about this. And I would highly
recommend anyone watches this because it
is insane when you see what these people
have done with Tetris and the amount of
work they put in and the level of
understanding they have. Like this is to
the point where if we think about like
in the computer hacking world, these are
like those examples you hear about where
like back in the 90s and early 2000s
where you had the hackers telling
Microsoft how their stuff worked. Like
that's what this is except it's from a
game that's what like 40 years old now
and the people who wrote it are probably
all dead. But okay, so I also want to
talk about something called TAS, tool
assisted speedrun. What if we let the
computers play the video game for us?
And so what's happened is you can see
like there's this jumbled mess in this
picture. That's actually what my
basement kind of looks like. I've been
working on one of these for a long time
and I keep getting distracted. And we
all have half-finish projects all over
our houses, I'm sure. And the a task is
one of mine. That is not my picture, but
I have a very similarly we'll say shaped
mess. And so the idea is what if we take
a microcontroller and we plug it into
the NES and now we can send button
presses faster than anyone else can. You
might say, "Oh, but you can't really do
that because it's randomness and we
don't know what's going on." But
remember that Dragon Warrior speedrun?
We can control the random number
generator in these games. And so we can
hook a computer up to real hardware and
we can do whatever we want. And I just
kind of have an example while I explain
some of this right here. It's a Super
Mario Brothers 3 speedrun. So, what
happens here, and this is super cool,
the how they do this is completely
mind-blowing and amazing. So, usually
these folks start with an emulator,
right? We've all played emulated games
on our computers and whatever. And they
use an emulator. They can, you know,
step forward by frames, maybe step back,
change an input, do all these crazy
things. And they design it so they can
make the game do things a human could
never do. Like there are things
happening here where you might press
left and right at the same time, which
you can't do on an NES controller. They
might have inputs coming in where you're
changing the input once every frame,
which is 160th of a second. No human can
do that. I mean, that's completely out
of the realm of just physical like
physics. Physics won't let you do that,
right? Because you're pushing buttons
and things. But you can see like the
computer can do ridiculous things. So
what happens now is people wrote tasses,
right? They did this on emulators. They
built these crazy things, these amazing
video game speedruns. Then people
decided, what if we take that task and
hook it up to a real NES, a real
PlayStation, a real Super Nintendo, and
they started doing that. And so now,
like when you look at these charity
speedruns and things like that, there
are people who show up, they call it
Taspot, they bring a computer, they they
have a little robot they'll put on the
chair for lulls, you know, but they hook
a computer up and then they literally
run these things that came off an
emulator on real hardware, which is wild
and it works right now. It doesn't there
are sometimes bugs. They call them you
desync where you might miss a clock
signal or something. And obviously you
can imagine in a situation like this if
you lose like one frame everything
collapses because it's like that precise
that they need it they need to know
exactly where they are all the time.
Once we go to like real life and and
wires and and electricity things can get
get dicey. But generally speaking it
works and it works well. It's completely
insane.
And these are so much fun by the way.
Like just watching what some of the
tasks can do is mindboggling. And what's
really wild, my favorite thing though
about tasks, so there's all these crazy
bugs they use. There's these amazing
things they do. And of course, it's just
swag strats because you got to show off
a little bit. But it is amazing how
often these speedrunners will look at
something that happens in the task and
then they figure out how to do it as a
human. Like that Ocarina of Time thing I
showed at the beginning, that started
out as task only. And they were like,
there's no way a human could possibly do
this because you need two precise
controller inputs. and then a human
figured out how to do it, right? Like
completely hacker mindset. Now, there's
another piece to this that I absolutely
love and I'm not I could I I could talk
for hours and hours and hours on mods
and randomizers. So, one of my favorite
things to do and this is like my kids
laugh at me because this is all I do.
There is a thing called SMZ3. These
hackers took Super Mario or I'm sorry,
they took Legend of Zelda: Link to the
Past on Super Nintendo and Super Metroid
and they pasted them together and then
they randomized the items. So, every
time you play, the items are completely
random. You don't know what you can do.
You have to like get items to unlock
areas and do things. And it's absolutely
amazing. And these people figured out
how to do this. One of my favorites
they're doing now, the picture up there
is from map rando.com
where they have taken Super Metroid,
they chop up the map, they put it back
together in a random order, and then you
have to collect the items randomly, and
it unlocks your ability to do things.
