Redirects of Redirects and New Redirects. Cond() Exploit (Read 1785 times)

Started by ink, January 30, 2019, 04:27:22 pm
Share this topic:


Redirects of Redirects and New Redirects. Cond() Exploit
New #1  January 30, 2019, 04:27:22 pm
  • ****
  • inktrebuchet
    • USA
I ran into David11 yesterday and he shared a line of code with me, now I’m exploring that more and sharing it here. These all have to do with the implementation of cond() in 1.0 and 1.1b. *also works in IKEMEN . David11 explains more here.

-This is a undocumented feature, possibly a bug, now known as the cond() exploit.
-There is no guarantee this will not be changed in future MUGEN releases.
-The examples below mainly show 'enemy' as the first redirect but any of these redirects can be redirected.
Elecbyte's documentation said:
Note: recursive redirection (e.g., "root,target,time") is not supported.

Redirects of Redirects Examples:

Redirect a Redirect
*Same as: Enemy, Helper, ID ;if it were possible.
Enemy, Cond(NumHelper, Helper, Cond(1, ID, 0), 0) 
;returns enemy’s first available helper’s player ID
Enemy, Cond(NumHelper, Helper, Cond(1, ID = 99, 0), 0) 
;returns 1 if true.
Enemy, Cond(NumHelper, Helper, Cond(1, ID, 0), 0) = 99 
;also returns 1 if true.

Set Enemy's Vars
*Same as: Enemy, Var(?) := ? ;if it were possible.
Enemy, Cond(1, Var(GameTime%60) := 0, 0)
Enemy, Cond(1, FVar(GameTime%40) := 0, 0)
;sets all of enemy’s root vars and fvars to 0.
David11 said:
but because of priority, p1 sets player2 vars to 0, p2 sets vars to normal value in the same tick if the vars are refreshed every tick.

Set Enemy Helper's Vars.
*Same as: Enemy, Helper(?), Var(?) := ? ;if it were possible.
*must know helper(id)
Enemy, Cond(NumHelper(33333333), Helper(33333333), Cond(1, Var(0) := 999, 0), 0)

New Redirect Examples:

Set Your Helper's Var From Root. No Lag
*Same as: Helper(?), Var(?) := ? ;if it were possible.
*Anything in Cond() should be written as it would be in the helper. If redirects are need in a helper they are needed here also.
Cond(NumHelper(33333333), Helper(33333333), Cond(1, Var(0) := 999, 0), 0)
Spoiler: Lag Test (click to see content)

Use Root,Time = 0 in Helper Without Using a Root Var
*requires one helper var.
This goes in [statedef -2]
[state time] ;Set your helper Var from root, to match root,time.
type = null
trigger1 = Cond(NumHelper(33333333), Helper(33333333), Cond(1, Var(15) := root,time, 0), 0)
ignorehitpause = 1
This goes in helper
Trigger1 = var(15) = 0 ; acts as Root,time = 0

Helper reads root target's time
*Same as: root,target,time ;if it were possible
Root, Cond(NumTarget, Target, Cond(1, time, 0), 0) 

Last Edit: June 02, 2019, 08:32:41 pm by ink
Re: Redirects of Redirects and New Redirects.
#2  February 12, 2019, 08:58:32 pm
  • *
  • --
    • Brazil
Late reply, but adding more to it:

Explaining a bit on how it actually works, without any of the examples Ink posted.

Cond was made with the intention to get information out of the source, check if its true/false and return a or b

Cond( Condition, a, b)
Cond( Condition = true, return a, b)
Cond( Condition = false, a, return b)

(IfElse works similarly but won't work for this kind of application).

with that in mind you can almost see how it works

If I Write

Cond(1, ID, 0)

100% of the time, that code will get me the ID value, since the info that cond is checking is ‘1’, which means ‘true’, it will return the id. if 1 would be considered ‘false’ then it would return 0 (but that won’t happen. (Unless you’re from a parallel universe lol).

But, why would you use cond that way? because all we care about its the “return a - b” scenario.

