From 46ec8f52e7be21a467287c9f5ba64cebb35f0a28 Mon Sep 17 00:00:00 2001 From: Aldo Cortesi Date: Mon, 27 Jun 2011 16:38:00 +1200 Subject: Prep for 0.5 release - Update CHANGELOG and CONTRIBUTORS - Bump version - Include Apple Gamecenter highscore setting tutorial in docs --- doc-src/tutorials/gamecenter.html | 105 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 doc-src/tutorials/gamecenter.html (limited to 'doc-src/tutorials/gamecenter.html') diff --git a/doc-src/tutorials/gamecenter.html b/doc-src/tutorials/gamecenter.html new file mode 100644 index 00000000..bf398cd1 --- /dev/null +++ b/doc-src/tutorials/gamecenter.html @@ -0,0 +1,105 @@ + +## The setup + +In this tutorial, I'm going to show you how simple it is to creatively +interfere with Apple Game Center traffic using mitmproxy. To set things up, I +registered my mitmproxy CA certificate with my iPhone - there's a [step by step +set of instructions](@!urlTo("certinstall/ios.html")!@) elsewhere in this manual. I then +started mitmproxy on my desktop, and configured the iPhone to use it as a +proxy. + + +## Taking a look at the Game Center traffic + +Lets take a first look at the Game Center traffic. The game I'll use in this +tutorial is [Super Mega +Worm](http://itunes.apple.com/us/app/super-mega-worm/id388541990?mt=8) - a +great little retro-apocalyptic sidescroller for the iPhone: + +
+ +
+ +After finishing a game (take your time), watch the traffic flowing through +mitmproxy: + +
+ +
+ +We see a bunch of things we might expect - initialisation, the retrieval of +leaderboards and so forth. Then, right at the end, there's a POST to this +tantalising URL: + +
+https://service.gc.apple.com/WebObjects/GKGameStatsService.woa/wa/submitScore
+
+ +The contents of the submission are particularly interesting: + + + + + category + SMW_Adv_USA1 + score-value + 55 + timestamp + 1301553284461 + + + + +This is a [property list](http://en.wikipedia.org/wiki/Property_list), +containing an identifier for the game, a score (55, in this case), and a +timestamp. Looks pretty simple to mess with. + + +## Modifying and replaying the score submission + +Lets edit the score submission. First, select it in mitmproxy, then press +__enter__ to view it. Make sure you're viewing the request, not the response - +you can use __tab__ to flick between the two. Now press __e__ for edit. You'll +be prompted for the part of the request you want to change - press __b__ for +body. Your preferred editor (taken from the EDITOR environment variable) will +now fire up. Lets bump the score up to something a bit more ambitious: + + + + + category + SMW_Adv_USA1 + score-value + 2200272667 + timestamp + 1301553284461 + + + + +Save the file and exit your editor. + +The final step is to replay this modified request. Simply press __r__ for +replay. + +## The glorious result and some intrigue + +
+ +
+ +And that's it - according to the records, I am the greatest Super Mega Worm +player of all time. + +Curiously, the top competitors' scores are all the same: 2,147,483,647. If you +think that number seems familiar, you're right: it's 2^31-1, the maximum value +you can fit into a signed 32-bit int. Now let me tell you another peculiar +thing about Super Mega Worm - at the end of every game, it submits your highest +previous score to the Game Center, not your current score. This means that it +stores your highscore somewhere, and I'm guessing that it reads that stored +score back into a signed integer. So, if you _were_ to cheat by the relatively +pedestrian means of modifying the saved score on your jailbroken phone, then +2^31-1 might well be the maximum score you could get. Then again, if the game +itself stores its score in a signed 32-bit int, you could get the same score +through perfect play, effectively beating the game. So, which is it in this +case? I'll leave that for you to decide. -- cgit v1.2.3