Damocles: Cradles Game Analysis Report

Author: Damocles

I. Summary

Cradles was made available for download on November 15, and the Damocles team conducted an in-depth security analysis of the game on November 16. The analysis revealed that the game contains a large amount of undeleted debug information, suggesting that the development team is based in China. Additionally, during testing, it was found that the game lacks any security protections, uses an open-source engine for part of its communication protocol, and exhibits overly lax logical checks, making it not recommended for users to play.

II. Game Background

Game version evaluated: 20231115
Game type & game engine: MMORPG, Unity2021.3.x
Potential gameplay issues:
Illegal movement (malicious packet manipulation for teleportation, acceleration, etc.)
Acceleration (in-game world time, time functions under UE framework)
Aimbot/auto-lock
Invincibility
Unlimited stamina
Mining acceleration

III. Game Security Analysis

Game code protection:
Analysis process:

1. Different engines have different analysis modes, so after obtaining the game EXE, the first step is to determine the engine used. By identifying the basic information of the game, we can confirm that it is developed using Unity 21.3.x.

2. By browsing the released game files, it can be confirmed that the game uses the Mono mechanism and does not adopt the iL2Cpp mode for development. Games developed in this way generally have lower overall security and are easier to analyze.

Moreover, the protocol framework used by the game is KBEngine.

Therefore, the source code of KBEngine and some public information can be obtained from open-source repositories like GitHub, which can speed up the game analysis process.

Analysis Conclusion:

Cradles scores 0 in terms of game code protection, with no protection at all. In traditional games, custom encryption and packing methods are often used to protect the source code, and traditional games rarely compile using the Mono mode. The lack of robust foundational code protection and the use of outdated compilation techniques in Cradles result in a low threshold and cost for malicious players to analyze the code. If cheats emerge, it would be extremely unfair to normal players, especially in areas where players can freely duel, making it easier for malicious players to defeat their opponents.

Basic Anti-Cheat Measures:

Analysis Process:

1. In terms of basic anti-cheat detection, we mainly test two aspects: whether the game has anti-debugging measures and whether it has read/write protection.
2. While the game is running, we used CE to attach and set breakpoints on common functions, discovering that the game did not exit or provide any prompts.

3. By using CE to modify stamina and HP in the game, we found that the changes were effective, and the game did not display any pop-ups or prompts. (Modifying stamina allows for infinite stamina/mana, and HP locking can be effective within 10 seconds.)

Analysis Conclusion:

1. Cradles scores 0 in anti-cheat capabilities; if malicious users exist, they can cheat at will.

2. The reason for testing only anti-debugging and read/write protection is that for a cheat tool, finding data and implementing functions can be achieved through debugging and read/write operations. If the most basic two protective capabilities are missing, then other detections like injection and hooking are meaningless.

Game Logic Issues

Analysis Process:

For MMORPG games compiled using the Mono method, directly modifying data is generally low-yield. However, during our testing, we found that modifications to certain data, such as health and stamina, were effective. Specifically, health modifications remained effective for 9 seconds; beyond that time, players could not attack monsters, suggesting that there is a damage time limit on the server. Stamina modifications could remain effective for a long time, indicating that the server does not perform any checks, as when a local character's stamina is depleted, it can recover by pausing movement. If recovery is possible locally, then the game can skip the server validation step.
Stamina update logic:

Health update logic:

Additionally, the Avatar class contains many attributes related to the character, and there should be other exploitable points within these attributes.

Analysis Conclusion:

1. Cradles has serious overall game logic security issues, especially since the game involves a forced PVP mode. The low threshold for cheat development and high rewards mean that once a functional cheat is developed, it can easily lead to one-sided slaughter.
2. There is a lack of awareness regarding game data and detection of other vulnerable points within the game. Additionally, since it uses an open-source engine, its protocol is completely open, which poses a high risk for games involving mining.

Game Protocol Analysis

Cradles uses the KBEngine engine as its protocol foundation, and there are existing resources available online regarding this engine.
Reference materials:

1. KBEngine Technical Overview
2. KBEngine MMORPG Demo
3. KBEngine Unity3D Plugins

WEB3 Security Analysis:

As Cradles' tokens have not yet been launched, the WEB3 analysis is on hold. Furthermore, since the mining-related protocols are fully exposed, the amount of mining for users is merely a temporary number for the game, so this part will not be analyzed further.

About Damocles

Damocles Labs is a security team established in 2023, focusing on security in the Web3 industry. Our services include: contract code auditing, business code auditing, penetration testing, GameFi code auditing, GameFi vulnerability discovery, GameFi cheat analysis, and GameFi anti-cheat measures.
We will continue to make efforts in the Web3 security industry and strive to produce as many analysis reports as possible to enhance the awareness of project parties and users regarding GameFi security, as well as to promote the safe development of the industry.