Hacking Pushmo/Pullblox QR codes analyzed

  • Thread starter Thread starter celcodioc
  • Start date Start date
  • Views Views 12,420
  • Replies Replies 59
  • Likes Likes 3
First hacked Pushmo level:

crc_test2.jpg


Lol, not much, but it shows that it's clearly a hacked level.

Ha, nice! :P

When I try to "read from Image" or "write from image" the program crashes. Probably because I haven't loaded a .bin though...
EDIT: when I load either .bin from the OP's post, it says Corrupted Pushmo binary.

I'll upload fixed .bin files. It shouldn't though when reading from an image though as it always works for me...

EDIT: A 3dsexplorer.bin file should be included with the program. Try it. Otherwise I can't help you much because I'm not the one who made the program ;)

EDIT2: Just uploaded fixed .bin files
 
First hacked Pushmo level:

crc_test2.jpg


Lol, not much, but it shows that it's clearly a hacked level.

Ha, nice! :P

When I try to "read from Image" or "write from image" the program crashes. Probably because I haven't loaded a .bin though...
EDIT: when I load either .bin from the OP's post, it says Corrupted Pushmo binary.

I'll upload fixed .bin files. It shouldn't though when reading from an image though as it always works for me...

EDIT: A 3dsexplorer.bin file should be included with the program. Try it. Otherwise I can't help you much because I'm not the one who made the program ;)

EDIT2: Just uploaded fixed .bin files
It still doesn't work...
 
For those of you interested, we'll be releasing details on the checksum algorithm in the near future!

Video fun:
http://www.youtube.com/watch?v=X9gt-w8dqyY

Try out the QR at the end of the video, if you don't feel like watching what actual editing takes place during. You'll notice the level ends up being nameless, features an assortment of random patterns (in the earlier portions of the video you'll see me using 0x01,0x23,0x45 repeatedly), and has no finish! Trololol. Enjoy.
 
Create a buffer overflow, incorporate some kind of loader, homebrew? Nah, just me being noobish ^^ (Yes I know that the knowledege on the 3DS isn't good enough for such a loader as of now!
 
Create a buffer overflow, incorporate some kind of loader, homebrew? Nah, just me being noobish ^^ (Yes I know that the knowledege on the 3DS isn't good enough for such a loader as of now!

Hehe, its been attempted and deemed to be impossible with this game, at the moment. We'll release the checksum algorithm once all of our experimenting is through ;)
 
Create a buffer overflow, incorporate some kind of loader, homebrew? Nah, just me being noobish ^^ (Yes I know that the knowledege on the 3DS isn't good enough for such a loader as of now!

Hehe, its been attempted and deemed to be impossible with this game, at the moment. We'll release the checksum algorithm once all of our experimenting is through ;)

Impossible because of no crashing at all.

Anyhow, an interesting tidbit with the first 8 bytes, labeled as unknown in elisherer's pushmo editor. If the first 4 bytes of those 8 is not equal to 0x8D060000, then the game reports that its not pushmo data. The second 4 of the 8 however, seems to be a pushmo data version. Currently, if it is not equal to 0x00000000, then you get this.
pushmo_future2.png
.

This seems to be checked even before the crc32 field.
 
Create a buffer overflow, incorporate some kind of loader, homebrew? Nah, just me being noobish ^^ (Yes I know that the knowledege on the 3DS isn't good enough for such a loader as of now!

Hehe, its been attempted and deemed to be impossible with this game, at the moment. We'll release the checksum algorithm once all of our experimenting is through ;)

Impossible because of no crashing at all.

Anyhow, an interesting tidbit with the first 8 bytes, labeled as unknown in elisherer's pushmo editor. If the first 4 bytes of those 8 is not equal to 0x8D060000, then the game reports that its not pushmo data. The second 4 of the 8 however, seems to be a pushmo data version. Currently, if it is not equal to 0x00000000, then you get this. .

This seems to be checked even before the crc32 field.

