Skip to content

Instantly share code, notes, and snippets.

@rgov

rgov/battlesport_cheats.py

Last active January 22, 2025 07:52
Download ZIP
Raw
battlesport_cheats.py
targets = {
(0x00091F53, 0x68FBA45D): None,
(0x00000C0E, 0x3E98F88A): None,
(0x0001A660, 0x04B58623): b'NOCHEAT',
(0x000066DB, 0xA208CA35): b'CHEATOFF',
(0x00009A12, 0xC7037294): None,
(0x0006C1D2, 0xB6327AD8): None,
(0x00005B9B, 0x4054633A): None,
(0x00011F18, 0xBD67C5D2): None,
(0x000369A7, 0x90FFC99D): None,
(0x0005DFC2, 0xC3A3D0C1): None,
(0x0012AEA6, 0xD6EDD572): None,
(0x00007C51, 0x348501F8): None,
(0x000B0354, 0x6692C49D): None,
(0x000B2974, 0x030792AE): None,
(0x0003D73D, 0x1645EBE3): None,
(0x00174E57, 0x3432E939): None,
(0x000A004D, 0x9071ECD6): None,
(0x000057AA, 0x17A7A13A): None,
(0x00003E9B, 0xC9DF00BF): None,
(0x000081FC, 0x15293D85): None,
(0x0003BDE6, 0xAD523686): None,
(0x0000CF49, 0x6BA41039): None,
(0x00006C6F, 0x4CB9D0FE): None,
(0x0011D757, 0xD026D5C2): None,
(0x0000B94C, 0x4C37F1FC): None,
(0x0000899C, 0xDAEA8887): None,
(0x000067F7, 0x5D5E8746): None,
(0x000192C7, 0x23FCE135): None,
(0x0000009A, 0x00033E70): None,
(0x000002CE, 0x00346D5B): None,
(0x00000148, 0x00033F84): None,
}
lookup = {
((ord(c) - 0x40) % 6, (ord(c) - 0x40) % 7): c
for c in 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
}
lookup |= {
((ord(c) - 0x15) % 6, (ord(c) - 0x15) % 7): c
for c in '0123456789'
}
if (0, 0) in lookup:
print('Note: Name may end with', lookup[(0,0)])
print()
for x, z in targets.keys():
# undo final multiplication by (x * 2 + 1)
modinv = pow((x * 2 + 1), -1, 2**32)
z = (modinv * z) & 0xFFFFFFFF # iVar6
# perform digit expansion for base 6 and 7
x_digits = []
while x > 0:
x_digits.append(x % 6)
x //= 6
z_digits = []
while z > 0:
z_digits.append(z % 7)
z //= 7
# pad to same length
while len(x_digits) > len(z_digits):
z_digits.append(0)
while len(x_digits) < len(z_digits):
x_digits.append(0)
print(' + '.join(f'(6**{i})*{c}' for i, c in enumerate(x_digits)))
print(' + '.join(f'(7**{i})*{c}' for i, c in enumerate(z_digits)))
decoded = ''
for a, b in zip(x_digits, z_digits):
decoded += lookup.get((a, b), '?')
