Tuesday, September 22, 2020

R.I.P. Matthew Frederick, One Of The Great Unpublished Game Designers

Some time ago -- almost 2 decades now -- I stumbled across a website called the Board Game Designers Forum. At the time I had recently graduated college and gotten a job, many of my friends had moved away, and I was looking for something to fill my time. It was a perfect storm that led to my eventual career in game design, development, and publishing, and it all started on that fateful forum.

In the early days of BGDF, I read a lot of posts, I wrote a lot of posts, and I spent a lot of time in the IRC chat room with some of the forum regulars. Several of those regulars have gone on to see great success in the game industry as designers, artists, or publishers (or all three)!

One of those regulars, an admin in fact, went by the handle FastLearner. His name was Matthew Frederick. Matthew was ever-present, always insightful, and always made sure the forums were going strong. He's the one that created this BGDF logo:

A logo I placed on the back of the box for both Terra Prime and Eminent Domain, as a nod to the role the forums played in the design of those games.

One of my favorite aspects of the site was something called the Game Design Showdown, which turned into a monthly design challenge where, given a week and a theme, component restriction, or other guidelines, you could submit an entry. Entries were posted anonymously, and then voted on. There was no prize, and the submissions were not intended to be finished, tested games anyway, but the challenge was a good way to exercise the design muscles, and I know of several ideas from the GDS that went on to become fully fleshed out (and in some cases published) games. I say that's what the GDS turned into, but it started as a sort of real time challenge in the chat room, run by FastLearner, where instead of a week to come up with a game idea, you had just minutes! We only did that a couple of times, but it was great fun, and it opened the door to the larger Game Design Showdown, which still runs today if I'm not mistaken.

As it happens, Matthew lived in Phoenix, AZ -- just up the street from my hometown of Tucson. A couple of times I drove up and got together with Matthew... we talked about our game designs, even played each other's games. Matthew was one of the players who I wrangled into may first two playtests of UK designer David Brain's prototype: All For One, and we did a prototype swap (I left 8/7 Central with him, and brought home his mountain climbing themed game: Everest). I recall several of Matthew's games that I played, and they were all very good:

Everest was a middle-weight euro-style game about drafting a team of climbers (with sponsorship from various countries), and climbing Mount Everest. There were different terrain types to navigate, and your climbers were better at some than others. You could set up camps along the way where you could rest your team. There were rewards for reaching certain elevations first, including a large reward for reaching the top of the mountain. It was a real, honest to goodness game, on par with a lot of the stuff I've played off store shelves.

Velociracers was a card driven game where you, a Velociraptor, raced around an island grabbing up eggs and trying to keep ahead of the T-rex that was hot on your heels. Each turn you would play one of your cards, and you wouldn't get them back until you did a special "rest" action. There were mechanisms in place to keep the dinos bunched in a pack -- a headwind to keep the front runners from getting too far ahead, and cards that let you advance more the farther back in the pack you were. Fall too far behind and the T-rex will hurt you, much like taking damage in Snow Tails. Like all of Matthew's games, this felt fully fleshed out, even if he wasn't happy with it.

Elvencraft was another excellent design, where you would move around an Elven village in the trees, connected by bridges (which I think you would build, if I remember correctly), collecting items and crafting them into better items. I don't remember all the details of this one, but I do recall it feeling like a real game as well.

Cow Tipping was a small, Rummy-style card game that a nascent TMG considered publishing. It had adorable art and a cute theme of gangs of cows taking revenge on people by tipping over vehicles stopped in traffic. Motorcycles required a smaller gang (set or run) of cows to tip, but are worth fewer points. Buses were the most valuable, but of course required the largest gangs to tip. I recently re-read my email threads with Matthew about this game.

As a neophyte developer, I was perhaps overzealous about wanting to change Cow Tipping a lot. In the end, TMG did not publish that game, but Matthew gave me some important feedback that I still need to take to heart at times- he said something to the effect of "with all those changes, what exactly are you licencing from me?" That is a significant question for a few reasons. Not only was it a wake up call to me as I stepped into the game industry as a professional developer, but it also stands in stark contrast to some of the sentiments I've seen in modern designers who might submit an unfinished game with the expectation that the publisher will finish it for them. In contrast, all of Matthew's games were fully fleshed out, thoroughly tested, and more complete than many submissions I've received over the years.

