2025-06-16

Knocking our opps with a debugger (PhaserJS)

Of course I didn’t used those cheats to win the prizes, I’m not that down bad 🥀

Introduction

While wasting my times on snapchat I came across an ad about a game for promoting the new album of a rapper and I wondered if I could cheat on it.

The game is hosted at https://www.ladouille.fr/ and is a 2D web browser game where you have to eliminate the ennemies, the “opps”, coming from the both sides of the screen.

Eliminating a target earns you 1 point, and eliminating multiple targets quickly get you a combo and more points.

The player is supposed to make the biggest score so he can have a chance to win a 100€ gift card or a custom gold disc (350€).

When the game is finished, we are asked to fill out a form to enroll to the giveway :

Let’s dive in !

Finding where the code is

The whole game is stored client side on two JS file :

• index-ByZ33U9g.js ~15000 lines
• phaser-DJkhv3Fe.js ~70000 lines

When I saw the line count, I told myself “naaah I ain’t reading ts 🥀”.

The “phaser.js” made me curious so I looked up in google and found out that it is a HTML 5 game engine based on javascript : https://phaser.io/. It uses WebGL and Canvas.

Also, by opening the console when the page load, we got a log message mentionning Phaser :

By intuition, I thought that index-ByZ33U9g.js (I will refer as ‘index.js’ from now), is the main part of the game. And by reading it we see that the other JS file is imported :

1
2
3
4
5

import {
  g as n,
  r
}
from'./phaser-DJkhv3Fe.js'; 

The variable names are made of one letter, reminding me of a compressed or obfuscated JS code. There is tooooo many code so my first move was looking for strings in the code. And to know which one, I tried to look what happen when I press the “Commencer” button (“Start” in french) and look for this in the JS code.

But nothing is specified in the HTML :

So I immediately look up in index.js for “Commencer” and got only one result :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

c.jsx(
  'button',
  {
    className: 'button',
    onClick: () => {
      n(!1),
      window.dispatchEvent(new Event('start-game'))
    },
    children: 'Commencer'
  }

So the event 'start-game' is started when the button Commencer is pressed. By looking again in the code, we find that 'start-game' is defined in the class be, which inherit C.Scene class, a PhaserJS class. Which run this.handleStartGame :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

class be extends C.Scene {
  constructor() {
    super ('MainMenu'),
    t(this, 'background'),
    t(this, 'logo'),
    t(this, 'title'),
    t(this, 'logoTween'),
    t(this, 'handleStartGame', (() => {
      this.scene.start('Game')
    })),
    window.addEventListener('start-game', this.handleStartGame)
  }

This function is defined right above and run : this.scene.start('Game'), where this is the be class.

However, scene.start is not defined in index.js, so it must be part of phaser.js because be class inherit C.Scene. And C further in the code is defined in index.js and is equal to r(), a function exported from PhaserJS supposed to be the game context.

Here are the exported functions in the phaser.js file :

1
2
3
4

export {
  t as g,
  s as r
};

For example in another Phaser game, Phaser is exported like that :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

  if (typeof exports !== 'undefined') {
      if (typeof module !== 'undefined' && module.exports) {
          exports = module.exports = Phaser;
      }
      exports.Phaser = Phaser;
  } else if (typeof define !== 'undefined' && define.amd) {
      define('Phaser', (function() { return root.Phaser = Phaser; })() );
  } else {
      root.Phaser = Phaser;
  }

    return Phaser;
}).call(this);

So I understand that our target game source code is compressed or altered in someway. The fact is, for this game the Phaser template used is for React JS, that’s why the code is different.

However there are still hardcoded value so it slightly changes the difficulty.

Now, we need to know where is the actual code handling the ennemies we attack, our score and stuff ? Well reading the documentation for making a Pḧaser game, we learn about essential functions :

• create() : This function will define Phaser variables, staging and everything.
• upload() : This function will be executed in a loop to check some events, for instance it handle what to do when and ennemy attack a player.
• preload() : Phaser will automatically loof for this function when it starts a scene load anything defined within it..

Then we can search for those functions in the code. And we can find a nice reference under the class ve which call the superclass ‘GAME’

1
2
3

class ve extends C.Scene {
  constructor() {
    super ('Game'),

We can see that some very interesting variables are defined :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

class ve extends C.Scene {
  constructor() {
    super ('Game'),
    t(this, 'isPlaying', !0),
    t(this, 'difficultyLevel', 1),
    t(this, 'difficultyTimer'),
    ...
    t(this, 'player'),
    t(this, 'enemies', []),
    t(this, 'enemiesGroup'),
    t(this, 'lives', 10),
    ...
    t(this, 'livesBar'),
    t(this, 'isReady', !1),
    t(this, 'ennemesDead', 0),
    t(this, 'score', 0),
...

Finding where the code REALLY is

Now we know that, how can we edit those variables and have a big score ? Usually, we could directly edit the variable on the console, and edit the properties inside the ve class instance, but first we need to find this instance.

Fast forward, I found further in the code that ve alongside other classes were put in another variable ke :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

const ke = {
  type: C.AUTO,
  width: window.innerWidth,
  height: window.innerHeight,
  parent: 'game-container',
  backgroundColor: '#000000',
  scene: [
    P,
    we,
    be,
    ve,
    z
  ],

And the game start with ke as argument :

1
2
3
4

n.current = new C.Game({
  ...ke,
  parent: 'game-container'
}),

So, the game context is stored in n.current. However, when I start the game I couldn’t find any n variable in the console, it returns undefined. It’s weird because the game is actually here, I can play it.

