Monday, April 13, 2020

ASIS CTF Quals 2015 - Sawthis Writeup - Srand Remote Prediction


The remote service ask for a name, if you send more than 64 bytes, a memory leak happens.
The buffer next to the name's is the first random value used to init the srand()


If we get this value, and set our local srand([leaked] ^ [luckyNumber]) we will be able to predict the following randoms and win the game, but we have to see few details more ;)

The function used to read the input until the byte \n appears, but also up to 64 bytes, if we trigger this second condition there is not 0x00 and the print shows the random buffer :)

The nickname buffer:



The seed buffer:



So here it is clear, but let's see that the random values are computed with several gpu instructions which are decompiled incorrectly:







We tried to predict the random and aply the gpu divisions without luck :(



There was a missing detail in this predcitor, but there are always other creative ways to do the things.
We use the local software as a predictor, we inject the leaked seed on the local binary of the remote server and got a perfect syncronization, predicting the remote random values:




The process is a bit ugly becouse we combined automated process of leak exctraction and socket interactive mode, with the manual gdb macro.




The macro:



















More articles

How tO Secure Yourself From Evil Twin Attack

How To Secure Yourself From Evil Twin Attack ?
Hello, in this article you are going to learn how to secure yourself from getting hacked using evil twin attack.

1) Do not connect to any public networks, anyone can sniff your data while you are on a public network.Evil Twin attack will be performed as a public network, so wherever possible restrict connecting to any open or public networks mainly if it wifi name is same as your wifi name

2) When your internet connection suddenly stops working, you might be under DOS attack using evil twin attack, just restart the router and the hacker need to restart the attack and as it takes some time.  Maybe they leave it or continue some other time 

3) Running a VPN to ensure that any browsing and transmitted data is done through an encrypted tunnel that cannot be easily snooped. 

4) Do not always rely on the name of the network, make sure it is a legitimate and trusted network or not. 


Thank You for Reading, Hope It's Useful

@£V£RYTHING NT

Related news


  1. Hack Tools For Games
  2. Hacking Tools For Windows Free Download
  3. Hacking Tools Free Download
  4. Hack Tools For Games
  5. Hacker Tools Windows
  6. Hacker Tools Software
  7. Hacker Tools 2020
  8. Kik Hack Tools
  9. Hacker Tools
  10. Pentest Tools Subdomain
  11. Hacking Tools For Games
  12. Physical Pentest Tools
  13. Bluetooth Hacking Tools Kali
  14. Pentest Automation Tools
  15. Top Pentest Tools
  16. Hacking Tools Free Download
  17. Hacker Tools Mac
  18. Hack Tools For Games
  19. Hacking Tools Mac

Insecurities Of WhatsApp's, Signal's, And Threema's Group Chats

Recently, the theoretical and practical analysis of secure instant messenger protocols received much attention, but the focus of prior evaluations mostly lay in one-to-one communication. In this blog post we want to presents the results of our work that focuses on group chat protocols of three major instant messenger applications; namely Signal, WhatsApp, and Threema.

In this blog post, we aim to focus on the practical impact and the found weaknesses identified by our analysis. The interested reader may also look into our paper for more details.


Our Aim and What We Were Looking For

End-to-end encryption protects the confidentiality of communication that is forwarded via central servers to the designated receivers. As a consequence, neither parties on the network route of the messages, nor the provider of the central server (e.g. the WhatsApp server) should be able to read any information out of the observation of the communication. In particular, no other user of the application should have access to the communication. Further it might be desirable to require that also the messages' integrity is end-to-end protected and that a sender is informed about the delivery state of sent messages.
Delivery state information in Signal (upper screenshot) and WhatsApp (lower screenshot)

In a two party scenario, this analysis is rather fixed to two components of the protocol: the key establishment between both parties and the communication channel protection using the established key (mostly consisting of an encryption algorithm and a scheme for providing integrity like MACs or signature schemes).

