CubeMadness2 — HackTheBox

Description

Unity IL2CPP game protected by CodeStage AntiCheat Toolkit (ObscuredInt, ObscuredFloat, ObscuredString). The goal is to collect 20 cubes to get the flag, but only ~14 cubes exist in the game world, making legitimate victory impossible. The game runs on a remote Windows server accessible via WinRM.

Analysis

Metadata Extraction (Il2CppDumper)

IL2CPP compiles C# to native code but preserves metadata (class names, methods, fields) in global-metadata.dat. Il2CppDumper extracts this metadata:

GameAssembly.dll + global-metadata.dat → dump.cs, script.json, stringliteral.json

Key classes (names obfuscated):

Class	Parent	Description	Key fields/methods
CubeCounter (extends j)	MonoBehaviour	Cube counter	Text rmu (0x18), int rmv (0x20), int rmw (0x24)
FlagCheck (extends m)	MonoBehaviour	Win check	SpriteRenderer rmx (0x18), string rmy (0x20)
Player	MonoBehaviour	Player	TypeDefIndex 2814
Cube (extends g)	MonoBehaviour	Collectible cube	TypeDefIndex 2815
ObscuredString (extends g)	—	Encrypted string	TypeDefIndex 2820

FlagCheck (m) methods:

• Start() RVA 0x740660
• Update() RVA 0x740810 — main win condition check
• cbm() RVA 0x7409B0
• onh() RVA 0x740A40

Win Condition Analysis

In m.Update() (RVA 0x740810) found the check:

mov rcx, [rax+0xB8]          ; load ObscuredInt cube counter
cmp dword ptr [rcx], 0x6874   ; compare with encrypted threshold
jge +0x17                      ; if >= threshold → show flag (SpriteRenderer.SetActive)

• 0x6874 — encrypted threshold value (ObscuredInt: hiddenValue = value ^ currentCryptoKey)
• jge (opcode 7D) — conditional jump controlling flag sprite display
• Flag is not stored in files — constructed at runtime from ObscuredString

Asset Extraction (AssetRipper)

AssetRipper extracted sprites, textures, scenes, but:

• Scripts are empty stubs (AssetRipper doesn't decompile IL2CPP)
• Flag text not found in any file — confirms runtime construction

CodeStage AntiCheat — ObscuredInt

ObscuredInt memory structure:

Offset 0x00: currentCryptoKey (int)
Offset 0x04: hiddenValue (int) = value ^ currentCryptoKey
Offset 0x08: inited (bool)
Offset 0x0C: fakeValue (int) = value (for integrity check)
Offset 0x10: fakeValueActive (bool)

AntiCheat compares hiddenValue ^ currentCryptoKey with fakeValue. On mismatch — the value is reset.

Failed Approaches

Memory Hacking (didn't work)

Created several tools for memory scanning and modification:

• FS.exe — full ObscuredInt pattern scanner
• M.exe — integer value scanner
• W.exe — process memory writer

Result:

1. Found ObscuredInt cube counter in memory
2. Successfully changed to 19, then 20
3. AntiCheat detected mismatch between hiddenValue and fakeValue and reset the value
4. Even when updating both fields simultaneously — AntiCheat still caught the modification

Conclusion: ObscuredInt memory modification is unreliable due to CodeStage integrity checks.

Solution

Binary Patching — Bypassing the Condition Check

Instead of modifying data (counter value) — modify the code (check condition).

Step 1: Find GameAssembly.dll Base Address

$proc = Get-Process CubeMadness2
$ga = $proc.Modules | Where-Object { $_.ModuleName -eq "GameAssembly.dll" }
$base = $ga.BaseAddress  # e.g., 0x7FFB668B0000

Step 2: Calculate jge Instruction Address

Runtime address = base + RVA_offset_of_jge_instruction

RVA found by analyzing disassembled m.Update() in GameAssembly.dll.

Step 3: Patch jge → jmp (unconditional)

Created P.exe — binary patching tool:

// Key steps:
// 1. OpenProcess with PROCESS_ALL_ACCESS
// 2. VirtualProtectEx — remove page protection (PAGE_EXECUTE_READWRITE)
// 3. WriteProcessMemory — replace opcode
// 4. VirtualProtectEx — restore protection

// Patch: 7D → EB
// 7D = jge (jump if greater or equal) — conditional jump
// EB = jmp short — unconditional jump
WriteProcessMemory(hProcess, targetAddr, new byte[] { 0xEB }, 1, out _);

Result: The "show flag" branch executes always, regardless of collected cube count.

Step 4: Capture Screen with Flag

Game runs on remote Windows server via WinRM (Session 0, non-interactive):

# WinRM runs in Session 0 — direct screenshots give empty screen
# Solution: run via Scheduled Task in interactive Session 1

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-File C:\screenshot.ps1"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddSeconds(5)
Register-ScheduledTask -TaskName "Screenshot" -Action $action -Trigger $trigger -User "SYSTEM"

Screenshot script uses System.Drawing.Graphics.CopyFromScreen() for screen capture.

Final Attack Chain

Il2CppDumper → dump.cs (metadata)
    ↓
Analyze m.Update() → found jge (opcode 7D) for counter check
    ↓
P.exe: VirtualProtectEx + WriteProcessMemory → patch 7D → EB
    ↓
Scheduled Task → screenshot of interactive session
    ↓
HTB{REDACTED}