Bughunting - Revision history

Enhasa: maybe i should hit preview this time

2009-08-31T03:42:20Z

maybe i should hit preview this time

Enhasa: very minor wording

2009-08-31T03:41:00Z

very minor wording

Enhasa: minor changes for conciseness, clarity, removing weasel words

2009-08-31T03:39:49Z

minor changes for conciseness, clarity, removing weasel words

Lag.Com: /* Memory Corruption */ slight grammar fixes

2009-08-29T00:27:18Z

‎Memory Corruption: slight grammar fixes

Greenalink: /* Pausing */

2009-08-28T17:13:40Z

‎Pausing

Moozooh: Added a link to Generic techiques.

2009-08-28T13:15:25Z

Added a link to Generic techiques.

Lag.Com: new idea, let me know if it makes sense / fix mistakes

2009-08-28T11:10:04Z

new idea, let me know if it makes sense / fix mistakes

New page

No program is perfect. By extension, no game is bug-free. The techniques here will help you find them, if none are already known. Hopefully the bugs you find will be useful, and you will then add them to this wiki on the appropriate game page!

==All Games==
Games share a lot of code, no matter the genre. Inventory management, quest/plot completion and conversation trees are a common factor, especially among today's "Action RPGs". As with any code, they are breakable.
===Pausing===
Pause may seem like a simple thing to implement, but in many cases it is done poorly. This mainly applies to older games. Most commonly it confuses timed events, such as reloading or hitstun. You can use this trick on Mega Man 2 to repeatedly hit bosses with the Lightning weapon, by pausing each time it hits, and waiting a short duration for the boss's hitstun to reset. It also changes Mega Man's vertical velocity to zero on some games, allowing you to make extra-long jumps.
===Hidden Worlds===
On games where the world is made up of discrete rooms, there must be some mechanic whereby the game decides which room to put you in next, usually when you reach a boundary. If this mechanic were confused, perhaps by another event occuring at the same instant the boundary is triggered, then it may send you to the wrong place. An alternate way of triggering this is by triggering a boundary while facing the wrong direction. This often leads to completely un-navigable areas or copies of other rooms without the contents. The Pokemon series are known for their 'Glitch Cities' which can be entered by exiting the Safari Zone in an unintended fashion.
===Scrolling===
When games scroll (in any direction), they have to decide what to put on the screen next. As with the Hidden World bugs, confusing this decision process can have strange results. A fairly well-known example is with Metroid II; by hitting Select at appropriate times, entire lines of wall can be skipped out when the engine scrolls them on screen. This also allows you to enter glitchy areas and skip vast sections of the map. The [[Pokémon_Diamond/Pearl/Platinum#Glitches|tweaking trick]] discovered on 4th-generation Pokemon games has much the same effect.

==Action Games==
You shoot stuff, you jump around, you press buttons. Sometimes you fight a boss. All action games share a great amount of gameplay, and as such, a lot of bugs too.
===Physics===
Let's say, the game you are playing runs at 60Hz. In most modern-ish PC games you can change this as long as your monitor supports it. While this frequency only tells you how many frames the graphics engine outputs per second, it also tends to be how many 'game ticks' the engine runs per second. This knowledge might not seem particularly useful, but when combined with a little understanding about how games implement physics, it can blow the game wide open.

Almost all games that have physics at all will go with some kind of simplified Newtonian method. What this means is that your character (and possibly other actors in the game world) will have at least position and velocity. Most of these engines boil down to running "NewPosition = OldPosition + Velocity" every game tick, which has some interesting consequences. If you are going so fast that on consecutive game ticks you are either side of a wall, the game may not register a collision. This is used on Half-Life to go through a barrier, and on countless other games to occasionally ignore corners.

===Bunnyhopping===
How do you reach such ludicrous speeds in the first place? A common technique (at least in First-Person Shooters) is to repeatedly jump. This counter-intuitive technique works, because the engine almost always runs something like "If Player on Ground: NewVelocity = OldVelocity - Friction" every tick. The more time you spend off the ground, the less friction will be applied to you. So far, so good. However, in order to actually gain speed rather than keep the same speed, you will need to do something else. The 'something else' depends entirely on the game's engine: on Quake, you need to continually move the mouse from side-to-side whilst using the strafe keys; Half-Life 2 mandates that you use alternate strafe keys as you land. Experiment.