Regarded attackers


In a group setting, the same attackers apply (network, provider, other users). However the requirements for secure communication differ. It is further necessary that only group members can write to and read content from the group. Additionally, only administrators of the group are able to add new members.

In addition to these standard requirements, we also evaluated the protocols' security guarantees if the client's secrets were revealed (forward secrecy and future secrecy).

Our Approach

We analyzed the mentioned protocols by reading the source code and debugging the apps. We also used alternative open source implementations of Threema and WhatsApp as a help and we traced the network traffic. When using alternative implementations, we only took incoming traffic into account, which was generated by official applications. Thereby we extracted the protocol descriptions and evaluated them regarding the defined requirements.

Our Findings

In WhatsApp and Threema, the provider was able to manipulate the set of members. Threema only allowed the provider to rewind the set of members to a previous state. As a consequence previously removed members could have been added to the group again. The WhatsApp provider is able to arbitrarily manipulate the member set. Thereby further members and administrators can be added to the group. Since the authenticity of group manipulation is not protected, the WhatsApp provider can set the real group administrator as the source of manipulation even though this administrator was not active.

Since Signal's key exchange protocol provides future secrecy, we also evaluated the protocol's ability to recover into a secure group state after a member's state was compromised. The essential weakness here is that a sender only needs to know the static group ID to send a message to the group. If a group member receives a message with the correct group ID, no verification regarding the current member set takes place but the message is directly added to the group communication. Consequently it is sufficient to retrieve the group ID in order to send messages to the group. Since Signal treats content messages the same way as messages for the manipulation of the group set, an attacker who knows the group ID can add herself to the group and thereby read the subsequent group communication.

In addition to this, in all cases the delivery state of sent messages was not securely provided. Threema's group chats do not inform the sender about the delivery state while Signal and WhatsApp do not protect the delivery information on the end-to-end layer. Therefore the central provider can forge this information and drop messages without letting the communicating parties detect this.

Also the order of messages was manipulable for the providers of the applications such that the provider is able to deliver the messages in a different order than they were sent. Threema's weakness of rewinding a group state results from missing replay attack protection.

Impact of Weaknesses

Even though end-to-end encryption is implemented in all analyzed applications, the central providers can largely manipulate the communication in groups and partially also read it.
In all applications, the provider can undetectably drop and reorder messages during the delivery and thereby manipulate the view of the communication such that further attacks can be obfuscated.
The central servers of WhatsApp can be used to add arbitrary users to groups and thereby receive their communication.
To achieve the same result for Signal, it suffices to retrieve the group ID. An earlier member who left the group once still knows this ID since it is static. However, in contrast to WhatsApp, the origin of the manipulation is correctly displayed in the Signal application (which was not the fact when we started our analysis).

As a result, the end-to-end protection of WhatsApp is not sufficient to reach confidentiality in groups. For Signal no future secrecy is reached in groups and Threema was vulnerable to replay attacks which resulted in further weaknesses.

Responsible Disclosure

We disclosed our findings to the developers and received varying response. Threema updated their protocol in version 3.14 such that our attacks are not feasible anymore. Moxie Marlinspike responded that Signal is "working on an entirely new group mechanism that we should be deploying soon". WhatsApp did not hold out the prospect of fixing the described vulnerabilities (Update 01/18: According to Facebook's Security Head, the invite links make a fix more difficult [1]; we proposed a way to solve this issue [2]).

[1] https://twitter.com/alexstamos/status/951169036947107840
[2] https://web-in-security.blogspot.de/2018/01/group-instant-messaging-why-baming.htmlMore info
  1. Hacking Tools 2019
  2. Growth Hacker Tools
  3. Pentest Tools
  4. Hacking Tools Download
  5. Hack Tools
  6. Pentest Tools Website Vulnerability
  7. Hacking Tools Hardware
  8. Hacker Search Tools
  9. Hack Tool Apk No Root
  10. Hack App
  11. Easy Hack Tools
  12. Pentest Tools For Ubuntu
  13. Hacker Tools Hardware
  14. Beginner Hacker Tools
  15. Hacking Tools For Mac
  16. Hacking Tools Usb
  17. Pentest Reporting Tools
  18. Hacker Tools Apk
  19. Hacking Tools Online
  20. Hackrf Tools
  21. Pentest Recon Tools
  22. Hacks And Tools
  23. Pentest Tools
  24. What Are Hacking Tools
  25. Hacker Tools Free

Saturday, April 11, 2020

Experimenting With Outlines

I posted recently about how I often do one-week projects to learn and experiment. I don't have a strict one-week time limit. Sometimes I'll extend a project or come back to it after I've learned something new.