print('=>', decoded)
print()
Raw
battlesport_cheats_z3.py
import z3
targets = {
(0x00091F53, 0x68FBA45D): None,
(0x00000C0E, 0x3E98F88A): None,
(0x0001A660, 0x04B58623): b'NOCHEAT',
(0x000066DB, 0xA208CA35): b'CHEATOFF',
(0x00009A12, 0xC7037294): None,
(0x0006C1D2, 0xB6327AD8): None,
(0x00005B9B, 0x4054633A): None,
(0x00011F18, 0xBD67C5D2): None,
(0x000369A7, 0x90FFC99D): None,
(0x0005DFC2, 0xC3A3D0C1): None,
(0x0012AEA6, 0xD6EDD572): None,
(0x00007C51, 0x348501F8): None,
(0x000B0354, 0x6692C49D): None,
(0x000B2974, 0x030792AE): None,
(0x0003D73D, 0x1645EBE3): None,
(0x00174E57, 0x3432E939): None,
(0x000A004D, 0x9071ECD6): None,
(0x000057AA, 0x17A7A13A): None,
(0x00003E9B, 0xC9DF00BF): None,
(0x000081FC, 0x15293D85): None,
(0x0003BDE6, 0xAD523686): None,
(0x0000CF49, 0x6BA41039): None,
(0x00006C6F, 0x4CB9D0FE): None,
(0x0011D757, 0xD026D5C2): None,
(0x0000B94C, 0x4C37F1FC): None,
(0x0000899C, 0xDAEA8887): None,
(0x000067F7, 0x5D5E8746): None,
(0x000192C7, 0x23FCE135): None,
(0x0000009A, 0x00033E70): None,
(0x000002CE, 0x00346D5B): None,
(0x00000148, 0x00033F84): None,
}
def hash_it(s, name):
# Initialize variables
x = z3.BitVecVal(0, 32)
iVar6 = z3.BitVecVal(0, 32)
multiplier_7 = z3.BitVecVal(1, 32) # iVar5
multiplier_6 = z3.BitVecVal(1, 32) # iVar4
# Process each input byte
for c in name:
# Shift values
c = z3.If(c > 0x40, c - 0x40, c - 0x15)
c = z3.ZeroExt(24, c)
# Calculate hash components
iVar6 += z3.URem(c, 7) * multiplier_7
x += z3.URem(c, 6) * multiplier_6
multiplier_6 *= 6
multiplier_7 *= 7
# Calculate final hash value
z = iVar6 * (x * 2 + 1)
return x, z
def solve_hash(t1, t2, length=8):
s = z3.Solver()
# Name character array, constrained to printable ASCII
name = [z3.BitVec(f'n_{i}', 8) for i in range(length)]
for c in name:
# s.add(c >= 32, c <= 126) # any printable ASCII character
# s.add(c >= ord('A'), c <= ord('Z')) # uppercase alpha
s.add(z3.Or(
z3.And(c >= ord('A'), c <= ord('Z')), # uppercase alpha
z3.And(c >= ord('0'), c <= ord('9')) # or numeric
))
# Compute the hash
x, z = hash_it(s, name)
s.add(
z3.Or(
x == t1, # player 1
x | (1 << 0x1A) == t1 # player 2
),
z == t2
)
if s.check() == z3.sat:
m = s.model()
return bytes([m[b].as_long() for b in name]).decode()
return None