The other way around to do that would be by writing:
Cond(0, 0, ID)

this will prefetch the b-data.

and using that with other instances inside mugen, give you the same. Catch my thought yet?

What if we could get the id of a helper that’s attacking the player in just 1 line?
We need to do as it follows:
-Check if there’s a player nearby
-Check if that same player, has an active helper with attacking properties
-If everything above is true - return it’s ID.

 Coding that in game:

Cond(Enemy, NumHelper,
Cond(Helper, MoveType = A
Return ID.

I’ve separated just so you get the jist of it.


All we are doing is redirecting data inside other objects(players/helpers) until it gets to the object you need. Its like a chain of redirects that go 1 by 1, until it reaches it's destination. That's why there's cond on top of conds.

The var setting using the := operator also works using this method:

Helper(200), Cond(1, Var(10) := 1, 0)

This will set the var 10 of that Helper(200) to 1. Remember that, mugen works like this:

Check condition > if true, apply whatever effect from whatever sctrl; While true, do not check for any more objects that this is not true.

What does that mean in practice? That’s gonna check for the first spawned helper(200), and set its var while the helper is ingame. if by any chance another helper 200 is summoned. it won’t get the same effect as long as the first helper is still there. To overcome this problem, there’s a lot of different solutions. I’ll leave that as an open topic.

This exploit was found in mid-ish 2018. Me and a couple of friends have stress tested this and we can say it's totally reliable. (As long as you know how to use it, and you're fully aware of how mugen checks conditions).

Funny enough, Electbyte coded Cond, because IfElse had problems with how it had try to check the conditions, and to fix that they created Cond, which makes it possible to cross-redirect any type of data in between all available ids. Helper from your team or not, it can be accessed and their info can be checked directly from any id without any kind of hacking code that would only work on full games. IfElse on the other hand, can't be used to do that. It wont work.

Also it’s kinda weird that i've just came across this exploit 10 years later since the first time Cond was actually introduced but oh well.
Re: Redirects of Redirects and New Redirects.
#3  February 12, 2019, 09:19:41 pm
  • ******
  • Master of Jankness
  • 15 years of MFG, geez...
    • Brazil
Oh, this sounds really useful.
Re: Redirects of Redirects and New Redirects.
#4  February 12, 2019, 11:54:12 pm
  • ****
  • it's me
  • Maybe something different
    • Chile
    • Skype - koakumadevil69
This is an amazing breakthrough! My biggest question is though, would this exploit work in IKEMEN?
Re: Redirects of Redirects and New Redirects.
#5  February 13, 2019, 05:08:13 pm
  • *****
  • Gaps? Where we're going, we don't need gaps...
    • USA
Did some testing with jade_midori last night and we both confirmed this to work in IKEMEN, with the exception that it doesn't affect the additional sysvars that Ikemen uses to handle constants (such as life, maxlife, power, etc) or, at the very least, that the values for these vars are precached before the match begins:

Since we did this in a closed fullgame environment, we knew what each character used its variables for, so using this trick it became possible to redirect the opponent's projectiles remotely (albeit only the first one in cases of multiple projectile attacks). This could theoretically be used to create a poison effect without having to make any sort of contact with the opponent (ie: a gas cloud). Of course, this would only work with dedicated variables in a fullgame environment, but I'm sure there are other practical applications of this.

Additionally, this method would also render using projectile state controllers as makeshift logic flags obsolete.
Last Edit: February 13, 2019, 05:11:30 pm by Ricepigeon


Re: Redirects of Redirects and New Redirects.
New #6  February 17, 2019, 10:21:59 pm
  • ****
  • inktrebuchet
    • USA
I'm glad to hear these work for IKEMEN too!

I don't use IKEMEN normally but from my testing it already supported recursive redirection. So any IKEMEN creations taking advantage of recursive redirection will now work in 1.0 or 1.1 if they are written in this way.

[state n] ;IKEMEN test
type = DisplayToClipboard
trigger1 = 1
trigger1 = enemy,var(0) := var(0) + 1 ;IKEMEN only, not compatible with MUGEN
params = enemy,var(0)
Last Edit: February 17, 2019, 10:50:35 pm by ink