Ten weeks ago I had a one-week project in which I wanted to draw outlines on an isometric view of a dungeon game. I didn't want to outline each block, which could be implemented easily by editing the sprites. Instead, I wanted to outline the larger units. Here's a comparison:

Outlines around every sprite vs around walls

The second thing I wanted to do was to implement all of this in shaders. My first attempt was to draw a "surface id" to a texture, and then draw black outlines whenever the surface changes.

Draw a black line whenever the surface id changes

There were lots more details to implement, including outlines around billboard sprites, field of view, and lighting of wall blocks beyond the outline.

Dungeon map with outlines

I was pretty happy with that, even though it had some glitches, and I decided that project was finished.

A few weeks later I re-opened this project to explore a different approach. Instead of drawing the lines in a post-process step, I wanted to draw the lines as the sprites were being rendered. I posted some images on Twitter and got a suggestion from @Rezoner, who had made a version where some lines were white and some were black, depending on camera direction. I took that idea and ran with it, making white lines where the player could see the walls.

Dungeon map with lit and unlit outlines

I was pretty happy with this version too. I then merged the code together into one unified demo, with a toggle. Now I think I'm finished. But who knows? Maybe I'll re-open it later.

Take a look at the demo!

Things for me to keep in mind:

  • The one-week self-imposed deadline is just a rough guide. I don't have to follow it strictly.
  • Sharing unfinished work can lead to more ideas for improvement. I should share more things early.
  • Sometimes all I need is a proof of concept. I don't need to make everything work perfectly. If I actually use this in a real project, I can work out those details then.

Wednesday, April 8, 2020

Shadow Of The Comet – Won!

Written by limbeck

And so we arrive at the final showdown. The town itself is cleansed from the four families that were working to bring their evil plans to fruition, but all is not yet clear in the skies over Illsmouth. NARACKAMUS is still alive and the comet's passing is tonight. I have a lot of work still ahead of me and not enough time.

In the end of the previous post, Dr COBBLE gave me a message and a warning. The message was from Mr UNDERHOUSE, who was requesting my help. The warning was about Sgt. BRAGGS, who considered me responsible for last night's carnage (and with good reasons I will add). So, I need to go to the post office without running into BRAGGS.


Or Miss PICOTT, but that seems impossible.
Outside of Dr COBBLE's house is Miss PICOTT, who is seriously distressed about previous night's events and is also looking for her niece. She also tries to play matchmaker once again, but I avoid the commitment. Still, it won't hurt to pay a visit to her niece. I know where she lives after all.

It seems that BRAGGS is indeed after me. I have to go directly to the post office. If I go to the Mayor's barn for example, he follows me and arrests me. I cannot completely get rid of him myself. When I enter the post office I speak to a distressed Ms GUILDCHRIST at the counter and Sgt BRAGGS arrives. I take him upstairs to meet Mr UNDERHOUSE, who jumps to my rescue when I fumble for a response on my whereabouts. UNDERHOUSE even places suspicion on the bartender, ZEKE, who apparently ratted me out. BRAGGS leaves in anger to find him.

After that, UNDERHOUSE gives me a note speaking about a sacred bow, with an arrow and feather that I need to find. NATAWANGA, a local Native American can help me, but his location in the forest is unknown, but the feather and stick will find him. The note from him says that the bow is where the fire lives at the accursed family's youngest member. The accursed family is probably the HAMBLETONS and I think CURTIS is the youngest. In that case, I have to go to his place again. Before I leave, UNDERHOUSE hands me the feather and wishes me luck.