About a decade ago, I lost touch with Matthew. I wasn't hanging out in the BGDF forums anymore, and I didn't travel to Phoenix very often. I didn't have much occasion to reach out to him, and from what I could gather, he had a very busy life, sometimes plagued with additional hardships outside his own control. I did follow Matthew on Twitter, and occasionally saw some snippet of his life scroll through my timeline, and every time it made me wonder "what ever happened to that guy?"

Back in October, just a few months ago, Matthew sent me a Twitter DM, seemingly out of the blue. It was a very complimentary message, just saying that he was pleased and impressed to hear how well I'm respected in the industry. Apparently Matthew had followed my career, or was at least aware of it. He followed that with another message:

Perhaps one day we'll get together again and reminisce about the old days and talk about what's happened in the intervening years.
Two months later, I was sad to hear that Matthew was gone. I had gathered from tweets I'd seen that Matthew was sick -- fighting some kind of cancer. I know now that his message to me was something of a "goodbye," and I'm sorry I didn't drop everything right then and there and drive up to Phoenix to see him one last time, maybe play a game, or do that reminiscing he mentioned.

Matthew, I'd like to thank you for being the man that you were. The pillar of the game design community which brought me from a casual Magic player to a professional game designer. You are far and away the best designer I know, and the gaming world is poorer now that you're gone.

You will be missed.

Monday, September 21, 2020

Superliminal Review (NSW)

Written by Patrick Orquia


Title: Superliminal
Developer: Pillow Castle
Publisher: Pillow Castle
Genre: First-Person Puzzle
Number of Players: 1
Platform: Nintendo Switch
Release Date: July 07, 2020
Price: $19.99



I remember when I was in college, I got fascinated by the works of MC Escher, whose works include bizarre, mind-bending illustrations of forced perspectives, impossible figures, and other out-of-this world dream-like scenarios. I can't draw or paint to save my life but I do appreciate art from time to time, and MC Escher's works really impressed me. Probably not enough for me to study art in college, but still, really impressed. A few years after my graduation in college, Christopher Nolan's magnum opus, Inception, came along, featuring lucid dreams and the power one can have while dreaming, and also featuring some of the best visual effects and imagery put to film. That scene where an entire street bends and folds on itself, just fantastic.




Fast forward to now, I get the chance to play a game that I didn't think will really tickle my fancy much but eventually put my problem-solving skills to the test. The game is Superliminal from the developers Pillow Castle, and it is a first-person puzzle game that involves using forced perspectives and optical illusions to solve puzzles. The game is presented quite unassumingly quaint at first, and yet, things build up and get more and more complex the further you progress into it. The visuals, graphically, don't look too remarkable, but they are well-presented and executed. The music is also excellent, consisting simple, mostly piano-based jazz elevator music but eventually leads way to other genres, such as electronica and orchestral music.

In this game you play an unnamed individual in first person view. You are at the Pierce Institute, about to take part in SomnaSculpt, a state-of-the-art dream therapy program. You are already asleep and in a lucid dream, the kind of dream where you know you are dreaming and can control your surroundings. After a brief introduction from Dr. Glenn Pierce, the head of Pierce Institute, explaining to you what SomnaSculpt is, a female voice greets you and make you sign the Terms of Service of the program, and you are soon given the rules. The main rule is you can use force perspective to solve puzzles: you can make objects appear bigger or smaller depending on how you look at them in respect to the surrounding. The big caveat is the objects DO become bigger or smaller for real after you place them on the ground or on whichever surface that you need to put them. By aligning seemingly disparate lines or shapes into completely new ones, you get to open up new pathways or make new objects appear. Not all objects can be interacted with, though, so another part of puzzle-solving is to find such objects or find patterns in your surroundings to make them appear. When you hover on an object that you can interact with, the little circle that acts like a cross hair in the middle of the screen becomes a hand icon, and that signifies that you can pick it up. Once an object gets picked up, you can then rotate it around depending on how you will use it, and then you have to use forced perspective on it to make it bigger or smaller. You can make new platforms appear that will allow you to reach doors that hang a few feet from the floor or a big object to press switches with or break walls, etc. You will also have to deal with doors that lead to another area through another door and they can loop with each other, and since you can make these doors physically big or small, if you pass through them, you become big or small as well, creating additional challenges and even paradoxes at times. Yes, your head will spin on this game, and you have to make sure not to get left behind. 




