Wargames.MY 2024: World 3

Welp, time to do it again and again.

TL;DR

Local override through browser's developer tool to manipulate player stats.

Challenge Overview

World 3 is a continuation of last year's Defeat the boss! challenge, but this time it's hosted on a web server, so manipulation of local save file is no longer possible.

There are 5 bosses we have to defeat, and with each defeat, we will receive the respective part of the flag. To be fair, the first to fourth boss can be defeated by just playing the game normally. The main hurdle is the final boss, who will one-shot you every single encounter.

Inspecting Source Files

While working on World 2, I realized that the game state will always be initialized based on values defined in several .JSON files, such as:

• Actors.json: Stats of all friendly NPCs in the game, including our player.

• Enemies.json: Stats of all hostile NPCs (bosses) in the game, which includes the "rating" of each of their skillsets. The "rating" value is probably how much damage it will deal to our player.

• CommonEvents.json: Event handlers for when our player uses an item. This is important as Flag 1, 2, 3 and 5 are given when we consume a letter item (dropped from defeating the respective bosses).

• and more ...., that are not that important.

Local Override

In World 3, all the abovementioned .JSON files are loaded when we launch the game. This can be verified from the Network tab of developer tools.

The values defined in the .JSON files can be overridden locally (Right Click -> Override Content), and it will manipulate the initial state of the game when we re-load the game.

The first intuition is to override our player's level to an absurd level so that we can one-shot all the bosses we encounter on our way.

However, the game performs some kind of server-side check to ensure that we do not go over the maximum level allowed of 99. If our current level is >99, the ATTACK button will be greyed out automatically, despite having overridden the maxLevel attribute.

Without an option, I tried to speedrun all bosses with our player at level 99, and turns out level 99 is just enough to one-shot the final boss with a critical hit before it has any chance to one-shot us.

This works because our player always has priority over the bosses to perform an attack in the first round. Additionally, if a critical hit does not happen, we have the option to reroll the save file again and again thanks to the save button.

Flag: wgmy{811a332e71b5d4651edd3ddcace5b748}