---
description: Defeat the boss and you get the flag, probably, maybe, I think, hmmm
---

# Wargames.MY 2023: Defeat the boss!

## TL;DR

> Game state/data is saved locally on a .RMMZSAVE file. Manipulate game variables using an Online Save Editor to buff our player stats, get unlimited money and teleport to out-of-bounds location.&#x20;

## Challenge Overview

Defeat the boss! is an RPG game that runs on NW.JS.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FPMqDreOQrCA2j4vP1bDZ%2Fimage.png?alt=media&#x26;token=9f461518-ed6b-45e2-ae4f-05da23753de5" alt=""><figcaption></figcaption></figure>

## Game Hacking

There are 4 different challenges we have to overcome in the game to receive the flag. Our character starts with 1000 gold and base stats of Level 1.

### Stage 1: Boss Fight (Damage Multiplier)

The 1st challenge is to defeat an overpowered evil boss.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FWhkdQAe0esLK52L302D2%2Fimage.png?alt=media&#x26;token=f2b54d00-c8a2-40f0-b9bc-ef953daeaf13" alt=""><figcaption></figcaption></figure>

The boss deals over a million damage and takes essentially no damage from our attacks since we are Level 1 with minimal stats.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2F4SLa46E4Wvnvr9d4mpgi%2Fimage.png?alt=media&#x26;token=320c2b66-4570-4aad-8fb6-2ca6ad2fbed1" alt=""><figcaption></figcaption></figure>

After saving the game, the save data is saved into a .RMMZSave file locally on our machine. Using this [RMMZSave Editor](https://www.saveeditonline.com/), we can buff our character to have overpowered stats.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FduHRJqKJb3gXq9aWIs4h%2Fimage.png?alt=media&#x26;token=60defa59-1ad3-4187-a7f3-2296433bfdfe" alt=""><figcaption></figcaption></figure>

Load the save file manually and the spoofed values are now reflected in game!

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2F61S5e12ysqmmymBCiAxH%2Fimage.png?alt=media&#x26;token=165161b1-de83-42a7-8875-f8286362cbdd" alt=""><figcaption></figcaption></figure>

Since our character would always start with an action first, we can now one-shot the evil boss in just 1 hit.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FQSZCCGZeDXTV0Umz27s6%2Fimage.png?alt=media&#x26;token=3adc2fbf-7d43-4c95-a17b-d48233d83e0b" alt=""><figcaption></figcaption></figure>

First part of the flag obtained!

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FljyiNByX1n3eiZUV3M5m%2Fimage.png?alt=media&#x26;token=652fdce8-bd3c-4e3d-954a-8099ef036ffb" alt=""><figcaption></figcaption></figure>

### Stage 2: Merchant Item (Unlimited Money)

The 2nd part of the challenge is to earn enough money to buy a Dead Sea Scroll from the merchant. There is a dummy NPC available that we can farm to win 1G on each victory, but that would take a long time to reach 500k in gold.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2Fa5dGiwifVbAlBB8ZUs2h%2Fimage.png?alt=media&#x26;token=1acaa26a-3cc8-44fb-b0b2-cd8b8a2e4072" alt=""><figcaption></figcaption></figure>

Using the Save Editor from Stage 1, we can also spoof our money to afford the scroll.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FMf6N07Fb6Zukxw6XBDZg%2Fimage.png?alt=media&#x26;token=a2cbe6e0-66a3-42b2-955b-4e0b5d78d978" alt=""><figcaption></figcaption></figure>

Second part of the flag obtained!

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FHkwLoqMwvzFKOoVv4AJS%2Fimage.png?alt=media&#x26;token=0dd26d86-ea74-4bbe-bb5f-d514bfa566c9" alt=""><figcaption></figcaption></figure>

### Stage 3: Unreachable Chest (Player Teleportation)

The third part of the challenge is to loot this chest that seems impossible to reach based on the given route.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FzYi7hRq0nhotoUdhUx3M%2Fimage.png?alt=media&#x26;token=fdee983c-14b7-4f39-979a-b11ec9c58ce4" alt=""><figcaption></figcaption></figure>

Using a different [Save Editor Online](https://saveeditor.online/), we can manipulate our character's coordinates on the map. This is the exact location where our player is standing when the game is saved.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2Fj6mfJyIQN3ZVVEtEY5uJ%2Fimage.png?alt=media&#x26;token=b7716307-a589-41e3-b387-5257b0a6e807" alt=""><figcaption></figcaption></figure>

Changing the X and Y values to coordinates that are not populated by the map allows us to travel freely out-of-bounds.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FSD8fHcmscBIHDJplW49G%2Fimage.png?alt=media&#x26;token=2d20baca-0787-4e48-96a7-689e3adb745d" alt=""><figcaption></figcaption></figure>

Third part of the flag obtained!

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FzmOlVma2qtZPBCsW7OpE%2Fimage.png?alt=media&#x26;token=5c4161f8-beb7-4e06-93e3-9fe55dd465e5" alt=""><figcaption></figcaption></figure>

### Stage 4: Guessing Game

The last part of the challenge is a 7-digit number guessing game. We can technically brute force this until the right combination appears, but that would be a pain in the ass.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FO869HPGbQoccvlmod9Tz%2Fimage.png?alt=media&#x26;token=ab002442-76f7-426a-b0b1-da70fe36658a" alt=""><figcaption></figcaption></figure>

There are no signs of attributes that control the right combination, so I tried to identify the NPC's name through the save editor.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2F38OW9gj2rRJMvgXXTLog%2Fimage.png?alt=media&#x26;token=8cf0a5b5-43dd-4d4a-bad2-4dbb805a9ce1" alt=""><figcaption></figcaption></figure>

Then, I tried grepping the NPC's name from the binary to see if anything interesting was there and found the last piece of the flag unexpectedly.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2F4NqSAYHxRX0gBoFjDk8a%2Fimage.png?alt=media&#x26;token=9a5a92d8-1796-4bbf-91fe-26fdfd03a2a8" alt=""><figcaption></figcaption></figure>

## Getting the Flag

Putting everything together gives us the base64-encoded flag.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FyMPhvgX4eKTJDOv6gSHk%2Fimage.png?alt=media&#x26;token=20fa12b8-4414-422e-a290-58b338fa7752" alt=""><figcaption></figcaption></figure>

**Flag:** wgmy{9dedace597929c5316d6443d2783d291}