And reminds me of my biggest enemy

On my way to CURTIS's place, I note that JUGG's house is again open for visitors, so I go in. One of the butterflies is missing from the case. The label says it is the one mentioned in the book of rituals. I will need to find it. Naturally, it is not in the house.

I meet BISHOP outside CURTIS's house. He informs me that HAMBLETON is not inside and he is probably with GREENWOOD. I saw them together the previous day, but when I go to GREENWOOD's house, nobody is there. I come back to CURTIS's place.

The door to his house is locked, but there is a stick lying outside. I pick it up and I manage to remove the bar that was from the INSIDE. How on earth did CURTIS get out and then lock his door? Or lock his door and then get out? I will think about that later. For the time, I just use the pin from the locket to pick the lock and get inside.


I suppose this answers my previous questions

Yes, CURTIS is definitely dead. He was killed brutally and left hanging from his legs to dry. As I inspect the crime scene, I notice some moccasin tracks on the dusty floor and, in good detecting practice, I add my footprints as well. Maybe I should get going, but first I need the bow and arrow. As predicted, the bow is under the fireplace. The arrow was under a loose floorboard I had noticed in my first visit. Feeling really sorry for CURTIS, who really did not deserve any of this, I leave quietly to find NATAWANGA.

The note NATAWANGA gave to UNDERHOUSE said that the feather will fly to him. I don't know how or where to use it, so I start wondering around the forest trying to use the feather and even the arrow and the bow. I wasted some time here, also partly to my carelessness. I had understood that I needed the feather for the arrow, but I had misread the instructions. I just needed to use the feather. It was a bit frustrating anyway, as I had to be in a specific spot in the forest, without any other clue, where I could put the feather on a stump. Then, a crow came and picked it up and I turned into a white crow and flew to NATAWANGA's hut.


Clearly, turning into a white crow and back messed up my perceptive abilities

NATAWANGA asks me a number of questions to which I answer correctly. NARACKAMUS's tribe: Mic Macs, He Who Howls in the Night: Yog Sothoth, Year BOLESKINE observed the comet: 1834, Sign of the four families: Star, Name of undersea monstrosity: Dagon.

Once I pass the quiz, he gives me some advice on how to kill NARACKAMUS. He hides in "the eye that is set deep in the earth" and I need fire born of the earth to defeat him with my bow and arrow. My Journal agrees that these are indeed too many riddles. He also gave me a pot of red paint and his ring. I am turning into a well sought out bachelor. The ring has no stone, so I must find one.

The eye set deep in the earth seems a lot like the well. Let's see if the well is anything more than a changing screen.


Quite spacious

As expected, I can climb down in the well and arrive at an underground river. Now, if I may say, a well so close to the sea would not need to be so deep to reach water and the water would be brackish at best, but I'll play along.

When I reach the bottom, if I try to walk on the bank, I reach a place where the wild water carries me away and I drown. If, however, I throw the pail with paint that NATAWANGA gave me, the water calms and I can cross. In the next cavern is a set of cans. One is empty, but the others hold acid, tar and nitroglycerin. I assume that this is what "fire from earth" comes about. And I also think it will be a brute force puzzle, because all these are associated with fire, or at least a burning sensation. Acid can cause chemical burns, tar can burn if set on fire and nitroglycerin, well, it just needs a good shake!

I start with the empty can and the can of acid, as they are the first on the line. In the next cavern, I pick two flints. A bit later, I drown in a pool. Next time, I avoid the pool and move south, into NARACKAMUS's inner chamber. I can do nothing and he explodes me to death. This repeats a few times. Apparently my can of acid or tar or nitroglycerin are not fire from earth enough.


If I carried the nitroglycerin with me, I could blow up the whole town

I am sure the empty can is part of the solution, so I start clicking around. I die many times in the pool until I find the correct spot again and I fill in the can with naphtha.