The game is divided into 9 levels, each with its own theme, like one is about making things bigger or smaller, one about lights and shadows, one about cloning objects, etc. The goal for each chapter is to reach an elevator that signify your gradual "waking up" from your lucid dream. At the start of (almost) each level, you get waken up by an alarm clock that you need to turn off in order for you to leave the room and deal with the puzzles that await you. As you progress into the game, the puzzles become more and more complex. There are chapters where it seems that all the rules established from the previous chapters get thrown out of the window and new ones get created on the fly while rooms get turned upside down or crumble on itself and it is up to you to figure them out using all the skills that you learned previously. They are awesome and fantastic and a bit scary at times, because you may feel trapped and disoriented due to the lack of clear indication on what you need to do to get past the puzzles. At one point, I felt like being trapped in some David Lynch movie and felt like going insane… that is, until I get to figure out what to do next and continue with my journey.

You get to hear the female voice from time to time to give you some insights about the program. Also, throughout the game, you will see boom boxes that if you choose to play, you will hear Dr. Glenn Pierce's voice, giving you some feedback about your performance so far and additional encouraging words to make you keep on keeping on.




Overall, Superluminal is one outstanding game with unique gameplay mechanics, presented in such a way that doesn't only challenge you mentally but also touch you emotionally within in quite surprising ways. There will be times when you will just feel lost and confused and going insane with the barrage of visual eccentricities from the puzzles thrown at you by the game, but you will eventually get to solve them and the feeling of such accomplishments is really satisfying. The game is short and can actually be finished in one sitting, depending on how you quickly you process visual cues and solve the puzzles, but it also ideal for short play sessions, either docked or in handheld mode on the Switch. The game has an achievement system with a good number of challenges that you can try to accomplish, thus encouraging you to play more and go back to previous levels. So, if you are a fan of puzzles and maybe art in general, this game is highly recommended to you. But even if not, this game is still very much worth your time to play, because it is really satisfyingly good and will challenge you in ways that you probably have not been challenged before in a video game. If you decide to play the game, good luck, and play it to the satisfying end. This game is fantastic from beginning to end, and it is waiting for you to play and experience it.



REPLAY VALUE: High



PROS
  • Outstanding aesthetics and gameplay
  • Excellent musical score, ranging from simple elevator music to electronica to jazz and other musical awesomeness in between
  • Challenging puzzles that vary from simple to really mind-bending, forcing you to really think out of the box
  • Evenly paced for the most part
  • Various achievements encourage you to play levels and the entire game multiple times, such as activating fire alarms, emptying fire extinguishers, beating the game in less than 30 mins, etc.
  • Satisfyingly good ending

CONS
  • Very short for its asking price, and since the puzzles don't get randomized, the overall charm of its unique gameplay only really work particularly well on the first playthrough
  • Some framerate dips and glitches happen, albeit infrequently


RATING: 4.5/5 mind bends and paradoxes

Saturday, September 12, 2020

VC 1012, M.A.D.!

What, me worry? Not when I have M.A.D. from U.S.Games as this episode's game! Hoo boy. I hope you enjoy the episode. Next up is Robin Hood by Xonox. If you have any feedback for that game, please send it to me at 2600gamebygame@gmail.com by March 8th. Thanks so much for listening!

M.A.D. on Random Terrain
John Hall's website
Interview with John Hall by Sean Fitzgerald 
No Swear Gamer 426 - M.A.D.
No Swear Gamer M.A.D. gameplay footage
Get Matt's Repro Freeway patch on eBay

Fixing NES Headers And Converting Them To NES 2.0 : Putting Theory Into Practice!

In my last blog entry, I announced the creation of an evolving database of NES ROM headers, focused on cartridge accuracy.  However, while I can make a spreadsheet for easy accessibility, spreadsheets are not the best way to organize data for use by other programs.  I cannot expect someone wanting a full set of proper NES 2.0 ROMs to manually edit the headers of over 2,900 separate files!

