Hacker goes Speedrunning: Beating a 25 hour game in under 2 minutes

Hacker goes Speedrunning: Beating a 25 hour game in under 2 minutes

Speakers: Gynvael Coldwind, Managing Director, Dragon Sector

Conference: Area41

YouTube: https://www.youtube.com/watch?v=OkL6RKLznHk

Overview

In a captivating talk at Area41, Gynvael Coldwind, Managing Director at Dragon Sector and a renowned figure in the cybersecurity and CTF community, took the audience on an unexpected journey into the world of speedrunning. Far from a typical gaming presentation, Coldwind masterfully demonstrated how the principles of vulnerability research, reverse engineering, and exploit development translate directly into beating a classic 1994 Turbo Pascal RPG, Aefhra Chronicles, in an astonishing 1 minute and 45 seconds – a game normally requiring 15 to 30 hours to complete. This presentation was explicitly framed not as a source of corporate security wisdom, but as an exploration of hacking as a hobby, showcasing the intellectual thrill of dissecting complex systems and bending them to one's will.

Coldwind's unique blend of deep technical expertise and playful curiosity made this talk a standout. He peeled back the layers of a vintage game, revealing how its 16-bit architecture, Turbo Pascal overlays, and even undocumented developer features could be leveraged for unprecedented sequence breaks and time savings. The talk resonated deeply with the hacker ethos, illustrating that the fundamental skills applied to securing or compromising modern software are equally potent when applied to a nostalgic digital playground.

The core message underscored that "software is software," regardless of its purpose. Whether it's a critical enterprise application or a beloved retro video game, the underlying vulnerabilities – from memory corruption to business logic flaws – present opportunities for those with the knowledge and persistence to find them. Coldwind's demonstration was not just a feat of gaming prowess, but a vivid, live-action case study in practical reverse engineering and creative problem-solving, reaffirming the enduring appeal of understanding and exploiting digital systems.

Background

▶ Watch: Introduction: Speedrunning a 25-hour game in 2 minutes (0:00)

Speedrunning, at its heart, is the art of completing a video game as fast as possible. As Gynvael Coldwind explains, if you're not exploiting glitches, you're likely not doing it correctly. This philosophy draws a direct parallel to the world of cybersecurity, where vulnerability researchers and penetration testers actively seek out bugs, logic flaws, and unintended behaviors to achieve their objectives. The only difference, Coldwind quips, is that speedrunning is often more fun to watch, with exploits performed live on screen.

The game at the center of this exploit-laden journey is Aefhra Chronicles, a monumental role-playing game from 1994. Developed primarily by a single person, Michael Lawrence, over two years of weekends using Turbo Pascal, it was an ambitious project for its time. Originally distributed as shareware, players received only the first act, requiring a $25 payment to unlock the full experience. The game is expansive, featuring an open world with 6x6 screens, 16 cities, 22 multi-level dungeons, 241 items, 130 monster types, and 140 spells. A normal playthrough is a significant commitment, typically ranging from 15 to 30 hours.

The conventional gameplay loop of Aefhra Chronicles involves a lengthy, multi-act questline. Players begin in Stormhaven, tasked with finding a kidnapped baby prince and a Book of Prophecies. This leads to a convoluted series of objectives: finding a painting for an NPC, retrieving the book from a dragon (after clearing pest-infested caves), seeking translators who then direct them to an oracle, who in turn demands four Gems of Power before finally translating the book. The translation reveals the need to defeat a big demon boss, which requires significant leveling and side quests to overcome. The ultimate goal is to rescue the baby prince from the queen mother, who orchestrated the kidnapping for a demonic resurrection. This intricate and time-consuming quest graph is precisely what Coldwind aimed to dismantle through strategic exploitation.

Key Findings

▶ Watch: Live speedrun demo: Beating the game in under 2 minutes (11:00)

Coldwind's speedrunning endeavor was a masterclass in identifying and weaponizing various types of software vulnerabilities, ranging from subtle business logic flaws to severe memory corruption. His initial approach mirrored typical vulnerability research: how to acquire in-game money, a leveled-up party, and an optimized route, all by exploiting bugs.

One of the first critical discoveries revolved around quest flags. These 16-bit values dictate the state of every quest in the game. By understanding and manipulating these flags, Coldwind realized he could bypass entire questlines. For instance, the quest to find a painting could be skipped entirely because a shopkeeper, likely due to a typo in the item ID list, sold the painting. More broadly, he identified numerous "grayed out" quests in the game's internal graph that were not strictly necessary for completion, allowing for massive sequence breaks.