Would it hurt you Infogrames to add a bit of FEEDBACK when I push L? I can see what is in the room, so tell me what it is! If I drown in a pool of liquid, I can definitely see there is liquid. And if I randomly use my empty can to get naphtha, I should know that this is naphtha. Or at least tell me that "You get a very particular odour in this room. Smells like naphtha / petroleum". I could figure out the rest. Rant over.

With naphtha in my possession, I use it immediately as I enter the next chamber (N. immediately recognises the smell. See game?). Then I use the flints to set it on fire and then again the bow and arrow to kill NARACKAMUS. Victory?


I know that Lovecraft was not big on dialogues, but this line could do with some more work

We have not won of course. I have yet to see the comet. After I kill NARACKAMUS, Lord BOLESKINE's apparition appears and tells me I have to stop Dagon from being set free. His temple is on an island off the coast of Illsmouth, so I need a boat to get there. Maybe BISHOP has one? Before I leave, I pick up two gems, a turqoise and an aquamarine, and the butterfly stolen from JUGG's house from next to NARACKAMUS's throne. Then I leave. And die a couple more times on the way.

I get to the port and see a boat and BISHOP, so I naturally speak to him. After a few attempts, during which he gets frustrated and refuses to talk to me until I leave and enter again, I persuade him to lend me his boat, which I then use to travel to the island.


Insert Monkey Island music

On the island, there is a fallen head from a statue, which has two gems as eyes, a ruby and an emerald. I naturally pocket both. Then I try to enter the temple and I get stuck because of the obligatory...


Frustrating sliding puzzle!

I wonder if there some secret agreement among mystery adventure game designers that they should include sliding tile puzzles in their games? I understand it is easy to program and implement, but it adds frustration and artificially lengthens the game. It is not fun. I enjoy such puzzles, but in the abstract.

Anyway, inside the temple is a grotesque mound of stone which could well be a statue of Dagon or Jabba the Hutt. On the floor there are several slabs with signs carved on them. There are some gems as well set in the walls and as the statue's eyes. I cannot really look at anything, so, once again, I don't know what I should be interacting with.

I find out that I can interact with the gems and the statue's eyes. I try one gem at random and am electrocuted. I try with a ruby, and this time a beam is emitted from it and is reflected around the cave. It could be trying to form a sing, but, if so, it is incomplete. I suppose I should be doing something about it. As I am thinking, a creature breaks through the belly of the statue and kills me.


Too many deaths to count

I spend some time on this puzzle. I do not have much time once I climb down. I die a few times trying to find the solution. It turns out that I had to hold the aquamarine gem and walk on the slab with the correct sign. The creature then bursts into fire and I run out in slow motion to jump ahead of an explosion, Hollywood style. Again, it is a clever puzzle in retrospect. I think there was a clue in one of the books at JUGG's library, speaking about sitting on the sign, but it again seemed a bit unclear to me.

Moving on, Lord BOLESKINE reappears to give me some half solution again. I need to let the currents lead me to my next stop, in which I have to single-handedly stop Cthulhu himself. And he gave me his ring and said something about our green land (I assume England) in the BOLESKINE family moto.

At Cthulhu's island or sandbank, the cave is too dark. Fortunately, I have been carrying my lantern almost since the beginning. The lantern, which immediately runs out of oil and leaves me in the dark, at the mercy of the creatures that roam the caves.


Actual game footage!

I feel I am in a dead-end, because I cannot refill it. If only I had something that burns. Yes... you guessed it: Napthta. Why would I refill the can after I killed the sorcerer? So I reload from before beating Dagon and head down to the well again to collect that precious liquid.

Now, when I run out of oil in the caves, I can use the can of naphtha to refill. Unfortunately, I find myself in another obstacle course. This time I have to slip past the monsters that roam the two rooms that I must cross. It takes a few tries because there is only so much space between the creatures. I don't know how hard it would be in the CD-ROM version.