There has to be an easier way, right?
The task of manual fixing isn't slight.
Well, if you read further now,
I'll be happy to tell you how.

Read more »

Friday, September 4, 2020

People Behind The Meeples - Episode 231: Seth Cooper

Welcome to People Behind the Meeples, a series of interviews with indie game designers.  Here you'll find out more than you ever wanted to know about the people who make the best games that you may or may not have heard of before.  If you'd like to be featured, head over to http://gjjgames.blogspot.com/p/game-designer-interview-questionnaire.html and fill out the questionnaire! You can find all the interviews here: People Behind the Meeples. Support me on Patreon!


Name:Seth Cooper
Email:support@blueprintgamingconcepts.com
Location:Chicago, IL USA
Day Job:Project Manager
Designing:One to two years.
Webpage:www.blueprintgamingconcepts.com
Blog:www.blueprintgamingconcepts.com
BGG:Blueprint Gaming Concepts
Facebook:Blueprint Gaming Concepts/
Twitter:@concepts_gaming
YouTube:BlueprintGamingConcepts
Instagram:@blueprintgamingconcepts/
Other:
Find my games at:FLGS Locator on www.blueprintgamingconcepts.com
Today's Interview is with:

Seth Cooper
Interviewed on: 5/5/2020

In this week's intervew we get to meet another game designer that is fairly local to me. Seth Cooper is from Chicago and has run a successful Kickstarter for his first published game, a game about some dark Chicago history and lore: Crimes in History: H. H. Holmes' Murder Castle. If you're interested in some darker historical stories and games, be sure to check it out. And read on to learn more about Seth and his projects!

Some Basics
Tell me a bit about yourself.

How long have you been designing tabletop games?
One to two years.

Why did you start designing tabletop games?
I have been an avid board game player for years and have thought of some new ideas and themes to pursue.

What game or games are you currently working on?
Crimes in History: H. H. Holmes' Murder Castle

Have you designed any games that have been published?
This is our first self-published game and is supported by 1800 backers from Kickstarter and post-Kickstarter late pledges.

What is your day job?
Project Manager

Your Gaming Tastes
My readers would like to know more about you as a gamer.

Where do you prefer to play games?
Like to host

Who do you normally game with?
Friends

If you were to invite a few friends together for game night tonight, what games would you play?
Wingspan, Terraforming Mars, Watergate, Smash Up, Scythe, Azul Stained Glass

And what snacks would you eat?
Veggie Trays, Brownies

Do you like to have music playing while you play games? If so, what kind?
Yes, 80s and 90s

What's your favorite FLGS?
Dice Dojo

What is your current favorite game? Least favorite that you still enjoy? Worst game you ever played?
Wingspan; Puerto Rico; King of Tokyo (due to the rulebook and event card language)

What is your favorite game mechanic? How about your least favorite?
Connections; Player Elimination

What's your favorite game that you just can't ever seem to get to the table?
Steampunk Rally

What styles of games do you play?
I like to play Board Games, Card Games, Video Games

Do you design different styles of games than what you play?
I like to design Board Games

OK, here's a pretty polarizing game. Do you like and play Cards Against Humanity?
No

You as a Designer
OK, now the bit that sets you apart from the typical gamer. Let's find out about you as a game designer.

When you design games, do you come up with a theme first and build the mechanics around that? Or do you come up with mechanics and then add a theme? Or something else?
Come up with the mechanics first and then add the theme

Have you ever entered or won a game design competition?
No

Do you have a current favorite game designer or idol?
Jamey Stegmaier

Where or when or how do you get your inspiration or come up with your best ideas?
In the middle of night, true eureka style!

How do you go about playtesting your games?
Design the game with playtesting approaches in mind, playtest with friends, playtest with game designers, then blind playtests

Do you like to work alone or as part of a team? Co-designers, artists, etc.?
Team

What do you feel is your biggest challenge as a game designer?
Building the right team

If you could design a game within any IP, what would it be?
Back to the Future

What do you wish someone had told you a long time ago about designing games?
Find an artistic friend!

What advice would you like to share about designing games?
You really have to become a swiss army knife of as many trades as possible if you want to self-publish (game design, playtesting, manufacturing, fulfillment, marketing, rulebook editing, IT, etc.)