And it is amazing. It's really fun to
watch the people who are good at this do
it because they can do like really wild
tricks like they remember I showed that
door open trick at the beginning. That's
nothing. Like they can do way crazier
things than that. But it's amazing like
these people, it's not just that they
figured out how these games work. They
also have to fix bugs because they're
doing things the games never expected.
And sometimes there's just bugs in old
video games, right? Because I mean we
all know what it's like. It's got to
ship like good enough. And so it is
bananas how much work these people have
done, how much development they've done.
Like it is it is so hacker. It's so
cool. And these are so much fun to play.
Like if you grew up playing like Metroid
and The Legend of Zelda. And actually
the the guy now who wrote SMZ3 is
working on a new one that is the
original Legend of Zelda, the original
Metroid, Super Metroid, and The Legend
of Zelda: Link to the Past. So it's four
games squashed together with random
items scattered everywhere. It takes
like eight hours to play one game of it.
It's completely insane, but oh my
goodness, it's so bananas. Um, and now
I'm going to kind of wind us back. We've
been talking a lot about the games I
really like cuz I'm old and I get to do
that. But there's things like Minecraft,
right? Any of you who are younger or
even are old and have kids like I do,
like Minecraft is all over, right? Like
kids love Minecraft and Minecraft is I'm
old and I love Minecraft, but like how
many mods have you seen for Minecraft?
There is so much crazy hacking that goes
on in the Minecraft world. It's
absolutely amazing. And some of the
things they've done are wild. I mean,
there are servers you can connect to
that they've just basically completely
changed the game because they found out
how to do so much just on the server
side that you don't even need like a
hacked client or you don't even need to
install mods. Now, one of the things
kind of putting my we'll say black hat
on is if you've ever had kids in the
Minecraft mod scene, your computer has
been infected by many, many viruses. So,
So any anyone who's ever done any
digging for Minecraft mods, like you
know what I'm talking about. It is like
a cesspool of malware because these kids
are just, you know, typing crap into
Google and going to the first site they
get and downloading. It wasn't actually
from from that perspective. It was a
marvelous opportunity to teach my
children what malware is, how malware
works, and like for the love of God, run
it through virus total before you
install it, which they do sometimes. But
yeah, this is actually why my like
internal network at home I treat as
adversarial because of my children in
Minecraft mods. Like it is it is more
dangerous than any of the people I work
with. Now, on the topic of mods, of
course, as a geyser, I could say, but
mods aren't hacking, right? That's just
we're changing something minor. This is
actually a picture. Uh, anyone who's
played Skyrim, you can get a mod that
changes the dragons into Thomas the Tank
trains, which is very funny, by the way.
And then I saw someone once that added
in the Randy Savage. Oh yeah. Instead of
Dragon Roars and it was chef's kiss.
Like it was it was really really good.
But anyway, you could say it's just
changing things. Mods don't count as
hacking. But I argue we have been
modding websites for people for a very
long time. So you young people, you old
geysers remember this was Code Red back
in the early 2000s. For you young
people, there was a a worm. It was like
2001 probably maybe 2002. I think it was
2001 called Code Red. It was named after
Mountain Dew Code Red, not a joke. And
anyone infected by Code Red, your
website said that and it was hilarious.
I worked at a company that ran a lot of
Microsoft back in those days, so it was
it was pretty good times. I was the Unix
admin, so I just got to sit in the chair
and be smug. But it was good times. But
anyway, like we've been modding websites
forever.
All right. So, this is we'll say some of
the easy stuff.
There's some crazier things though that
the hackers in the video game world have
done. And I want to start with this guy.
So, because I don't want to get sued,
we're going to say this is Todd Rogers
and he holds the record for a game
called Atari Dragster. Todd Rogers
record for Atari Dragster, as you can
see on the screen, is 5.51 seconds.
Okay. Now, there's also a fellow named
Billy Mitchell some of you may have
heard of. There have been some incidents
with Billy Mitchell. I'll let you look
it up. I'm not going to have a comment
on it. Billy Mitchell likes to sue
people. So does Todd Rogers. However, so
there have been people who have
questioned if Todd Rogers actually beat
Atari Dragster in 5.51 seconds. Okay.