As an aside, some games actually implement bunnyhopping consciously; Painkiller and Quake 3 let you off with just jumping while holding forward.

==RPGs==
Bughunting on RPGs is usually less 'playing around' and more 'pushing the envelope'. In general you should try and find the game mechanic that has the most effects on combat, and bend it until it breaks.
===Integer Underflow===
Games which need to store values do so based on how big that value will probably get. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game checks that the value does not 'go below the minimum', you can often cause the value to wrap around to its maximum. This has obvious consequences if the value in question is your character's Strength or Level. On Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. On Suikoden II you can use the Kindness Rune's attack-increasing ability to add 255 by making your Kindness value lower than 0. The applications are endless, and often, very profound.

===Memory Corruption===
A massive topic, and one that can break the game more often than not. As with Integer Underflow, it occurs when the programmer was not careful enough in implementing something. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch and it misses (because you cast Vanish on it beforehand). This causes the program to try to read an area of memory which does not contain an enemy's data, with often catastrophic results.

@@ Line 27: / Line 27: @@
 ==RPGs==
 ===Integer Underflow===
-Games which need to store values do so based on how large that value might possibly need to become. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game ensures that the value cannot go below the minimum, you can often cause the value to wrap around to its maximum. This can be very useful if the value in question is your character's Strength or Level. With Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. With Suikoden II you can use the Kindness Rune to add 255 Attack by making your Kindness value lower than 0.
+Games which need to store values do so based on how large that value might need to become. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game ensures that the value cannot go below the minimum, you can often cause the value to wrap around to its maximum. This can be very useful if the value in question is your character's Strength or Level. With Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. With Suikoden II you can use the Kindness Rune to add 255 Attack by making your Kindness value lower than 0.
 ===Memory Corruption===
 Memory corruption can be used to completely break open a game. This volatile type of bug can have profound effects on the stability and state of the game. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch after Vanish, causing it to miss the target. The program will then attempt to read an area of memory that does not contain any enemy data, with potentially exploitable results.

@@ Line 27: / Line 27: @@
 ==RPGs==
 ===Integer Underflow===
-Games which need to store values do so based on how large that value might possibly get. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game ensures that the value cannot go below the minimum, you can often cause the value to wrap around to its maximum. This can be very useful if the value in question is your character's Strength or Level. With Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. With Suikoden II you can use the Kindness Rune to add 255 Attack by making your Kindness value lower than 0.
+Games which need to store values do so based on how large that value might possibly need to become. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game ensures that the value cannot go below the minimum, you can often cause the value to wrap around to its maximum. This can be very useful if the value in question is your character's Strength or Level. With Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. With Suikoden II you can use the Kindness Rune to add 255 Attack by making your Kindness value lower than 0.
 ===Memory Corruption===
 Memory corruption can be used to completely break open a game. This volatile type of bug can have profound effects on the stability and state of the game. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch after Vanish, causing it to miss the target. The program will then attempt to read an area of memory that does not contain any enemy data, with potentially exploitable results.

← Older revision		Revision as of 00:27, 29 August 2009
Line 33:		Line 33:

	===Memory Corruption===		===Memory Corruption===
−	A massive topic, and one that can break the game more often than not. As with Integer Underflow, it occurs when the programmer was not careful enough in implementing something. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch and it misses (because you cast Vanish on it beforehand). This causes the program to try to read an area of memory which does not contain an enemy's data, with often catastrophic results.	+	A massive topic, and one that can break the game more often than not. As with Integer Underflow, it occurs when the programmer was not careful enough in implementing something. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch and it misses (because you cast Vanish on the target beforehand.) This causes the program to try to read an area of memory which does not contain an enemy's data, with often catastrophic results.