Would you like to tell my readers what games you're working on and how far along they are?
Games that will soon be published are: 2
And games that are still in the very early idea phase are: 1

Are you a member of any Facebook or other design groups? (Game Maker's Lab, Card and Board Game Developers Guild, etc.)
Yes

And the oddly personal, but harmless stuff…
OK, enough of the game stuff, let's find out what really makes you tick! These are the questions that I'm sure are on everyone's minds!

Star Trek or Star Wars? Coke or Pepsi? VHS or Betamax?
Star Wars; Coke; VHS

What hobbies do you have besides tabletop games?
Beach and Indoor Volleyball

What is something you learned in the last week?
Steampunk Rally has a sequel being Kickstarted!

Favorite type of music? Books? Movies?
80s/90s; Devil in the White City; MCU

What was the last book you read?
Teammate

Do you play any musical instruments?
No

Tell us something about yourself that you think might surprise people.
DJ'd for 15 years

Tell us about something crazy that you once did.
Jumped off a tall waterfall in Hawaii without checking the bottom of the pool to make sure it was deep enough

Biggest accident that turned out awesome?
Car accident

Who is your idol?
I don't idol that many people. :)

What would you do if you had a time machine?
Travel to the future to understand how awesome or bad the future may be...

Are you an extrovert or introvert?
Introvert

If you could be any superhero, which one would you be?
Flash

Have any pets?
Nope

When the next asteroid hits Earth, causing the Yellowstone caldera to explode, California to fall into the ocean, the sea levels to rise, and the next ice age to set in, what current games or other pastimes do you think (or hope) will survive into the next era of human civilization? What do you hope is underneath that asteroid to be wiped out of the human consciousness forever?
True humanity kindness; disease and guns


Thanks for answering all my crazy questions!




Thank you for reading this People Behind the Meeples indie game designer interview! You can find all the interviews here: People Behind the Meeples and if you'd like to be featured yourself, you can fill out the questionnaire here: http://gjjgames.blogspot.com/p/game-designer-interview-questionnaire.html

Did you like this interview?  Please show your support: Support me on Patreon! Or click the heart at Board Game Links , like GJJ Games on Facebook , or follow on Twitter .  And be sure to check out my games on  Tabletop Generation.

Monday, August 31, 2020

Hacking Windows 95, Part 2

In the Hacking Windows 95, part 1 blog post, we covered that through a nasty bug affecting Windows 95/98/ME, the share password can be guessed in no time. In this article, I'm going to try to use this vulnerability to achieve remote code execution (with the help of publicly available tools only).

The first thing we can do when we have read access to the Windows directory through the share, is to locate all the *.pwl files on the c:\windows directory, copy them to your machine where Cain is installed, switch to Cracker tab, pwl files, load the pwl file, add username based on the filename, and try to crack it. If you can't crack it you might still try to add a .pwl file where you already know the password in the remote windows directory. Although this is a fun post-exploitation task, but still, no remote code execution. These passwords are useless without physical access.


One might think that after having a share password and user password, it is easy to achieve remote code execution. The problem is:
  • there is no "at" command (available since Windows 95 plus!)
  • there is no admin share
  • there is no RPC
  • there is no named pipes
  • there is no remote registry
  • there is no remote service management
If you think about security best practices, disabling unnecessary services is always the first task you should do. Because Windows 95 lacks all of these services, it is pretty much secure!

During my quest for a tool to hack Windows 95, I came across some pretty cool stuff:
LanSpy

But the best of the best is Fluxay, which has been written by chinese hackers. It is the metasploit from the year 2000. A screenshot is worth more than a 1000 words. 4 screenshot > 4 thousand words :)





It is pretty hard to find the installer, but it is still out there!

But at the end, no remote code execution for me.

My idea here was that if I can find a file which executes regularly (on a scheduled basis), I can change that executable to my backdoor and I'm done. Although there is no scheduler in the default Windows 95, I gave it a try. 

Let's fire up taskman.exe to get an idea what processes are running:


Looks like we need a more powerful tool here, namely Process Explorer. Let's try to download this from oldapps.com:


LOL, IE3 hangs, can't render the page. Copying files to the Win95 VM is not that simple, because there are no shared folders in Win95 VM. And you can't use pendrives either, Win95 can't handle USB (at least the retail version). After downloading the application with a newer browser from oldapps, let's start Process Explorer on the test Windows 95.