And of course Todd assures us he
definitely did. This was the 80s. We
couldn't record things. There's no
pictures, but his friend Billy Mitchell
promises he did it. Okay, now here's
where the hackers come in. Atari
Dragster is not a complicated program.
The Atari, for anyone who's ever done
any sort of like I guess spelunking into
old hardware, is a shockingly
uncomplicated machine. It is amazing
what they could accomplish with. There's
actually a book called Racing the Beam.
If any of you want to read an amazing
book, like go read Racing the Beam,
because when you programmed an Atari,
you had to know where the beam on a CRT
TV was as you were running your code,
which is ridiculous. Like now we think
of this and this is we think of like
frames per second. They're talking about
moving a freaking beam of light, you
know, across the CRT. But anyway,
someone took the Atari Dragster game and
they built a a a task basically that ran
every possible combination of buttons
you could ever do through Atari
Dragster, right?
And the best possible time is 5.57
seconds. Like that's it. Remember this
guy? 5.51. Yeah, there is no way to get
a 5.51. And this is trying literally
every button combination possible. Which
is funny to think about because why
would you do this, right? I mean, spite
mostly, but like, right, how many of us
have just done things because you to
prove someone wrong? Like there's
nothing that drives hackers more than
spite, right? like I'm just going to
prove you wrong because I can. And oh my
I love spite driven development is my
favorite kind for sure. So anyway, like
this is an example. I also want to talk
about Mario 64. Again, we're back to the
Nintendo 64. I grew up on all this
stuff, so I love talking about it. But
Mario 64 is next level compared to
anything else. There is a GitHub repo
where they have decompiled the Mario 64
binary into the C code. And what's
bananas is if you take their CC code and
you use the same version of GCC Nintendo
had in their devkit, you get back the
exact same ROM. This is like literally a
reproducible build of a Nintendo game.
But what does it mean if I have the C
code for something like Mario 64, right?
It means we can rebuild it. We can hack
it. We can mod it. A lot of the modders,
the things I've shown so far, they're
doing, you know, shell code level work.
They're working on machine language.
It's assembly instructions. It's hard to
do. But once we have C code, like
granted, C has its issues, but C is a
lot easier to work on than assembly. And
one of my favorite examples is Mario 64.
They decompile it, they get the C code,
and you know what the first thing people
tried was? They turned on compiler
optimizations,
and it sped the game up substantially.
There's a whole bunch of slowdowns in
the game and just turning on
optimizations. And of course, everyone's
like, "Oh, Nintendo, you guys suck. You
didn't turn on optimizations." But this
was of course deadlines back in the 90s
using GCC because I mean, crap, anyone
using GCC in the 90s, that was like
unheard of. I mean, we accept it now,
but it was a big deal then. So, they
didn't turn on optimizations because
they were worried optimizations would
break their code. Turns out it Well, it
turns out in modern GCC, it doesn't
break the code. We don't know about the
the old stuff back in the day, but like
this is one of the wild examples, right,
where these hackers took this game, they
decompile it, and then they recompile
it, and it's better. They even took the
game, like I have Mario 64 on my
Nintendo 3DS because someone took the
Mario 64 code and they just built it to
run native on a 3DS. So now I can play
Mario 64 in widescreen correctly on a
3DS and it plays amazingly and it's
super fun. There's another video. This
one is this is one of my favorites. This
is a threeh hour and 45 minute video
about the invisible walls in Mario 64
because what happens is when you're
building levels, right,
their tools sucked because this was the
'9s. And you can imagine that when
you're lining up walls, what happens if
you have, let's say, like a 0.00001
distance between walls, right? In a
normal game engine, you'd probably just
account for that and make it go away.
But in this, they didn't. So, there are
these things called invisible walls in
Mario 64. There are literally like every
level has hundreds of them. This guy
found them all and he made a 4hour long
video about all of the invisible walls
in Mario. And I watched the whole thing.
Yes.
Yeah. See? Awesome. He says he's seen
the video. Like, it's so good. I was
like riveted for four hours. It's funny
because my wife was like, "What is wrong
with you? why are you watching this? But
I'm like, this is so interesting. Look
at this. And of course, she's like, I
whatever, whatever, you do you. But it
was so much fun. Like, and it's so,
think about that. Think of the time
investment someone put into figuring
this out. This had to have been like
months of work to find every invisible
wall, to document every invisible wall.