When I succeed, I find an altar to Cthulhu and the WEBSTERS, mother and son, tied on a pole and in dire need of help. Cthulhu is sapping their energy and if I do not do something quickly, he will join us. I cannot untie the prisoners so I must stop them. Fumbling around with my stuff, I see that I can put the emerald (green gem) on BOLESKINE's ring. I also use my can of acid on a weird slab on the ground and I reveal a diamond. As soon as I pick this up, Cthulhu starts sucking the life out of the WEBSTERS and tentacles appear. I die a couple of times, as I am too slow thinking what to do. In the end, I use the turquoise (I think) on NATAWANGA's ring and put them on one after another. Cthulhu is banished and I have some free squid for my dinner.


By your powers combined, I am Captain Planet. Or not

I must also say that I like that scene above and give credit where it is due.

I let the WEBSTERS find their own way out and I stay behind to have a chat with Lord BOLESKINE. He says that the way I came in is blocked (I hope after the WEBSTERS got out) and that I need to go to the stone circle quickly and definitely take a photo of the comet. Does he work for my employer? I get out of the caves and I have to look again for the secret passage that takes me out of the collapsed cave and directly at the stone circle.

The last sequence is relatively straightforward and satisfying as far as puzzles go. I can take my time to set up my tripod, put the camera on it, check the butterfly to note the colours on its wings and then place it on my camera. I then put the magnifying glass (my sonic screwdriver) on the camera and add the lantern. Four coloured beams appear and hit 4 stones, leaving a coloured mark, red, green, white and blue. Once I finish, I unwrap the photographic plates and use them on the camera to take photos of the comet. As the comet passes, it leaves a fragment. I am sure astrogeologists would give an arm and a leg to just look at it, but I pick it up and put it on the white spot, which symbolises air. I do the same with diamond (green – earth), flint pieces (red – fire), aquamarine (blue-water). Everything else is technically a cutscene. I say the ritual and Yog Sothoth is banished.


Thank god I didn't have to type the words myself

I am now in the closing cutscene with limited control. In my room I have already packed my stuff and head to port to board the steamer home. Outside Dr COBBLE's house, BAGGS shows me the door not so kindly and lets me know that he had locked ZEKE in just in case. I think he did well, considering the quality of his beer.

At the port, I am greeted by the whole town, or what's left of it, and treated to a warm goodbye. In the last scene, I sit at Mr GRIFFITH's office and get to recount my story once again, looking too sane for it to be true.


Can I go away now?

So, we reach the end of a game, which played almost perfectly like a Lovecraftian short story, though not so much for the main character as for the player. But more on that on our Rating post, which will follow soon.

Session time: 3:00
Total time: 13:10

Sanity lost: 60 from making the acquaintance of the Ancient ones (20 each from Dagon, Cthulhu and Yog Sothoth)
Total sanity lost: 97 (Iäää Iäää FHTAGN!)

Saturday, March 28, 2020

WIP - "Rescue Of Hommlet" - Playtest Weekend

Having written stolen and mashed up rules to create a Chainmail/Book of War hybrid Frankenstein monster, I wanted to make sure that the thing played well, and I wanted to see what comes up that I hadn't thought of.

And I wanted to give the model a shakedown, to see how it would be used by (hopefully) friendly faces before taking it to GaryCon to sit next to two other Greyhawk games taking place with the same topic - the goings on of the Temple of Elemental Evil and the infamous Moathouse.

But first... picture porn of the model! I've made progress since the last model update from early December.

      

It felt really good to get the model to a point where I could play with it. Obviously, a lot of work left to be done, with painting details, making the mucky moat and surrounding terrain. The comments I got from players was very positive!



Playtesting - I had three concerns with the scenario and rules:
  • Will the rules work in reflecting that we have figures that represent single characters (1:1 scale) and figures that represent troop units (~10:1 scale)
  • With using the forces as represented in the module T1 - Village of Hommlet, is there a huge mismatch?
  • What surprises do I need to account for that devious players will come up with?
I ran one session on Saturday for Chris and Alex, two of my D&D players and members of the Northern Illinois Fantasy Miniatures Association. On Sunday, I ran a session for my D&D player Derek.