A cornerstone of the speedrun strategy was the Pass-Through Stone (PTS) spell. This high-level teleportation spell allows players to traverse dungeons and even map boundaries with ease. The catch: it requires a party of level 9 or higher. Coldwind discovered a business logic bug in how mercenary recruitment worked. The mercenary Allenas, who can cast PTS, typically refuses low-level parties. However, by recruiting two other NPCs, Tumar (level 10) and Khaled (level 7), and bringing them to Allenas, the game's logic incorrectly perceives the overall party as sufficiently high-level, allowing Allenas to join and grant access to the critical PTS spell from the very beginning.

Another significant finding, though not ultimately used in the final speedrun route, was an accidental item duplication glitch rooted in a use-after-free (UAF) vulnerability. When a character (e.g., a Cleric) transferred all their items to another party member (e.g., a Paladin), their inventory would visually appear empty. However, attempting to use an item with the now "empty" Cleric revealed that copies of previously held items, such as healing potions, were still resident in memory. This occurred because Turbo Pascal's 1-based indexing, combined with faulty logic checks for cursor position when an item list was truly empty, allowed access to freed memory or memory regions outside the intended list. While powerful for unlimited item uses, it often led to game crashes, making it unreliable for a consistent speedrun.

Perhaps the most impactful discovery, which became the lynchpin of the record-breaking run, was the "Ooh" glitch, also known as Overwrite with Game Zero (OWGO). This critical vulnerability was uncovered while Coldwind was helping a streamer, Bill Bull, whose save game had become corrupted. The issue stemmed from a design flaw: if a player selected "Start Game" instead of "Load Game" and then exited on an existing save slot, the game copied initial template files from a save0 directory, overwriting map and metadata files. Crucially, the party.dat file, containing character data, remained untouched. The save0 template, however, contained quest flags initialized to a middle-of-the-game state, not a fresh start. This meant a player could effectively start a "new" game with a powerful, pre-configured party and, more importantly, with specific quest flags already set and critical inventory items (like the baby prince) already acquired. This effectively allowed Coldwind to skip the vast majority of the game's narrative from the outset.

Finally, an undocumented developer feature was found: holding F3 for an extended period increased a "delay divider" value. Old Turbo Pascal games often used busy loops for delays, benchmarking CPU speed at startup to calibrate sleep times. The F3 key allowed the developer to artificially inflate this divider, making all in-game delays happen significantly faster – a perfect, built-in speedrunning tool.

Technical Deep Dive

▶ Watch: Discovering a 'use after free' item duplication bug (19:30)

The technical depth of Coldwind's project extended far beyond typical gameplay analysis, venturing into the intricate world of 16-bit Turbo Pascal reverse engineering. The game, Aefhra Chronicles, presented a unique set of challenges due to its vintage architecture, relying on concepts like Turbo Pascal overlays for memory management and even EMS memory. Coldwind, a seasoned reverse engineer, approached this with tools like Ghidra and custom Python scripts.

His journey into the game's internals was fraught with the quirks of old compilers. He humorously noted that his reverse engineering scripts, which contained assert false for "should never happen" conditions, were constantly triggering. Even AI tools, when consulted about specific Turbo Pascal behaviors, would respond with variations of "you just stumbled upon one of the most obscure and frustrating quirks in the entire Turbo Pascal compilers." This highlighted the extreme technical challenges of working with such legacy codebases.

Through meticulous reverse engineering, Coldwind uncovered several fascinating, undocumented aspects of the game:

• Unused "Barbarian" Profession: Analysis of the game's strings revealed a placeholder for a "Barbarian" character class that was never implemented, indicating potential cut content.
• F1 Screenshot Mechanism: The F1 key, which brings up the game manual, was found to take a screenshot of the current game state and save it to a file named temp.dat in the PCX bitmap format. Upon exiting the manual, the game simply reloaded this screenshot to redraw the screen, a clever but clunky workaround for the lack of a direct screen redraw function.
• F3 Delay Divider: This undocumented feature was a goldmine for speedrunning. Coldwind's reverse engineering revealed that holding F3 directly manipulated an internal variable that controlled the duration of in-game delays. Rather than using modern timers, the game implemented delays via busy loops (e.g., counting to 1 million). The initial CPU benchmark at startup determined a multiplier for these loops. The F3 key allowed an increase in this "delay divider," effectively making these busy loops complete much faster, accelerating all in-game animations and transitions.
• Predictable Randomness: The game utilized a typical Linear Congruential Generator (LCG) for its randomness. While Coldwind explored predicting chest contents or random monster encounters, this wasn't ultimately necessary for the final speedrun route but offered insights into the game's determinism.