But again, when you're a speedrunner
trying to go fast, this kind of stuff
matters to them. Because to normal
people, if we jump and we bonk on
nothing and we fall down, we're like,
"Oh, there was a bug in the game." But
like these speedrunners, when you're
doing something that's an hour of time,
an hour of your life to get to the end
of the game, you're going to want to
know where the box are because there's
nothing worse than playing a game and 45
minutes in your whole speedrun is now
shot because you hit an invisible wall
no one knew about. But now we know where
all the invisible walls are. It's nuts.
My other favorite is you can beat Mario
64 without pressing the A button. The A
button jumps when you play Mario games.
Jumping is basically what you do right
now. This is a task. This is where you
have the computer play the game. But
they have figured out how to beat Mario
64 without jumping. It is bananas. And
it's really good. It's actually wild to
watch. It's really long because there's
things that have to do like some really
weird bugs where you have to like, you
know, have an enemy kind of spawn in and
then you run away and then it despawns
and you go back and it spawns in and
it's pretty wild. There's a lot of cool
videos that show this. Many of them are
not super long because they obviously
cut out the really boring parts, but
like this is another example like these
hackers figured this crap out and it's
ah it's so much fun. It's so much fun to
watch this stuff though. Oh, I
absolutely love it. Uh there's also a
helping part. So after this show,
there's Midwest Gaming Classic, for
example, which some of you are going to
go to. Like this is it's a gaming show.
Well, there are speedrunning events
where it's similar to Midwest Gaming
Classic. I'd say the vibe is very
similar, but like there's one up here,
GDQ Games DoneQuick. I've been to GDQ.
They have two of them a year. Yeah.
Right on. Good. They raise literally
millions of dollars twice a year. One of
them is in Minneapolis, not far from
here. I drove there. It's a long drive,
but they they play video games for a
week. They collect donations. Actually,
the Dragon Warrior example I had at the
beginning, that's footage I stole from a
GDQ where they've got like basically
they've got the player, they got the
runner, they call it, they got some
people on the couch, they say, where
you've literally just got commentators
behind the runner and they're usually
friends. So, they joke around and it's
real silly and it's a lot of fun. But
then they play these games really fast
and they might play actually I watched a
guy play Mario 64. I think it was in the
I think it was in the the one the summer
one last year. He played it on a drum
set. You know those drum sets like you
can play certain games with? He beat the
freaking game like and he's better at
that on a drum set than I am on a normal
controller and it's like this is
ridiculous. But they love doing this
stuff. It's what they do. It's amazing.
They raise millions of dollars. Uh
Desert Bus for Hope is so good. So
there's this game from Pen and Teller.
Yeah. Like those magician guys. It never
got released. It was for this Sega CD.
It's called There's a whole bunch of
games on the CD, but one of them is
called Desert Bus. And you drive from
Phoenix, Arizona to Las Vegas in real
time. It is an eight-hour drive through
the desert. So, you have to play this
game for eight hours. Like nothing. I
think at four hours a bug hits your
windshield and the bus like slightly
veers to the right. So, you have to like
keep steering it back on the road. And
if you crash, you let's say you drive
for four hours and crash, you have to
wait four hours for a tow truck to come
pick you up and bring you back to to
Phoenix. And there's this thing called
Desert Bust for Hope where these people
play this game over and over and over
again. Eight hours. Well, you drive
there for eight hours and then you can
turn around. You get one point if you
get there and I think you get two points
if you come back. So like 16 hours of
driving, right? Very pen and Teller. And
they they do this. It's called Desert
Bus for Hope and they raise again like
hundreds of thousands of dollars for
charity. Like again, like this is like
that that amazing thing hackers can do
where when we want to do something and
we put our minds together and we work
together, it is phenomenal. I mean, I
would argue these speedrunning events
are basically just they're taking the
the hacking aspect of speedrunning as
well as like the hacking aspect of just
entertainment and it like they amuse
people to no end and they raise a
freaking ton of money. Like it's so
cool. It is. And it's honestly so much
fun. If you ever get a chance, go to GDQ
in Minneapolis. It's not even super
expensive to get into and it is so much
fun. Like the people are amazing. They
have video games everywhere. If you
haven't seen on the second floor,
they've got like an arcade down on the
end. Same sort of deal. It's same sort
of feeling where there's just games
everywhere and it's so much fun. And
there's people who will teach you how to
speedrun. Like it was just amazing. I
brought my kids there and they still
talk about how good it was. And I'm sad
I haven't been back. It's just like life
and everything. But but anyway, okay. So
there are more hackers than ever before,
right? We like to think about where are
the hackers, what is going on, and these
speedrunners are completely doing the
same things we used to do, right? They
build community, we build community.