The first 2 bytes are just to identify that it's Pushmo data at all, the second two (like you stated) are probably some type of version identifier. The game has a whole array of errors it likes to spit out if you try editing different areas of the level data :) It's quite fun to see what the developers threw in there! Anyway, I think we'll be releasing the checksum information tomorrow sometime...

EDIT: Scratch that. We have made new developments...We'll keep you all posted!!! (P.S. One of your statements was incorrect, Caitsmith2)
 
Wanted left shift/right shift in the editor?

Code:
else if (sender ==tbtnShiftLeft)
{
//Data
for (var y = 0; y < Pushmo.BitmapSize; y++)
{
byte tempbyte = gridControl.Bitmap[y][0];
Buffer.BlockCopy(gridControl.Bitmap[y], 1, gridControl.Bitmap[y], 0, Pushmo.BitmapSize - 1);
gridControl.Bitmap[y][Pushmo.BitmapSize - 1] = tempbyte;
}
//Objects
if (gridControl.Flag.X != 0xFF)
{
if (gridControl.Flag.X == 0)
gridControl.Flag.X = Pushmo.BitmapSize - 1;
else
gridControl.Flag.X--;
}
for (var i = 0; i < gridControl.PulloutSwitches.Length; i++)
{
if (gridControl.PulloutSwitches[i].X != 0xFF)
{
if (gridControl.PulloutSwitches[i].X == 0)
gridControl.PulloutSwitches[i].X = Pushmo.BitmapSize - 1;
else
gridControl.PulloutSwitches[i].X--;
}
if (gridControl.Manholes[i].X != 0xFF)
{
if (gridControl.Manholes[i].X == 0)
gridControl.Manholes[i].X = Pushmo.BitmapSize - 1;
else
gridControl.Manholes[i].X--;

}
}
}
else if (sender == tbtnShiftRight)
{
//Data
for (var y = 0; y < Pushmo.BitmapSize; y++)
{
var tempArray = new byte[Pushmo.BitmapSize];
Buffer.BlockCopy(gridControl.Bitmap[y], 0, tempArray, 0, Pushmo.BitmapSize);
Buffer.BlockCopy(tempArray, 0, gridControl.Bitmap[y], 1, Pushmo.BitmapSize - 1);
gridControl.Bitmap[y][0] = tempArray[Pushmo.BitmapSize - 1];
}
//Objects
if (gridControl.Flag.X != 0xFF)
{
if (gridControl.Flag.X == Pushmo.BitmapSize - 1)
gridControl.Flag.X = 0;
else
gridControl.Flag.X++;
}
for (var i = 0; i < gridControl.PulloutSwitches.Length; i++)
{
if (gridControl.PulloutSwitches[i].X != 0xFF)
{
if (gridControl.PulloutSwitches[i].X == Pushmo.BitmapSize - 1)
gridControl.PulloutSwitches[i].X = 0;
else
gridControl.PulloutSwitches[i].X++;
}
if (gridControl.Manholes[i].X != 0xFF)
{
if (gridControl.Manholes[i].X == Pushmo.BitmapSize - 1)
gridControl.Manholes[i].X = 0;
else
gridControl.Manholes[i].X++;

}
}
}
 
Pushmo Crash
Interesting development, though I'm not sure if we could start running unsigned code through that kind of crash, or shall I say "freeze".

... Whoops, forgot that this wasn't a Pushmo Hacking thread.
 
Pushmo Crash

We've started a technical discussion on Pushmo QR codes here:
http://game-hackers....cussion?p=30934

It should (or will, shortly) have all of the information you would want, including some source code and a checksum patching app. Look forward to seeing this level editor develop!

A buffer overflow! We can hack the 3DS now! Oh, wait, stop dreaming. (And yes, I know we need more than a buffer overflow ;))

Anyway, nice work guys.

Also, @elisherer, did you finally add saving? :P
 

Site & Scene News

Popular threads in this forum