 

I'm happy to say that I got tons of great feedback from my very patient friends! Overall, they all expressed enjoyment with the scenario and with the approach of playing "D&D" with Chainmail as the battle mechanism. It became clear that what we had was more of a skirmish game than a huge battle. That turned out to be OK!

If you go and look at the rules, you can see a number of tweaks and approaches that I've adopted to reflect lessons learned. Here are the three big ones:

I. Having a character figure that isn't a superhero somehow take out a troop unit figure with just a single dice roll didn't feel right. The character should be a lot more threatened when they go against a unit of soldiers [1].

To solve that, I took this approach:
1. If the battle is troop unit figure vs. troop unit figure, or character/creature vs. character/creature, roll number of dice equal to Fighting Capability (FC) of unit. Count hits. This is standard Chainmail or Book of War.

2. If battle is troop unit figure (representing 10 soldiers) vs. character/creature, scale the dice. Roll # of dice representing FC of unit multiplied by number of soldiers left in figure. Count hits against character. Character rolls number of dice equal to their Fighting Capability.

So, Rufus the Fighter is facing a figure of bugbears. He has an FC of 6. He is attacking as Heavy Foot (HF) and the bugbears are defending as Armored Foot (AF). In my rules, he needs a 6. He rolls 3 6 1 1 2 5, so he scores a hit! That means a bugbear will be a casualty out of the unit.

The bugbears return the favor. Their FC is 2. The figure represents ten bugbears. So the player for the bugbears would grab TWENTY six siders and roll. The bugbears attack as HF and Rufus defends as AF. With twenty dice, the chances are likely for at least 3 to 4 hits, so Rufus might be in trouble here...

THIS felt right, even though it would be murder on the characters - as it should be! Up to about Superhero level, a single character is taking huge risks to get involved in an Aragorn-esque fight against a bunch of baddies.

What helped was the adopted rule that magic armor removes a dice from each roll. So if ten bugbears are rolling 2 dice each, Rufus's magic armor made that 1 dice. Which, magic armor should have that effect. So this felt right as well.

It does mean I'm going to have to track the "hits" on a troop figure from characters. So that as the character whittles away at the troop unit, it grows less and less effective in attacking, meaning less dice to attack with. I'm OK with that right now, but I'm still considering if this is the approach I want to take.

I may revert to the approach of Chaos Wars and represent units as multiple figures - so it will look like a 1:1 game, although troops on troops will still be adjudicated at a 10:1 scale. I'm not sure yet.

II. Magic and the different classes. At first, I was struggling with how to interpret the various bonuses and minuses from the gear that the inhabitants of Hommlet and Moathouse have with them. Through testing, we agreed to use the approach from "Compleat Chainmail" - if the defender (against ranged or melee) has magic armor, attackers remove a die from their roll. If attackers have a magic weapon, they add a die to their roll. This worked well for a convention game approach.

I also had to dig through OD&D history, original booklets, supplements and the Strategic Review articles to fill the rules and approaches for things in T1 that don't come in OD&D/Chainmail as written. Things like how to implement Elmo the Ranger (riff off the Ranger article from Strategic Review Vol 1, #3), the Druid Brother Smythe and his spells (look at Supplement III, Eldritch Wizardry), how does Lareth's Staff of Striking work in the Chainmail combat rules (riff off of AD&D/DMG description of the staff and have the player opt to improve a hit to be two or three, while spending charges).

That was a fun exercise in looking at how iconic classes were built, and how AD&D was still a similar game to OD&D in that you could easily use magic items from one in the other.

III. Crossbowmen are murder! The basic scenario has the Forces of Woe at the Moathouse, prepared with full knowledge of the approach of the Forces of Weal. This means that logically, the ranged forces are going to be on the ramparts, ready to shoot down any who approach. It's a sound tactic, used effectively through history. In the first game, I had written down the wrong range for crossbows, using the heavy crossbow range of 24" versus the actual range of 18". I also had two figures of crossbow units on the ramparts, to represent the 20 Guards of the New Master.

