Puzzle Bots Hack
Mirthe Luria
Puzzle Bots is a graphic adventure developed by Ivy Games and published by Wadjet Eye Games. The game uses a point and click interface to interact with the environment to solve puzzles and communicate with characters.
The game received above-average reviews according to the review aggregation website Metacritic.[2] Gamezebo called it "An incredibly charming adventure, packed with plenty of humor and some deviously clever puzzles."[5] Adventure Gamers also praised the game's "great mix of bot abilities and [...] charming story".[3]
In 1999, Ari Juels and John Brainard came up with an elegant protection against denial of service attacks, known as the client-puzzle protocol. Their idea was patented (US patent 7197639), which might have inhibited its uptake. However that patent expired in early 2020, so it is now free for anybody to use. And it should be used.
The client-puzzle protocol is not widely known or implemented, but we do note that Akamai picked up the concept very soon after the patent expired for their bot manager. Akamai adds advanced intelligence to it (remark: it appears that Clouflare may be doing the same, see also Kasada), but the basic client-puzzle protocol is easy to implement and can be used by anybody without spending a dime.
The objective in the client-puzzle protocol is to slow down bots so that they become near the speed of humans. Slowing them down impedes a number of different attacks, such as web scraping, brute forcing, and certain types of denial-of-service.
In this construct, two levels of hashing are used. First, the client request data (query parameters/request body) along with a server-side secret and timestamp are hashed. This produces hash h1, which is hashed to produce hash h2. The puzzle consists of h2 and most of the bits of h1.
In the client-puzzle protocol, h2 and most of the bits of h1 are given to the client. The client must brute force the remaining bits. When the client succeeds, it sends back the puzzle solution (h1), the timestamp that the server provided, and the request data.
Now consider how the server verifies the result. This is the most elegant part because the server does not need to remember h2. Instead, it just recomputes h1 by hashing its secret along with the client provided request data and timestamp. If the hash matches what the client provided, then the puzzle is solved!
Clients cannot forge fake puzzles as long as they do not know the server secret. Attempts at providing fake puzzles are easily caught and rejected from the computation just described. This computation is quick and easy to do for the server: a single hash computation with no database usage. Similarly, clients cannot lie about the timestamp because the hash computation will not check out.
I am not a professional programmer and I am just learning Node.js, but despite that it was little effort for me to build a proof of concept. You can see the source code on GitHub. This PoC takes user input for a search query and returns a random gif from Giphy related to the search query. The server side uses a Giphy API key. By using client-puzzle protocol, clients need to do a computation every time a request is made through the server to Giphy, which controls the number of requests going to Giphy through the server.
The main functions on the server side are compute_puzzle( ), which computes the puzzle from the original request, and check_puzzle_solution( ), which verifies the solution. The client side has code to brute force the puzzle solution.
The client-puzzle protocol handles the uncertainty much better by requiring every client to solve a puzzle. Legitimate users (people) do not make numerous requests per second, so they will see little impact. Malicious bots on the other hand will see a huge impact because they are forced to do computations for each of their numerous requests, and that builds up. With the client-puzzle protocol, making requests is no longer free.
Remark: Although it will reduce impact, the client-puzzle protocol is not by itself strong enough to prevent credential stuffing attacks because the attacker has a significant probability of success per request. For a more appropriate defence, see our OT2FA blog. The client-puzzle protocol does help impede other forms of brute force where the likelihood of success per request is smaller.
One of the shortcomings of the client puzzle protocol is that the attacker might have significant more computational resources than legitimate users. This is known as the resource disparity problem. Guided Tour Puzzle Protocols were designed to address this disparity. I have not yet researched their practicality or intellectual property considerations.
It always slows bots down. How much bang you get for your buck depends upon other factors such as the speed you will tolerate for the most primitive device you support and whether you used any of the enhancements suggested here. It is of most benefit when there are a large number of calls a bot needs to make to be successful.
And I did really like the characters in this game. The humans are cartoony and somewhat archetypal but have enough nerdy, game-informed quirks to make them endearing. The voicework is consistently good. The robots did not feel quite as fleshed out as the ones in Nanobots personality-wise, but were nonetheless cute and chirpy and pretty hard not to like.