Don't try to download the Winsocks 2 patch from the official MS site, it is not there anymore, but you can download it from other sites

Now let's look at the processes running:


After staring it for minutes, turned out it is constant, no new processes appeared.
Looking at the next screenshot, one can notice this OS was not running a lot of background processes ...


My current Win7 has 1181 threads and 84 processes running, no wonder it is slow as hell :)

We have at least the following options:
  1. You are lucky and not the plain Windows 95 is installed, but Windows 95 Plus! The main difference here is that Windows 95 Plus! has built-in scheduler, especially the "at" command. Just overwrite a file which is scheduled to execution, and wait. Mission accomplished!
  2. Ping of death - you can crash the machine (no BSOD, just crash) with long (over 65535 bytes) ICMP ping commands, and wait for someone to reboot it. Just don't forget to put your backdoor on the share and add it to autoexec.bat before crashing it. 
  3. If your target is a plain Windows 95, I believe you are out of luck. No at command, no named pipes, no admin share, nothing. Meybe you can try to fuzz port 137 138 139, and write an exploit for those. Might be even Ping of Death is exploitable?
Let's do the first option, and hack Windows 95 plus!
Look at the cool features we have by installing Win95 Plus!


Cool new boot splash screen!


But our main interest is the new, scheduled tasks!


Now we can replace diskalm.exe with our backdoor executable, and wait maximum one hour to be scheduled.

Instead of a boring text based tutorial, I created a YouTube video for you. Based on the feedbacks on my previous tutorialz, it turned out I'm way too old, and can't do interesting tutorials. That's why I analyzed the cool skiddie videoz, and found that I have to do the followings so my vidz won't suck anymore:
  • use cool black windows theme
  • put meaningless performance monitor gadgets on the sidebar
  • use a cool background, something related with hacking and skullz
  • do as many opsec fails as possible
  • instead of captions, use notepad with spelling errorz
  • there is only one rule of metal: Play it fuckin' loud!!!!
Related news

Sunday, August 30, 2020

BruteSpray: A Brute-forcer From Nmap Output And Automatically Attempts Default Creds On Found Services


About BruteSpray: BruteSpray takes nmap GNMAP/XML output or newline seperated JSONS and automatically brute-forces services with default credentials using Medusa. BruteSpray can even find non-standard ports by using the -sV inside Nmap.

BruteSpay's Installation
   With Debian users, the only thing you need to do is this command:
sudo apt install brutespray

   For Arch Linux user, you must install Medusa first: sudo pacman -S medusa

   And then, enter these commands to install BruteSpray:


Supported Services: ssh, ftp, telnet, vnc, mssql, mysql, postgresql, rsh, imap, nntpp, canywhere, pop3, rexec, rlogin, smbnt, smtp, svn, vmauthdv, snmp.

How to use BruteSpray?

   First do an Nmap scan with -oG nmap.gnmap or -oX nmap.xml.
   Command: python3 brutespray.py -h
   Command: python3 brutespray.py --file nmap.gnmap
   Command: python3 brutesrpay.py --file nmap.xml
   Command: python3 brutespray.py --file nmap.xml -i

   You can watch more details here:

Examples

   Using Custom Wordlists:
python3 brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

   Brute-Forcing Specific Services:
python3 brutespray.py --file nmap.gnmap --service ftp,ssh,telnet --threads 5 --hosts 5

   Specific Credentials:
python3 brutespray.py --file nmap.gnmap -u admin -p password --threads 5 --hosts 5

   Continue After Success:
python3 brutespray.py --file nmap.gnmap --threads 5 --hosts 5 -c

   Use Nmap XML Output:
python3 brutespray.py --file nmap.xml --threads 5 --hosts 5

   Use JSON Output:
python3 brutespray.py --file out.json --threads 5 --hosts 5

   Interactive Mode: python3 brutespray.py --file nmap.xml -i

Data Specs
{"host":"127.0.0.1","port":"3306","service":"mysql"}
{"host":"127.0.0.10","port":"3306","service":"mysql"}
...


Changelog: Changelog notes are available at CHANGELOG.md.

You might like these similar tools:

More info