It's why we're here. It's all about the
community aspect of hacking, right? Like
the point of hacking is to do a thing
and then to show someone else. It's like
one of the stories I like to tell is the
first person to make a cave painting,
you know what the first thing they did
was? They went and got their friend to
show them what they did. I guarantee it.
We all do that. I hacked my Cipher Con
badge. You know what I did? I posted it
on Discord the second I got it working
because I'm like, "Holy crap, I did it,
everybody." And then all the codes
there, too. So, if you want to hack your
own badge, like totally go for it.
Really easy to do. Raspberry Pies. But,
you know what I mean? Like, that
community aspect is so cool. And all of
these things I've talked about, all of
the bugs, all of the tasks, the the
rewriting games, the decompiling games,
none of this was done by one person,
right? This was all like a village
because none of this can be done by one
person. Like the idea of like the lone
wolf hacker that's it doesn't exist
anymore. Like all of the video game
stuff, even all the stuff we do now,
even in the hacker world today, like we
we have to work together. There's you
don't have a choice. It's how it works.
Excuse me, right? The cooperation is
such a big deal. And the new people
aspect, I think, is also huge. So, it is
easy for the geysers to say, "Where are
all the hackers? You didn't learn. You
don't know Linux. You don't know MS
Dash. You don't know whatever that thing
is. You've never played a Nintendo
Entertainment System. You don't even
know how to blow on a cartridge." Right?
But yeah, and you're not supposed to do
that, by the way. Don't blow on the
cartridges. But you know what I mean?
Like, there's always this prevailing
attitude, especially with the old folks
that are like, "You're not good enough.
You can't do it." This is one thing I do
not see in the video game world. Like if
you go into a Discord and you say, "I
want to learn to speedrun Super Mario
Brothers. I want to play The Legend of
Zelda." These people are so friendly and
it's amazing. It's it's literally what I
wish we had 20, 30 years ago because I'
I've I've given a talk about this in the
past. Um actually on hacker history I
talked to uh Wolf Jay Wolf Gang Gorick
who gave a I don't know if he's spoken
yet but he's speaking at Cypercon this
year as well. Wolf was a guest on hacker
history and we talked about this about
in the past how just freaking mean we
used to be to each other like we were
not kind. the hacker world was not nice
to each other and I think if we were we
would have gone farther than we could
imagine because I think this is an
example these crazy bugs this is stuff
we can't imagine honestly like these
people have levels of understanding that
blow your mind and they're so friendly
and they're so nice so I want to say
like what's the point of all this right
I mean to talk about video games really
like that that's kind of the the secret
purpose behind this when I when I
submitted this talk to Mike. I was like,
I want to talk about video games. Like,
how can I get Cipher Con to accept my
talk about video games? I was like, oh,
I know what I'll do. I'll compare it to
hacking. But the thing is like there's
hackers everywhere. We might not see
them necessarily where when we're
looking for hackers like us, but they're
everywhere and they're working on all
kinds of stuff. Like it's it's wild.
Even in the open source universe, I'd
argue a bunch of the open source people
are hackers. Same thing. But that's
maybe a talk for next year. So, they
don't hang out with us. All right. we
can maybe go hang out with them, but
they're not coming here. Which is kind
of the last question here. And this is
I've got to be careful with this one
because I've already had Mike say,
"Well, you should run the hacker track
at Cipher Con or the video game track at
Cipher." And I'm like, "I got enough I
got enough to do." Like, I don't I
don't think I want to do that. But like,
this is one of my questions. Like, why
don't we have video game people coming
to hacker conferences talking about what
they're doing because the things they're
doing are bananas and we can learn so
much from what they're doing. I mean, if
you look at how they're hacking some of
these games, look at like how they
decompiled Mario 64. Actually, they're
working on I think Ocarina of Time just
got decompiled also. So, now we have
multiple Nintendo 64 games converted to
CC code that we can then obviously do
whatever crazy thing we want with. And
it it's fun though. Like, it's amazing
to see what they're up to. And there's
so much going on. I could literally
speak for 12 hours about the things the
video game people are doing and I
wouldn't have enough time. It's all on
YouTube. People love making videos about
this stuff. There's a handful of really
good like behind the code type video
game channels that are out there. Like
they talk about how some of these bugs
work you see in the video games. They'll
talk about how the the like the um the
randomizer stuff is working, like what
they're changing. It's it's so much fun.