for length in range(4, 12):
print('Considering names of length', length)
for (t1, t2), known in targets.items():
if known is not None:
continue
answer = solve_hash(t1, t2, length)
if answer is None:
continue
print(f"h'(0x{t1:08x}, 0x{t2:08x}) = '{answer}'")
targets[(t1, t2)] = answer
# Pretty print the array again
print('targets = {')
for (t1, t2), known in targets.items():
print(f' (0x{t1:08x}, 0x{t2:08x}): {known!r},')
print('}')
Raw
solution.txt
h1 = 0x00091f53 = (6^0)*3 + (6^1)*4 + (6^2)*4 + (6^3)*1 + (6^4)*5 + (6^5)*4 + (6^6)*0 + (6^7)*2
h2 = 0x0048895b = ((7^0)*6 + (7^1)*2 + (7^2)*2 + (7^3)*6 + (7^4)*5 + (7^5)*2 + (7^6)*5 + (7^7)*5) * (h1 * 2 + 1)
0 P P M E P L Z
h1 = 0x00000c0e = (6^0)*2 + (6^1)*4 + (6^2)*1 + (6^3)*2 + (6^4)*2 + (6^5)*0 + (6^6)*0
h2 = 0x00029892 = ((7^0)*2 + (7^1)*0 + (7^2)*0 + (7^3)*6 + (7^4)*0 + (7^5)*3 + (7^6)*1) * (h1 * 2 + 1)
B 1 G T N X 9
h1 = 0x0001a660 = (6^0)*2 + (6^1)*3 + (6^2)*3 + (6^3)*2 + (6^4)*5 + (6^5)*1 + (6^6)*2
h2 = 0x000b37e3 = ((7^0)*0 + (7^1)*1 + (7^2)*3 + (7^3)*1 + (7^4)*5 + (7^5)*1 + (7^6)*6) * (h1 * 2 + 1)
N O C H E A T
h1 = 0x000066db = (6^0)*3 + (6^1)*2 + (6^2)*5 + (6^3)*1 + (6^4)*2 + (6^5)*3 + (6^6)*0 + (6^7)*0
h2 = 0x0056a773 = ((7^0)*3 + (7^1)*1 + (7^2)*5 + (7^3)*1 + (7^4)*6 + (7^5)*1 + (7^6)*6 + (7^7)*6) * (h1 * 2 + 1)
C H E A T O F F
h1 = 0x00009a12 = (6^0)*4 + (6^1)*3 + (6^2)*3 + (6^3)*2 + (6^4)*0 + (6^5)*5
h2 = 0x00017a04 = ((7^0)*4 + (7^1)*6 + (7^2)*0 + (7^3)*2 + (7^4)*5 + (7^5)*5) * (h1 * 2 + 1)
D 0 U B L E
h1 = 0x0006c1d2 = (6^0)*4 + (6^1)*5 + (6^2)*0 + (6^3)*4 + (6^4)*5 + (6^5)*2 + (6^6)*3 + (6^7)*1
h2 = 0x0000b7f8 = ((7^0)*0 + (7^1)*1 + (7^2)*2 + (7^3)*4 + (7^4)*5 + (7^5)*2 + (7^6)*0 + (7^7)*0) * (h1 * 2 + 1)
1 2 3 D E B U G
h1 = 0x00005b9b = (6^0)*3 + (6^1)*2 + (6^2)*3 + (6^3)*0 + (6^4)*0 + (6^5)*3
h2 = 0x0001bf96 = ((7^0)*6 + (7^1)*2 + (7^2)*0 + (7^3)*5 + (7^4)*5 + (7^5)*6) * (h1 * 2 + 1)
0 B U L L 0
h1 = 0x00011f18 = (6^0)*2 + (6^1)*3 + (6^2)*1 + (6^3)*4 + (6^4)*2 + (6^5)*3 + (6^6)*1
h2 = 0x00005472 = ((7^0)*2 + (7^1)*1 + (7^2)*0 + (7^3)*0 + (7^4)*2 + (7^5)*1 + (7^6)*0) * (h1 * 2 + 1)
B O G 1 B O G
h1 = 0x000369a7 = (6^0)*5 + (6^1)*3 + (6^2)*2 + (6^3)*3 + (6^4)*4 + (6^5)*4 + (6^6)*4
h2 = 0x000c8953 = ((7^0)*4 + (7^1)*0 + (7^2)*2 + (7^3)*1 + (7^4)*6 + (7^5)*6 + (7^6)*6) * (h1 * 2 + 1)