Had we run with the rule of multiple dice x FC of troop units versus single characters, I doubt that many would have survived the approach!

In the second game, I reduced the number of New Guards with crossbow to 10 soldiers (1 figure) only, but even with that, they murdered the approaching forces of Weal - taking out both single figures of mercenary bow and militia bow, then the elderly farmer captain armed with a crossbow.

The one factor in both situations was that the crossbowman had cover on the Moathouse's ramparts while the forces of Weal were out in the open.

I have a solution that is tied to the description of the terrain around the Moathouse.
A scrub of thorns, thistles, weeds, and shrubs grows thickly along the edge of the track which leads to the ruins, and even the track is mostly overgrown and cluttered with fallen branches and trees.
...
After two miles of distance, the land begins to sink and become baggy, as the track turns more northerly, and tall marsh plants grow thickly where cattails and tamaracks do not. Off to the left can be seen the jagged silhouette of the moathouse.
...
The bogs here stink, and the vegetation appears dense and prolific, but somehow sickly and unhealthy, creepers and vines throwing their strangling loops over the skeletons of dead saplings and living bushes alike. The rushes and cattails rustle and bend even when only a slight zephyr blows over the marsh, and weird bird calls, croakings, and other unwholesome sounds come faintly across the fen.
I had been saying that the only place where normal movement can happen is on the path/track to the moathouse. If you go off-road, you are in that thick scrub and vegetation, therefore you move at half movement. My fix here is to give anyone in the weeds the benefit of cover as well.

So it's a tough choice, go slow and with benefit of cover, or go fast and possibly get cut down. I think this is a good tactical choice, so I will leave the forces as-is, and playtest this approach.

Plus, I get to make more terrain! Scatter terrain to represent the bog/swamp around the moat.

There are a lot of other lessons and tweaks from the play-test, but these are big ones. I'm really glad I did the testing, it's going to make my Greyhawk game that much better.



Researching Greyhawk is interesting for me, because it's such hallowed, well-trodden ground in D&D lore. The Battle of Emridy Meadows and the Temple of Elemental Evil are well-known and beloved. This has led me to approach this scenario with a lot more preparation and thought than I normally do with my "plan a little, play a lot" approach. 

I want players to "feel" like this is OD&D/Chainmail and that the game is accurate, for the most part, to how T1 - Village of Hommlet sets things up. Judging by how my testers reacted, they weren't all that familiar with Greyhawk, but they enjoyed the experience. So I'm hopeful!

As a reminder, if you want to see what I'm doing, here are links to my documents on Google Drive:

[1] I blame Daniel Collins (of Delta's D&D Blog) for converting me to the view that many of the 'single person versus an army' fantasy scenes are just really unrealistic. I feel like it's a better game when I keep that in mind and take that approach. 

Thronebreaker: The Witcher Tales Now Available For Nintendo Switch!



Thronebreaker is a single player role-playing game that combines narrative-driven exploration with unique puzzles and turn-based battles, and spins the tale of Meve, war-veteran queen of two Northern Realms — Lyria and Rivia. Facing an imminent Nilfgaardian invasion, Meve is forced to once again enter the warpath and set out on a dark journey of destruction and revenge.




A set of free digital goodies comes with Thronebreaker, including the official soundtrack, concept art from the game, as well as an annotated map of Lyria. Details on how to claim these goodies can be found on the dedicated website.

Ported to the Nintendo Switch by Crunching Koalas, in close cooperation with CD PROJEKT RED, Thronebreaker: The Witcher Tales can be purchased right now from the Nintendo eShop. The title is also available on GOG.COM, Steam, as well as PlayStation 4 and Xbox One. For more information regarding the game, visit thewitcher.com/thronebreaker.






Y2K: THE GAME


The year is 1999. A new century is upon us and the new story to scare the masses is the Millennium Bug. Computers will stop working. Electricity will shut down. Mass hysteria! Someone had to capitalise on all of this. Step in Interplay with their prescient point-and-click adventure Y2K: The Game.

Read more »