The most critical aspect of the deep dive was understanding the save game format to exploit the "Ooh" glitch. While parts of the save game format were documented by community members like Pixel FCK, Coldwind needed a complete understanding. His method involved filling a savegame.dat file with sequential byte patterns (00, 01, 02, etc.), loading it into memory, and then inspecting the memory layout to map disk offsets to in-memory structures, noting that the structures differed. He then used a debugger to trace which functions accessed specific memory regions. For example, by observing a function that displayed the text "I'm glad to see you. Have you found my painting yet?", he could pinpoint the exact memory location and flag value (e.g., QuestPaintingGuy = 1) associated with that quest state. This painstaking process, performed over many late-night hours, allowed him to fully document all quest flags and their possible values. The culmination was a Python script that could programmatically patch save game files, ensuring precise manipulation of the game state for the "Ooh" speedrun.

Demo / Proof of Concept

▶ Watch: The 'Ooh' glitch: Leveraging save game corruption (25:00)

The live demonstration of the speedrun was the highlight of the talk, showcasing the practical application of all the technical discoveries. Coldwind executed a flawless run, beating the 25-hour game in a mere 1 minute and 45 seconds.

The sequence of events was meticulously orchestrated:

1. Initial Setup: Coldwind started the game, immediately closed it, and restarted. This seemingly innocuous action was crucial for triggering the "Ooh" glitch (Overwrite with Game Zero), which loads the pre-configured save0 template over an existing save slot while retaining the character party.
2. Activating Speed Boost: Upon restarting, Coldwind held down the F3 key for an extended period. This activated the undocumented developer feature, increasing the internal delay divider and accelerating all in-game animations and transitions, significantly shortening travel and action times.
3. Loading the Exploited Save: He then loaded the specific save slot that had been "corrupted" by the "Ooh" glitch. This save file contained a party that was half-dead (a consequence of the save0 template, but irrelevant to the route) and, critically, already possessed the baby prince in its inventory, along with all necessary keys and a high-level mercenary (Allenas) capable of casting Pass-Through Stone (PTS).
4. Immediate Sequence Break: From the starting point, Coldwind immediately navigated towards the demon-infested area, which is normally locked until Act 3 of the game. Thanks to the "Ooh" glitch, the party already had the required keys in their inventory, allowing instant access.
5. Dungeon Bypass with PTS: Inside the dungeons, the Pass-Through Stone (PTS) spell was repeatedly cast. This spell allowed the party to teleport directly through walls, obstacles, and even multiple levels of the dungeon, bypassing all combat and exploration. Despite encounters with demons, Coldwind was able to run away from battles, which is normally impossible in certain boss fights, but was possible here due to the party's high stats or a later discovered specific spell.
6. Reaching the Final Boss: After quickly traversing multiple dungeons, Coldwind entered a village in the middle of a lake, an area typically restricted. Using PTS again, he bypassed another blocked doorway, teleporting directly into the final boss room.
7. The Ultimate Business Logic Bypass: In the boss room, the Queen attacked. This is one of two battles in the entire game from which escape is normally impossible. However, Coldwind's party included a Bard character who could cast Soothing the Savage Beastie. This spell, due to a business logic bug, allowed the party to run away from any fight, including the otherwise inescapable final boss.
8. Instant Victory: Immediately after escaping the final boss battle, Coldwind cast the Teleport spell. This spell, whose target location was set by an earlier Beacon spell (or defaulted to the starting city if no beacon was set), instantly transported the party back to the main city, right next to the castle. With the baby prince already in the inventory (thanks to the "Ooh" glitch) and the quest flag for initiating the queen fight triggered (by running from it), the king was delighted, and the game registered as complete.

The entire process, from loading the game to the final victory screen, unfolded in under two minutes, a stark contrast to the intended 25-hour experience.

Defensive Implications

▶ Watch: Final exploit: Bypassing the unskippable queen battle (35:45)

While Coldwind's talk focused on speedrunning a vintage RPG, the underlying principles and vulnerabilities he exploited have direct and significant defensive implications for modern software development. The "hacking as a hobby" approach serves as a powerful analogy for real-world security challenges.