K U B O 7 7 7
h1 = 0x0005dfc2 = (6^0)*2 + (6^1)*2 + (6^2)*1 + (6^3)*0 + (6^4)*3 + (6^5)*1 + (6^6)*2 + (6^7)*1
h2 = 0x000ceb0d = ((7^0)*4 + (7^1)*4 + (7^2)*1 + (7^3)*4 + (7^4)*2 + (7^5)*1 + (7^6)*0 + (7^7)*1) * (h1 * 2 + 1)
5 5 A R I A N A
h1 = 0x0012aea6 = (6^0)*4 + (6^1)*5 + (6^2)*1 + (6^3)*4 + (6^4)*2 + (6^5)*1 + (6^6)*2 + (6^7)*4
h2 = 0x00007a3a = ((7^0)*0 + (7^1)*4 + (7^2)*1 + (7^3)*0 + (7^4)*6 + (7^5)*1 + (7^6)*0 + (7^7)*0) * (h1 * 2 + 1)
1 K A 1 T A N 1
h1 = 0x00007c51 = (6^0)*1 + (6^1)*0 + (6^2)*2 + (6^3)*3 + (6^4)*0 + (6^5)*4
h2 = 0x00013da8 = ((7^0)*1 + (7^1)*4 + (7^2)*0 + (7^3)*6 + (7^4)*5 + (7^5)*4) * (h1 * 2 + 1)
A R N 0 L D
h1 = 0x000b0354 = (6^0)*2 + (6^1)*3 + (6^2)*2 + (6^3)*5 + (6^4)*4 + (6^5)*2 + (6^6)*3 + (6^7)*2
h2 = 0x001baad5 = ((7^0)*2 + (7^1)*1 + (7^2)*2 + (7^3)*1 + (7^4)*6 + (7^5)*2 + (7^6)*1 + (7^7)*2) * (h1 * 2 + 1)
B O B 2 7 B O B
h1 = 0x000b2974 = (6^0)*0 + (6^1)*4 + (6^2)*3 + (6^3)*2 + (6^4)*0 + (6^5)*4 + (6^6)*3 + (6^7)*2
h2 = 0x0012247e = ((7^0)*5 + (7^1)*0 + (7^2)*3 + (7^3)*1 + (7^4)*5 + (7^5)*0 + (7^6)*3 + (7^7)*1) * (h1 * 2 + 1)
L 1 C H L 1 C H
h1 = 0x0003d73d = (6^0)*3 + (6^1)*5 + (6^2)*1 + (6^3)*1 + (6^4)*2 + (6^5)*2 + (6^6)*5 + (6^7)*0
h2 = 0x003cefb9 = ((7^0)*1 + (7^1)*4 + (7^2)*6 + (7^3)*1 + (7^4)*4 + (7^5)*6 + (7^6)*5 + (7^7)*4) * (h1 * 2 + 1)
O K M A 5 T E R
h1 = 0x00174e57 = (6^0)*5 + (6^1)*1 + (6^2)*1 + (6^3)*3 + (6^4)*2 + (6^5)*4 + (6^6)*2 + (6^7)*5
h2 = 0x003ee297 = ((7^0)*3 + (7^1)*6 + (7^2)*1 + (7^3)*3 + (7^4)*1 + (7^5)*0 + (7^6)*0 + (7^7)*5) * (h1 * 2 + 1)
Q M A C H 1 N E
h1 = 0x000a004d = (6^0)*3 + (6^1)*3 + (6^2)*2 + (6^3)*4 + (6^4)*1 + (6^5)*0 + (6^6)*2 + (6^7)*2
h2 = 0x00186ce2 = ((7^0)*6 + (7^1)*0 + (7^2)*6 + (7^3)*4 + (7^4)*1 + (7^5)*4 + (7^6)*6 + (7^7)*1) * (h1 * 2 + 1)
0 U T D A R T H
h1 = 0x000057aa = (6^0)*2 + (6^1)*2 + (6^2)*5 + (6^3)*1 + (6^4)*5 + (6^5)*2
h2 = 0x00019852 = ((7^0)*6 + (7^1)*1 + (7^2)*5 + (7^3)*3 + (7^4)*1 + (7^5)*6) * (h1 * 2 + 1)
T H E 4 2 T
h1 = 0x00003e9b = (6^0)*1 + (6^1)*1 + (6^2)*1 + (6^3)*2 + (6^4)*0 + (6^5)*2
h2 = 0x00019cb9 = ((7^0)*6 + (7^1)*1 + (7^2)*0 + (7^3)*0 + (7^4)*2 + (7^5)*6) * (h1 * 2 + 1)
M A G N 3 T
h1 = 0x000081fc = (6^0)*0 + (6^1)*2 + (6^2)*0 + (6^3)*4 + (6^4)*1 + (6^5)*4