Ive played this game between 2003-2013 and ive recently come back. Theres always been a bot issue. And ive always wondered, what do you mean when you say you use bots? What does it look like? And why cant they solve it? Is it like you open the puzzle and visibly you can see the puzzle pieces get moved like its taken control of your mouse? Or is it just to change what duty report shows? Not gonna use bots just genuinely curious.
An infectious sense of humor defines the game, with all 5 robots (Hero, Ultrabot, Kelvin, Ibi and Bombchelle) and their quirky inventors providing tons of comic relief throughout. We see this in both the puzzle designs and some extremely funny dialogue.
Created by award-winning indie designer Erin Robinson, PuzzleBots is a light-hearted adventure guaranteed to make you chuckle.The fun begins when Zander (who is possibly the world's mostabsent-minded inventor) trips over a metal box buried outside ofDr. Hugo's Factory for Making Robots. When he and his colleaguescan't figure out how to open it, their "offspring" -- five tinyrobots, each with a unique puzzle-solving skill -- sneak out andtry it for themselves. What they discover is the first step to agrand adventure, leading to a mystery as old as the factoryitself.
Puzzle Bots can be downloaded through Steam for $4.99USD /3.49GBP / 4.49EUR. The game is also available directly frompublisher Wadjet Eye Games at -bots.com, where the price hasbeen permanently lowered to $4.99 as well.
for the last few months i have been creating a new bot called Bastet. It is a multi-purpose bot for Empires and Puzzles Discord servers, it is already on 30+ servers and i think it is finally ready to be shared here on the forum too. Bastet uses the new slash command system that Discord started enforcing on bots at September 2022, so it works a bit differently than many previous enp bots.
One day they stumble onto an evil plan Dr. Hugo has in mind for the factory. They have to solve the mystery before he stops them in their tracks. The player takes control of each of the robots in turn, switching freely between them to get past the various hurdles.
There are a few nagging minor bugs in the game so watch out.
The Bottom Line
If you're after quick and fun game with easy to solve puzzles than this title is for you. Some of the characters can be a real hoot, but the voice acting isn't anything special. Good product but don't expect any replay value afterwards.
One of the robots can only pick up items, another only pushes heavy objects, while the the rest can perform abilities such as swimming or using a flamethrower. Each robot has its own personality and take on the outside world, and their interactions with each other are a highlight.
Yuriko has a crush on Zander, but he's too wrapped up in pre-bought candy bars to notice. Viktor hates his job and is trying to get fired. And Doctor Hugo may be up to something more sinister than creating the world's most fabulous lab coat. Sound like a soap opera? Not quite. It's Puzzle Bots from Wadjet Eye Games, a point-and-click puzzle adventure that proves it's not the size of your gears that counts.
Zander is one of "nearly four" inventors employed in Dr Hugo's Factory For Making Robots, and possibly the most addle-brained of the lot. Unlike his fellow inventors who try to create robots designed for chores, Zander's made Hero, a tiny yellow bot with what one might consider to be an unhealthy interest in "adventure" and a knack for dragging his fellow robots into trouble. Of course, it's all fun and games until he and his friends end up stumbling across a secret that one person will do anything to keep... with some aggressive presidential help.
Although you initially only have control over Hero, as the other inventors complete their work new robots are added to the group, all with their own special abilities. You've got Ultrabot, who is the best at pushing things. Kelvin, who is the best at setting things on fire (although he'd really rather not be). Ibi, the little robotic mermaid, and Bomchelle, the hot-pink roller skater with an endless supply of explosives. While originally created to "do chores", each robot will come in handy as you attempt to solve a wide variety of weird puzzles to progress. You can swap between them simply by clicking on the robots themselves, or on their names at the bottom of the screen.
Analysis: Although the focus here is on solving the various puzzles instead of interacting with other characters, which is a departure from previous titles from the developers, Puzzle Bots still features a lot of dialogue. Most of it very funny. There's an oddball, vaguely Futuramaesque vibe to the whole thing that makes it a real joy to play. I might have preferred more interaction with the humans in the group; clearly the stars of the show are the miniature robots, and they do the job well, but we're supposed to care about what happens to their human counterparts as well. Some of the inventors simply do not get enough screen time, which is a shame since they're almost always funny when they're around. (Such as one of my favourite scenes involving opening a window despite the fear that "nature might get in".)
aa06259810