← Older revision		Revision as of 13:15, 28 August 2009
Line 1:		Line 1:
	No program is perfect. By extension, no game is bug-free. The techniques here will help you find them, if none are already known. Hopefully the bugs you find will be useful, and you will then add them to this wiki on the appropriate game page!		No program is perfect. By extension, no game is bug-free. The techniques here will help you find them, if none are already known. Hopefully the bugs you find will be useful, and you will then add them to this wiki on the appropriate game page!
		+
		+	See also: [[Generic techniques]].

	==All Games==		==All Games==

@@ Line 1: / Line 1: @@
-No program is perfect. By extension, no game is bug-free. The techniques here will help you find them, if none are already known. Hopefully the bugs you find will be useful, and you will then add them to this wiki on the appropriate game page!
+No program is perfect. By extension, no game is bug-free. The techniques here will help you find bugs, if none are already known. Hopefully the bugs you find will be useful, and you will then add them to this wiki on the appropriate game page!
 See also: [[Generic techniques]].
 ==All Games==
 ===Pausing===
-Pause may seem like a simple thing to implement, but in many cases it is done poorly. This mainly applies to older games. Most commonly it confuses timed events, such as reloading or hitstun. You can use this trick on Mega Man 1 to repeatedly hit bosses with the Lightning weapon, by pausing each time it hits, and waiting a short duration for the boss's hitstun to reset. It also changes Mega Man's vertical velocity to zero on some games, allowing you to make extra-long jumps.
+In many cases, especially with older games, you can exploit quirks with how a game handles pausing. Most commonly they confuse timed events such as reloading or hitstun. You can use this trick with Mega Man 1 to repeatedly hit bosses with the Lightning weapon, by pausing each time it hits and waiting a short duration for the boss's hitstun to reset before un-pausing. Pausing could also reset the character's vertical velocity to zero, allowing you to make extra-long jumps.
 ===Hidden Worlds===
-On games where the world is made up of discrete rooms, there must be some mechanic whereby the game decides which room to put you in next, usually when you reach a boundary. If this mechanic were confused, perhaps by another event occuring at the same instant the boundary is triggered, then it may send you to the wrong place. An alternate way of triggering this is by triggering a boundary while facing the wrong direction. This often leads to completely un-navigable areas or copies of other rooms without the contents. The Pokemon series are known for their 'Glitch Cities' which can be entered by exiting the Safari Zone in an unintended fashion.
+Where the world is made up of discrete rooms, there must be some mechanic whereby the game decides which room to place you in next, usually occurring when you reach a boundary. If this mechanic were confused, perhaps by another event happening at the same instant the boundary is triggered, then it may send you to the wrong place. Alternately, you might try facing the wrong direction when triggering a boundary. This can lead to completely un-navigable areas or empty copies of other rooms. The Pokemon series' 'Glitch Cities' can be entered by exiting the Safari Zone in an unintended fashion.
 ===Scrolling===
-When games scroll (in any direction), they have to decide what to put on the screen next. As with the Hidden World bugs, confusing this decision process can have strange results. A fairly well-known example is with Metroid II; by hitting Select at appropriate times, entire lines of wall can be skipped out when the engine scrolls them on screen. This also allows you to enter glitchy areas and skip vast sections of the map. The [[Pokémon_Diamond/Pearl/Platinum#Glitches|tweaking trick]] discovered on 4th-generation Pokemon games has much the same effect.
+When games scroll in any direction, they must decide what to put on the screen next. As with the Hidden Worlds bugs, confusing this decision process can have strange results. By hitting Select at appropriate times during Metroid II, entire lines of wall can be skipped out when the engine scrolls them on screen. This allows you to enter glitchy areas and skip vast sections of the map. The 4th-generation Pokemon games have a [[Pokémon_Diamond/Pearl/Platinum#Glitches|tweaking trick]] with much the same effect.
 ==Action Games==
 ===Physics===
-Let's say, the game you are playing runs at 60Hz. In most modern-ish PC games you can change this as long as your monitor supports it. While this frequency only tells you how many frames the graphics engine outputs per second, it also tends to be how many 'game ticks' the engine runs per second. This knowledge might not seem particularly useful, but when combined with a little understanding about how games implement physics, it can blow the game wide open.
+Let's say the game you are playing runs at 60Hz. In most modern-ish PC games you can change this as long as your monitor supports it. While this frequency only tells you how many frames the graphics engine outputs per second, it also tends to be how many 'game ticks' the engine runs per second. When combined with a little understanding about how games implement physics, it can blow the game wide open.
-Almost all games that have physics at all will go with some kind of simplified Newtonian method. What this means is that your character (and possibly other actors in the game world) will have at least position and velocity. Most of these engines boil down to running "NewPosition = OldPosition + Velocity" every game tick, which has some interesting consequences. If you are going so fast that on consecutive game ticks you are either side of a wall, the game may not register a collision. This is used on Half-Life to go through a barrier, and on countless other games to occasionally ignore corners.
+Almost all games with physics will go with some kind of simplified Newtonian method. What this means is that your character (and possibly other actors in the game world) will have at least position and velocity. Most of these engines boil down to running "NewPosition = OldPosition + Velocity" every game tick, which has some interesting consequences. If you are going so fast that on consecutive game ticks you are either side of a wall, the game may not register a collision. This is used with Half-Life to go through a barrier and with countless other games to occasionally ignore corners.
 ===Bunnyhopping===
-How do you reach such ludicrous speeds in the first place? A common technique (at least in First-Person Shooters) is to repeatedly jump. This counter-intuitive technique works, because the engine almost always runs something like "If Player on Ground: NewVelocity = OldVelocity - Friction" every tick. The more time you spend off the ground, the less friction will be applied to you. So far, so good. However, in order to actually gain speed rather than keep the same speed, you will need to do something else. The 'something else' depends entirely on the game's engine: on Quake, you need to continually move the mouse from side-to-side whilst using the strafe keys; Half-Life 2 mandates that you use alternate strafe keys as you land. Experiment.
+How do you reach such ludicrous speeds in the first place? A common technique (at least in First-Person Shooters) is to jump repeatedly. This technique works because many engines calculate "If Player on Ground: NewVelocity = OldVelocity - Friction" every tick. The more time you spend off the ground, the less friction will be applied to you. However, in order to actually gain speed rather than maintain it, you will need to do something else. The 'something else' depends entirely on the game's engine. Quake runners continually move the mouse from side-to-side whilst using the strafe keys; Half-Life 2 mandates that you use alternate strafe keys as you land. Experiment.
-As an aside, some games actually implement bunnyhopping consciously; Painkiller and Quake 3 let you off with just jumping while holding forward.
+Some games consciously implement bunnyhopping: Painkiller and Quake 3 let you just jumping while holding forward.
 ==RPGs==
 ===Integer Underflow===
-Games which need to store values do so based on how big that value will probably get. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game checks that the value does not 'go below the minimum', you can often cause the value to wrap around to its maximum. This has obvious consequences if the value in question is your character's Strength or Level. On Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. On Suikoden II you can use the Kindness Rune's attack-increasing ability to add 255 by making your Kindness value lower than 0. The applications are endless, and often, very profound.
+Games which need to store values do so based on how large that value might possibly get. A standard way of doing this on old games is by using one byte, which gives an unsigned range of 0..255, or a signed range of -128..127. Unless the game ensures that the value cannot go below the minimum, you can often cause the value to wrap around to its maximum. This can be very useful if the value in question is your character's Strength or Level. With Baldur's Gate you can use an [[Infinity_Engine#Inventory_Stack_Underflow|item-swapping trick]] to wrap an item's quantity value around to 65535, the two byte unsigned maximum. With Suikoden II you can use the Kindness Rune to add 255 Attack by making your Kindness value lower than 0.
 ===Memory Corruption===
-A massive topic, and one that can break the game more often than not. As with Integer Underflow, it occurs when the programmer was not careful enough in implementing something. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch and it misses (because you cast Vanish on the target beforehand.) This causes the program to try to read an area of memory which does not contain an enemy's data, with often catastrophic results.
+Memory corruption can be used to completely break open a game. This volatile type of bug can have profound effects on the stability and state of the game. A well-known corruption bug occurs on Final Fantasy VI when Relm uses Sketch after Vanish, causing it to miss the target. The program will then attempt to read an area of memory that does not contain any enemy data, with potentially exploitable results.