The answer is, if n is accessed in a specific context, I can also access it but only in this specific context. This guy got the same case.

So we need to use the debugger to add a breakpoint inside the function where n is defined, create a reference to it and we should be able to do our modifications.

In the debugger we can open index.js which is a one liner but we can format it by clicking on {} on bottom left corner.

Now we can breakpoint on any line not grayed out. I chose to break at line 14715 because it occurs after the definition of n.current and because the other line 14706 just never stop the execution.

Now when refreshing the page I got a white overlay over the web page and in the console I can find n.current.

We can set a reference to it :

1

window.gameRef = n.current

By searching a bit we can find where the properties are stored, inside window.gameRef.scene.keys.Game :

Now we can play and try to edit some values.

Cheating in the game

Infinite lives

We can just set infinite lives by setting lives values :

1
2

window.gameRef.scene.keys.Game.lives = 9999999999999
9999999999999

No further check is made and the lifebar overflows :

And as we will take to much time to get to 0 HP, we can stop the game in the console with window.gameRef.scene.keys.Game.stopGame().

Big score

The score is saved at the same place as the lives. And it is updated while we play so we are at the right place :

Let’s update it :

At the end of the game the score is correctly set :

God mode (almost)

For this cheat I aimed to keep the same the life points, but not take any damage and still get point. Because, the default behaviour in the game when ennemy attack me, is to lose HP and not get any point.

First I started by investigating the function responsible for taking damage and killing ennemy. I saw setupCollision to be a good candidate and I was right.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

setupCollisions() {
    this.physics.add.overlap(
      this.player.instance,
      this.enemiesGroup,
      (
        (e, t) => {
          if (!t.body || !t.active) return void console.warn(
            'Collision skipped: Enemy body not initialized or enemy inactive.'
          );
          const n = t;
          if (this.player.isInBack(n)) return !0 === t.canDealDamage &&
          (
            this.lives -= 1,
            this.player.TakeDamage(),
            this.time.delayedCall(300, (() => {
              this.updateLivesBar()
            })),
            t.onHitByPlayer(this.player, !0),
            this.cameras.main.shake(200)
          ),
          this.lives <= 0 &&
          this.stopGame(),
          void this.player.stopDash();
          if (this.player.isDashing) {
            if (!t._alreadyKilled) {
              t._alreadyKilled = !0;
              const e = this.time.now;
              if (
                e - this.lastKillTime <= 500 ? this.currentCombo += 1 : this.currentCombo = 0,
                this.currentCombo > this.bestCombo &&
                (this.bestCombo = this.currentCombo),
                !0 === t.canDealDamage
              ) {
                this.lastKillTime = e;
                const n = 1 + this.currentCombo;
                this.score += n,
                this.ennemesDead += 1,
                this.showScorePopup(t.x, t.y - t.height - 250, n)
              }
              this.comboTimer &&
              this.comboTimer.remove(!1),
              this.comboTimer = this.time.delayedCall(500, (() => {
                this.currentCombo = 0
              })),
              t.onHitByPlayer(this.player, !1),
              this.enemies = this.enemies.filter((e => e !== t))
            }
          } else !1 === this.player.isInvincible &&
          !0 === t.canDealDamage &&
          (
            this.lives -= 1,
            this.player.TakeDamage(),
            this.time.delayedCall(300, (() => {
              this.updateLivesBar()
            })),
            t.onHitByPlayer(this.player, !this.player.isInvincible),
            this.cameras.main.shake(200)
          ),
          this.lives <= 0 &&
          this.stopGame(),
          this.player.stopDash()
        }
      ),
      void 0,
      this
    )
  }

In shorts :

• We take damage if we are not attacking, and if life <= 0 -> gameOver
• If the most recent kill was made under 500ms, a combo is started
• If we dash (dash==attack), we get invincible during the dash, and if we aslo touch an ennemy, we get a point

Like that, we learn about an invinciblity ability already implemented. Looking in the code, we can find those three functions :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

  startDash() {
    this.isDashing = !0,
    this.isInvincible = !0,
    this.startAfterImage()
  }
  stopDash() {
    this.isDashing = !1,
    this.stopAfterImage()
  }
  stopInvincibility() {
    this.isInvincible = !1
  }

To keep it shorts, when dashing, isInvincible is set to 1. And in other place in the code, the dash set a timer after which one isInvincible is set back to 0 by calling stopInvincibility().

Now let’s replace those functions to always keep isInvincible active :

1
2
3
4
5
6
7
8

window.gameRef.scene.keys.Game.player.stopDash = function() {
  	this.isDashing = !0,
    this.stopAfterImage()
};

window.gameRef.scene.keys.Game.player.stopInvincibility = function () {
  	this.isInvincible = !0
};

And it works, but I can’t move and I don’t know why (I’m too lazy to investigate) :

Conclusion

In the end, it wasn’t much difficult to cheat in this game even though some functions were renamed and made less understable. As PhaserJS is a client side engine, I managed to cheat on other games the same way, sometimes easily and sometimes not.

I still cannot find a way to script my cheats with tool like tampermonkey as I have to use the debugger (if someone have an idea, I’m all ears : wepfen on Discord).

References

• Hacking the Chrome Dino Game
• Hacking JavaScript Games - Accessing private javascript variables at runtime via debugging
• PhaserJS
• https://www.ladouille.fr/