1. Input Validation and State Management: The use-after-free (UAF) bug leading to item duplication stemmed from a lack of robust input validation and improper state management, specifically concerning empty item lists and cursor indexing. In enterprise applications, similar flaws can lead to memory corruption, denial-of-service, or even arbitrary code execution. Defenders must ensure rigorous validation of all inputs and maintain consistent, secure state transitions.
2. Business Logic Flaws: The most potent exploits in Coldwind's speedrun were business logic bugs:

• The shop selling the quest-critical painting (due to a typo in an item ID).
• The mercenary Allenas being recruited based on an aggregated party level rather than individual character levels or specific quest progression.
• The Soothing the Savage Beastie spell bypassing an "inescapable" boss fight due to an oversight in the battle's escape logic.
• The king accepting the baby prince only after the queen fight was initiated, not necessarily won, and with the baby already in inventory.

These types of flaws are notoriously difficult to detect with automated tools and often require a deep understanding of the application's intended functionality. They highlight the need for thorough manual review, threat modeling, and extensive integration testing to identify scenarios where business rules can be subverted.

1. Save Game Integrity and Serialization Vulnerabilities: The "Ooh" glitch is a prime example of a serialization vulnerability and weak save game integrity. By overwriting only parts of a save file with a default template (save0) while leaving other critical parts (party.dat) intact, the game entered an unintended, powerful state. In real-world applications, similar issues arise when data is loaded or deserialized without proper validation, leading to privilege escalation, data manipulation, or bypassing security controls. Secure deserialization and robust integrity checks for persistent data are paramount.
2. Undocumented Features and "Backdoors": The F3 delay divider was an undocumented developer feature. While beneficial for testing, such hidden functionalities can sometimes become unintentional backdoors if discovered by malicious actors, allowing them to bypass intended operational limits or security measures. Code audits should scrutinize all features, documented or otherwise, for potential abuse.
3. The Power of Reverse Engineering: Coldwind's success was predicated on deep reverse engineering – understanding the game's 16-bit Turbo Pascal code, memory layouts, and internal logic. This underscores the importance for defenders to possess reverse engineering skills, not just to analyze malware, but also to understand how legitimate software works, identify potential attack vectors, and verify the effectiveness of security controls.

Ultimately, the talk is a compelling reminder that the principles of secure software development – robust input validation, comprehensive state management, careful business logic implementation, secure serialization, and thorough code review – are timeless and universal, applying equally to a 1994 RPG and a modern, mission-critical system.

Key Takeaways

• Speedrunning as Vulnerability Research: The pursuit of beating a game as fast as possible through glitches is fundamentally equivalent to vulnerability research and exploit development in cybersecurity, demonstrating the universality of hacking principles.
• Legacy Code is a Goldmine: Old games written in languages like Turbo Pascal, with their unique memory management (e.g., overlays, EMS memory) and compiler quirks, offer fertile ground for discovering obscure and powerful bugs like use-after-free or undocumented developer features.
• Business Logic Flaws are Critical: Many of the most impactful sequence breaks and bypasses in Aefhra Chronicles stemmed from business logic errors, such as incorrect item IDs, flawed NPC recruitment conditions, or spells that bypass "inescapable" battles. These are often the hardest vulnerabilities to detect.
• State Corruption is Potent: The "Ooh" glitch, which leverages partial save game overwrites to inject a powerful, mid-game state into a new game, highlights the danger of insecure serialization and insufficient integrity checks for persistent data.
• Deep System Understanding is Key: Through meticulous reverse engineering using tools like Ghidra and custom Python scripts, Coldwind was able to uncover hidden mechanics, debug complex interactions, and precisely manipulate game states to achieve his objectives, emphasizing the value of deep system knowledge.
• Hacking is a Creative Pursuit: The talk celebrated hacking as a hobby, showcasing the intellectual challenge and creative problem-solving involved in understanding, deconstructing, and ultimately bending software systems to one's will, regardless of whether the target is a game or a production application.

About the Speaker(s)

Gynvael Coldwind is a prominent figure in the cybersecurity community, known for his deep technical expertise and engaging presentations. By day, he serves as a Managing Director in a cybersecurity consulting company, applying his skills in professional settings. Outside of his corporate role, Gynvael is an active YouTuber, a dedicated player of Capture The Flag (CTF) competitions with his renowned team Dragon Sector, and an author. His passion for "hacking as a hobby" shines through his work, demonstrating a profound curiosity for understanding how systems operate at their most fundamental levels.