It's so good and it's just it it's
riveting. If you if you've played old
games, you'll love it. Even if you
haven't, you're going to learn things
because it's just all about hacking. So,
on the last screen, I've got a Celeste
speedrun because I felt bad because all
the games I've shown were really, really
old. So, this one is Celeste. This is a
human being playing the game Celeste,
and I just uh ganked it off YouTube.
Actually, this one is a literal YouTube
video, so I don't feel like I stole it.
Um, where I'm linking to the YouTuber,
but like this is just one of those
examples where like someone figured out
how to play this game crazy fast. If
you've never played Celeste, it is like
a crazy hard game. It is so hard. And
when I play it, it takes me like six to
10 hours to beat the game. And I think
this person did it in like 24 minutes.
It's it makes you feel completely
inadequate and embarrassed when you
watch how they play the game versus I
mean I I die like twice on this screen,
right? This is supposed to be like the
opening tutorial and I can't even beat
that without dying. So, okay. Are there
any questions?
Yes.
Okay, the question was the like remote
code execution, command injection kind
of all this stuff. Are these documented
with CVEEs? So the old games you could
easily make the argument that you're not
crossing a trust boundary. It won't get
a CVE. Now, however, there are bugs.
There's actually a bug in Tony Hawk Pro
Skater for really every platform that
has Tony Hawk Pro Skater where you can
take a modified save file, you load it
into the system. So, like let's say you
have a PlayStation, you put the save
file on a memory card, which you need
special hardware to do. You put the the
memory card in the PlayStation. You load
the Tony Hawk Pro Skater. It's a custom
skate park. You load the skate park and
you launch into a game launcher that
then lets you do things like play
pirated games. There is a thing I just
stepped on uh let you play like pirated
games, right? Like that is an example
where you could argue that's crossing a
trust boundary. You could probably
request a CVE. I I don't know if they
give it to you. Like it gets weird. But
yes, there are examples like in the
Ocarina of Time and Super Mario World, I
would say they're not crossing a trust
boundary. They're just jumping to the
end. But yes, there are things like with
the PlayStation, you are crossing a
trust boundary. You are not supposed to
be able to play pirate games on a
PlayStation by default. You can totally
do it if you own Tony Hawk Pro Skater,
which is super cool. And again, this is
one of those examples like you could mod
your PlayStation or just buy a copy of
Tony Hawk Pro Skater and then they can
load games off memory cards and play
burn, you know, burnt discs and it's
amazing. And again, like these people
figured this stuff out. It's so cool.
All right, any other questions? I just
looked at the light and I can't see
well. Yes, sir. If you're interested in
this sort of stuff,
Oh, yes.
Yes. It it was a comment. It was saying,
"So, if you're interested in
speedrunning and like the exploits and
bugs and things like there's a YouTube
channel called Summoning Salt. The
videos are phenomenal. They're very well
done. The production value is very high.
They're extremely informative. Not too
long. Usually like 10, 15, maybe 20
minutes. It's not a 4-hour video on
invisible walls in Super Mario 64, Mario
64. But yeah, summoning salts content is
B. It's some of the best by far. Without
question. All right, anyone else? I know
this is we got a keynote next, so I make
sure I don't want to be pulled off with
a hook today.
I don't see anyone else. All right, so
I'm here all day. If you want your badge
hacked, you want to talk about video
games, talk about open source, you want
to be a guest on Hacker History, by all
means, get in touch. Hacker history is
so much fun. Like, you would not regret
it. I promise you. Otherwise, thank you
all very much. It's been a treat.
[Applause]
[Music]