shalzuth

I’m finally trying to jump on the AI train for a long ride instead of getting off at the first stop.

I’m currently creating a new fan site for Marvel Rivals (https://marvelrivals.app), and I’m trying to introduce new types of features using predictive analysis, and further, use some DL maybe to understand specific player behavior and do stuff like find cheaters. I am failing so far.

I thought it’d be easier to throw data at the magic AI monster, but it’s still garbage in -> garbage out. It makes me respect AI engineers a lot more.

I wish there was an easier way to apply AI to this kind of stuff, on the how to do better data analysis. Ideally, I’d hook up some tool to my Postgres db, which has a couple tables but everything is named appropriately and has references. Then the tool would output correlations, patterns, stuff people would find useful and interesting. Instead, right now, I think I have to make those guesses and then build models that will either support my hypothesis or reject it, but I don’t know ahead of time and it relies on my gut feelings.

You’re right - I should have specified more explicitly. I am not referring to the game dev that is developing game features or content - I am specifically talking about the “security engineering” organizations within game developer companies. NetEase hired security engineers to specifically do security related tasks (see NetEase AntiCheat @ https://dun.163.com/locale/en?force=true). NetEase Games doesn’t have an excuse for not conducting a security review on a massive game like Marvel Rivals - and this isn’t some corner case, this is part of the core architecture.

And this is not a story unique to NetEase. I have multiple other examples that I’ll probably talk about in the future.

That's the issue - they don't! But even games like Helldivers 2 have had silly vulnerabilities (just not RCE) - see https://helldivers.io/freesupercredits for some examples.

PS5 games are sandboxed, so it only allows an entrypoint to run code. For full PS5 exploitation, another chain is needed to go break out of the sandbox.

The one implication that I (the author) should highlight for the extra paranoid - this exploit extends to ISP's and cloud vendors that traffic is routed through. Anywhere in the trace route can MITM. It depends on how much you trust those parties.

I was researching Marvel Rivals with a friend (AeonLucid) and found an interesting (LAN) RCE. Many game devs lack proper security training and/or care about security, so I'm talking about the impact of security outside of cheaters and putting an emphasis on player safety.

The main reason I didn't include diamond is because it's a bit more complicated to crawl diamond players versus challenger/master. But feedback received, it's definitely not statistically significant for some of the uncommon skins (only 35k matches total, or 350k sightings of being played since there are 10 selections per match). I'll try to add that wider net this week.

I wanted to test if League of Legends premium skins actually improve your performance - or if they’re only cosmetic as Riot claims. Using data analysis, I broke down the numbers to find out. Along the journey, I reverse engineered the game's replay format and network protocol to collect the data.

Blog post - https://shalzuth.com/Blog/PayToWinSkinsInLeague Data/results - https://LeagueOfWhales.com Let me know what you think!

I wrote a short blog post about my thought process on how I reverse engineer video games and build tools that enable me to do security testing on them. It’s a bit brief on purpose, as reading the code is expected. Let me know your thoughts and what would make it better.