h2 = 0x000110ed = ((7^0)*2 + (7^1)*6 + (7^2)*4 + (7^3)*0 + (7^4)*1 + (7^5)*4) * (h1 * 2 + 1)
3 T R 1 A D
h1 = 0x0003bde6 = (6^0)*2 + (6^1)*4 + (6^2)*1 + (6^3)*1 + (6^4)*3 + (6^5)*1 + (6^6)*5
h2 = 0x0001069e = ((7^0)*2 + (7^1)*0 + (7^2)*0 + (7^3)*0 + (7^4)*0 + (7^5)*4 + (7^6)*0) * (h1 * 2 + 1)
B 1 G G U Y 8
h1 = 0x0000cf49 = (6^0)*1 + (6^1)*0 + (6^2)*4 + (6^3)*5 + (6^4)*4 + (6^5)*0 + (6^6)*1
h2 = 0x00084983 = ((7^0)*5 + (7^1)*5 + (7^2)*2 + (7^3)*1 + (7^4)*2 + (7^5)*4 + (7^6)*4) * (h1 * 2 + 1)
S L P 2 P R Y
h1 = 0x00006c6f = (6^0)*3 + (6^1)*0 + (6^2)*3 + (6^3)*2 + (6^4)*3 + (6^5)*3
h2 = 0x000188c2 = ((7^0)*5 + (7^1)*6 + (7^2)*0 + (7^3)*6 + (7^4)*6 + (7^5)*5) * (h1 * 2 + 1)
6 F U T 0 6
h1 = 0x0011d757 = (6^0)*1 + (6^1)*5 + (6^2)*0 + (6^3)*1 + (6^4)*2 + (6^5)*0 + (6^6)*1 + (6^7)*4
h2 = 0x0006c6de = ((7^0)*4 + (7^1)*5 + (7^2)*5 + (7^3)*6 + (7^4)*2 + (7^5)*5 + (7^6)*3 + (7^7)*0) * (h1 * 2 + 1)
Y E L M B L 4 1
h1 = 0x0000b94c = (6^0)*0 + (6^1)*4 + (6^2)*3 + (6^3)*3 + (6^4)*0 + (6^5)*0 + (6^6)*1
h2 = 0x0005bb5c = ((7^0)*3 + (7^1)*1 + (7^2)*1 + (7^3)*3 + (7^4)*2 + (7^5)*1 + (7^6)*3) * (h1 * 2 + 1)
X V O C 3 9 4
h1 = 0x0000899c = (6^0)*2 + (6^1)*3 + (6^2)*0 + (6^3)*1 + (6^4)*3 + (6^5)*4
h2 = 0x0001b9bf = ((7^0)*2 + (7^1)*6 + (7^2)*4 + (7^3)*0 + (7^4)*5 + (7^5)*6) * (h1 * 2 + 1)
B 0 R G 6 7
h1 = 0x000067f7 = (6^0)*5 + (6^1)*1 + (6^2)*1 + (6^3)*3 + (6^4)*2 + (6^5)*3 + (6^6)*0 + (6^7)*0
h2 = 0x0024271a = ((7^0)*2 + (7^1)*1 + (7^2)*4 + (7^3)*5 + (7^4)*6 + (7^5)*0 + (7^6)*6 + (7^7)*2) * (h1 * 2 + 1)
W A Y 6 T U F 3
h1 = 0x000192c7 = (6^0)*1 + (6^1)*1 + (6^2)*2 + (6^3)*3 + (6^4)*1 + (6^5)*1 + (6^6)*2 + (6^7)*0
h2 = 0x000d12fb = ((7^0)*6 + (7^1)*1 + (7^2)*0 + (7^3)*6 + (7^4)*6 + (7^5)*1 + (7^6)*0 + (7^7)*1) * (h1 * 2 + 1)
M A N 0 M A N 9
h1 = 0x0000009a = (6^0)*4 + (6^1)*1 + (6^2)*4 + (6^3)*0
h2 = 0x000002b0 = ((7^0)*2 + (7^1)*0 + (7^2)*0 + (7^3)*2) * (h1 * 2 + 1)
P G 1 3
h1 = 0x000002ce = (6^0)*4 + (6^1)*5 + (6^2)*1 + (6^3)*3
h2 = 0x00000957 = ((7^0)*4 + (7^1)*5 + (7^2)*6 + (7^3)*6) * (h1 * 2 + 1)
D E M 0
h1 = 0x00000148 = (6^0)*4 + (6^1)*0 + (6^2)*3 + (6^3)*1
h2 = 0x00000144 = ((7^0)*2 + (7^1)*4 + (7^2)*6 + (7^3)*0) * (h1 * 2 + 1)
P R 0 G
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment