How we hack; a list of anti-cheats and how we bypassed them

[PatheticMustan]

Our original aim with the prodigy hacking group was to improve the abysmal security on Prodigy. Well, we succeeded! Prodigy has tons of annoying anti-cheat features!

Here's a history of how hacking has evolved, and what it is today.

We also have a markdown file explaining our history.

• PIXI Ages: 9/21/19 - 3/25/20
  • This was when the repository was started. A global variable, PIXI, included the player object and stuff. Modifying gold was as easy as PIXI.game.prodigy.player.data.gold = 9e9.
• Phaser Day: 3/25/20 - 3/26/20
• Login.gameObj Day: 3/26/20 - 3/27/20
• CanvasPool Days: 3/27/20 - 3/30/20
  • The PIXI variable was removed. From here on out, we just found alternative ways to get to the player object.
• Cheat Dashboard Day: 3/30/20 - 3/30/20
  • We tried deploying a cheat dashboard where you input your credentials, and selected which hacks you wanted. Ironically this wasn't very secure.
• Dark Ages: 4/01/20 - 4/07/20
  • They properly patched hacks, which broke hacks for an entire week.
• EnableDebug Breakthrough: 4/07/20 - 4/09/20
  • In the Prodigy status endpoint, it mentions a debug password. Apparently it would expose the API if we gave the right password. They removed the debug function shortly after, but the debug password is still there.
• Prodigy Console Prevention: 4/10/20
  • In the public game min, Prodigy added a small script that would redirect the player to 404 if they opened devtools.
  • To accomplish this, they created an Image with a getter, which was logged to console. If console was opened, the getter would be triggered, and we'd be 404'd. We overrode this by just removing console.log, hehe.
• Debugger Scope Ages: 4/12/20 - 4/15/20
  • For a while, Prodigy removed all the obvious global variables. We got around this with Google Chrome's [[scopes]], "Set to global variable", and accessing it from there. That was shortly removed :P
• Redirector Ages: 4/15/20 - CURRENT
  • We decided to directly modify the game files to bypass the anti-cheats and inject our own hacks. To accomplish this, we used Redirector, to redirect requests for the prodigy gamefile to our own modified gamefiles.
  • Will basically carried us.
• Content Security Patch: 6/10/20
  • They added CSP, so we had to add a plugin that disabled CSP.
• Script based hacks return: 8/25/20
  • Given the user tokens, Arc was able to make serverside hacks, like adding to the inventory. This meant you didn't need to use Redirector. Unfortunately, these depend really hard on Prodigy's APIs not changing.
• _.instance.prodigy.player Patch: 9/17/20 - CURRENT
  • Prodigy would 404 when it detected the hack variable in the global scope, and would overwrite clearInterval to protect it. Honestly, that was super lazy. We got around this by changing hack to _, which is used by lodash.
• Chrome Extension Releases: 10/21/20 - 11/11/20
  • Rus joined, and made a chrome extension. Super handy dandy, now we only need to install one extension, and get more control over everything! He released it to the Chrome Web Store, but Prodigy DMCA'd it on 11/11/20.
• Prodigy adds SHA256 Integrity Checks: 11/13/20 - CURRENT
  • Prodigy added integrity to their scripts so any modified scripts would be rejected.
• SHA256 Sumchecks bypassed: 11/13/20 - 11/19/20
  • We got around the integrity checks by using the extension only, and just overwriting the integrities. There were some more problems with replacing the scripts, so we just appended it to the body, lol.

So let's recap. Currently the things we're doing to bypass anti-cheats:

• Chrome Extension
  • Lets us redirect Prodigy game scripts to our very own modified scripts.
  • Also adds in anti-csp.
• Redirector
  • Takes the current game min, applies our edits, and injects Will's Cheat Menu.
• Will's Cheat Menu
  • The little arrow in the top left corner? Yeah, that's WCM. It just gives a UI for common hacks.

[userofprodigy]

hello, i just joined github , i am a user of the hacking system, but i have the outdated one and i have tried more than once to update it and it won't work. please help me, thanks

[ghost]

please wait until the new version is published to the chrome web store