#GOOGLE MINESWEEPER PATCH#
#GOOGLE MINESWEEPER CODE#
#GOOGLE MINESWEEPER WINDOWS#

#GOOGLE MINESWEEPER CODE#

So the original code was modified to look like this: 010026E9 JMP patched_minesweeper.01004A60 010026EE NOP 010026EF NOP 010026F26F26F2 NOP

#GOOGLE MINESWEEPER PATCH#

I padded the remaining bytes with NOPs and added the overridden instruction to my patch (see line 1004A66 above). But even the JMP opcode takes more than 3 bytes, meaning I had to override not only the AND instruction but also the one following it. In order to run my new code, I needed to use a JMP instruction from the original code. If it is a mine, replace 0x8F with 0x0E (the value required for drawing a flag).If it is not a mine, go on with the original code, namely draw an empty square.Notice how this assembly code implements the pseudo-code from above: Using a hex-editor and a nice online assembler, I added my opcodes, corresponding to the following x86 instruction sequence: 1004A60 CMP AL, 8F 1004A62 JNZ SHORT patched_minesweeper.01004A66 1004A64 MOV AL, 0E 1004A66 PUSH DWORD PTR DS: 1004A6D JMP patched_minesweeper.010026F3 I searched the executable file for a slot in the code section with enough null bytes which I could replace with my own code. The existing AND instruction takes 3 bytes of opcode. The logic I wanted to implement was this: if board_location = 0x8F: draw_flag else: draw_empty_square I needed to make this AND instruction more flexible and take into consideration the value of the currently-processed square. This AND instruction was too strict and it was the key to what I was trying to achieve. This left 0x0F to represent an empty square.īy ANDing with 0x1F on line 10026E9 (see IDA screenshot), both 0x0F and 0x8F end up being 0x0F, but I wanted them to be 0x0E, remember?😉 There were exactly ten 0x8F’s, which suggested that 0x8F is a value representing mines.So 0x10 must be a delimiter for rows on the board. Each pair of 0x10’s is exactly 9-bytes distant.I even got to know a very talented, young researcher who (in a strange coincidence) hacked Minesweeper too and published his own post about it! I was so excited I had to tweet something, which proved as a great thing to do as I received many likes, comments, retweets and GitHub-link requests.

#GOOGLE MINESWEEPER WINDOWS#

It took me one week, tens of hours, many Windows API Google-searches and way too many breakpoints to finish, but I finally did it.

He suggested that I hacked Minesweeper, such that when Minesweeper starts up, all mines are marked with flags.

I was looking for an interesting challenge that I could use in my workshop.Ī dear friend of mine, Aviad Carmel, is a super-skilled reverser and my reverse engineering mentor. When I started planning the workshop’s last session - I had no idea what to do. I was given the amazing yet terrifying task of teaching the Reverse Engineering workshop. This event is organized by Baot and its goal is to attract more women into the low level and security fields. Two weeks from today, the first Low Level & Security Celebration will take place. Put The Flags Out! - Hacking Minesweeper Background

Google minesweeper