It's all start from October 21st, 2015, where the disaster started. It was me developing an SIF files decrypter a few years ago. Probably the first one which become open source, based on my first successful attempt to reverse engineer program (read: SIF). I was hoping this tool can be good for datamining the game files to make predictions more and more accurate (PS: it's Eli Ayase birthday; I choose that specific date to release my decrypter).
Times has passed, like 1 year and 2 years. My decrypter received good support of being able to dump all cards, game database, and even almost-functional SIF private server at that time. It helps me alot understanding the game mechanics, as well as helping other people dumping card images from their rooted phone. Not to add my SIF live simulator is mostly based on what I found in SIF game code.
Somewhere in the early 2018, someone asked me (from Indonesia), via my Live Simulator: 2 Facebook page, how to decrypt Lua files with HonokaMiku. This is probably where things start to be in situation like today. I'm sorry, I wasn't aware at that time where he used it to create modded game, so I tell him how to do things like "unluac", but not all.
A few days later there was a news that there's Indonesian hacker which reach the top 10 event song ranking, and my reaction like "Man WTF?". After some investigating, he post it in Android modding forums. He even write my internet name (MikuAuahDark) in his post because he used HonokaMiku to create his modified APK and I'm angry because that, so I asked him to apologize and remove my name. Yet, only for some time, then he's strikes again.
Today, most dataminers now uses libhonoka, another decrypter which I write entirely in C, unlike HonokaMiku which is written in C++. It's also faster and better than HonokaMiku, but I swear I'll not give libhonoka to anyone unless who I trusted. It can compromise the game in point where changing encryption is not an option.
Cheaters (mostly Indonesians, or I'm just gonna call them Indons) are now widely spreaded. KLab WW (or should I call it Kebab?) tried to ban accounts for cheating, multiple times, or at every end of event, by nuking suspicious event ranking. But Caraxian said (one of dataminer) that banned accounts in SIF WW can be retrieved back if you have the passcode. Man for real?
To the cheaters, I suggest you not to use the modified APK for cheating, but use something like automated scripts which can save your time reaching the ranking. If you know about "The Friendly Hacker", you should get the idea. The downside is, you need to know how to authenticate with the server (which is stored in binary, and you have to read tons of assembly code for that).
(FYI: The same person, the cheater, actually tries to hack in SIF JP, but got real banned a few minutes later lol).
I've tried many ways to stop them all, including requesting KLab WW (in this context, Kebab) to takedown my decrypter and it's forks for good. I've tried multiple times, but they just didn't do anything. If KLab WW (Kebab) staff read this, please, please, just request GitHub to takedown that repository, along with all of it's forks, and switch your game encryption immediately. If you have better idea how to stop those cheaters, just comment below and I'll send it to Kebab.
TL;DR: SIF WW is compromised because HonokaMiku, and KLab WW (again, Kebab) haven't do anything to strengthen their game security.
It was the point where I was not aware, but now, I'm aware about this nice quote.
"With Great Power Comes Great Responsibility" - Ben Parker
Sorry to hear that, fam.
ReplyDeleteSo you said "If you have better idea how to stop those cheaters", I'd suggest you to stop the cheat creator not by reporting your source code.
ReplyDelete