YesNoOk
avatar

Redirects of Redirects and New Redirects. Cond() Exploit (Read 62089 times)

Started by inktrebuchet, January 30, 2019, 04:27:22 pm
Share this topic:
Redirects of Redirects and New Redirects. Cond() Exploit
#1  January 30, 2019, 04:27:22 pm
  • ****
    • USA
    • twitter.com/inktrebuchet
I ran into David11 yesterday and he shared a line of code with me, now I’m exploring that more and sharing it here. These all have to do with the implementation of cond() in 1.0 and 1.1b. *also works in IKEMEN . David11 explains more here.

Note:
-This is a undocumented feature, possibly a bug, now known as the cond() exploit.
-There is no guarantee this will not be changed in future MUGEN releases.
-The examples below mainly show 'enemy' as the first redirect but any of these redirects can be redirected.
- A study on some limitations of cond() exploit. Mainly on helper vs root delay.
Elecbyte's documentation said:
Note: recursive redirection (e.g., "root,target,time") is not supported.

Redirects of Redirects Examples:

Redirect a Redirect
*Same as: Enemy, Helper, ID ;if it were possible.
Code:
Enemy, Cond(NumHelper, Helper, Cond(1, ID, 0), 0) 
;returns enemy’s first available helper’s player ID
Code:
Enemy, Cond(NumHelper, Helper, Cond(1, ID = 99, 0), 0) 
;returns 1 if true.
Code:
Enemy, Cond(NumHelper, Helper, Cond(1, ID, 0), 0) = 99 
;also returns 1 if true.


Set Enemy's Vars
*Same as: Enemy, Var(?) := ? ;if it were possible.
Code:
Enemy, Cond(1, Var(GameTime%60) := 0, 0)
Enemy, Cond(1, FVar(GameTime%40) := 0, 0)
;sets all of enemy’s root vars and fvars to 0.
David11 said:
but because of priority, p1 sets player2 vars to 0, p2 sets vars to normal value in the same tick if the vars are refreshed every tick.


Set Enemy Helper's Vars.
*Same as: Enemy, Helper(?), Var(?) := ? ;if it were possible.
*must know helper(id)
Code:
Enemy, Cond(NumHelper(33333333), Helper(33333333), Cond(1, Var(0) := 999, 0), 0)



New Redirect Examples:

Set Your Helper's Var From Root. No Lag
*Same as: Helper(?), Var(?) := ? ;if it were possible.
*Anything in Cond() should be written as it would be in the helper. If redirects are need in a helper they are needed here also.
Code:
Cond(NumHelper(33333333), Helper(33333333), Cond(1, Var(0) := 999, 0), 0)
Spoiler: Lag Test (click to see content)


Use Root,Time = 0 in Helper Without Using a Root Var
*requires one helper var.
This goes in [statedef -2]
Code:
[state time] ;Set your helper Var from root, to match root,time.
type = null
trigger1 = Cond(NumHelper(33333333), Helper(33333333), Cond(1, Var(15) := root,time, 0), 0)
ignorehitpause = 1
This goes in helper
Code:
Trigger1 = var(15) = 0 ; acts as Root,time = 0

Helper reads root target's time
*Same as: root,target,time ;if it were possible
Code:
Root, Cond(NumTarget, Target, Cond(1, time, 0), 0) 

Last Edit: August 13, 2019, 03:03:15 pm by ink
Re: Redirects of Redirects and New Redirects.
#2  February 12, 2019, 08:58:32 pm
  • *
  • --
    • Brazil
    • psychoctrl@gmail.com
Late reply, but adding more to it:

Explaining a bit on how it actually works, without any of the examples Ink posted.

Cond was made with the intention to get information out of the source, check if its true/false and return a or b

Code:
Cond( Condition, a, b)
Cond( Condition = true, return a, b)
Cond( Condition = false, a, return b)

(IfElse works similarly but won't work for this kind of application).


with that in mind you can almost see how it works

If I Write

Code:
Cond(1, ID, 0)

100% of the time, that code will get me the ID value, since the info that cond is checking is ‘1’, which means ‘true’, it will return the id. if 1 would be considered ‘false’ then it would return 0 (but that won’t happen. (Unless you’re from a parallel universe lol).

But, why would you use cond that way? because all we care about its the “return a - b” scenario.

The other way around to do that would be by writing:
Code:
Cond(0, 0, ID)

this will prefetch the b-data.

and using that with other instances inside mugen, give you the same. Catch my thought yet?

What if we could get the id of a helper that’s attacking the player in just 1 line?
We need to do as it follows:
-Check if there’s a player nearby
-Check if that same player, has an active helper with attacking properties
-If everything above is true - return it’s ID.

 Coding that in game:

Cond(NumEnemy,
Cond(Enemy, NumHelper,
Cond(Helper, MoveType = A
Return ID.

I’ve separated just so you get the jist of it.

Lost?

All we are doing is redirecting data inside other objects(players/helpers) until it gets to the object you need. Its like a chain of redirects that go 1 by 1, until it reaches it's destination. That's why there's cond on top of conds.


The var setting using the := operator also works using this method:

Code:
Helper(200), Cond(1, Var(10) := 1, 0)

This will set the var 10 of that Helper(200) to 1. Remember that, mugen works like this:

Check condition > if true, apply whatever effect from whatever sctrl; While true, do not check for any more objects that this is not true.

What does that mean in practice? That’s gonna check for the first spawned helper(200), and set its var while the helper is ingame. if by any chance another helper 200 is summoned. it won’t get the same effect as long as the first helper is still there. To overcome this problem, there’s a lot of different solutions. I’ll leave that as an open topic.



This exploit was found in mid-ish 2018. Me and a couple of friends have stress tested this and we can say it's totally reliable. (As long as you know how to use it, and you're fully aware of how mugen checks conditions).

Funny enough, Electbyte coded Cond, because IfElse had problems with how it had try to check the conditions, and to fix that they created Cond, which makes it possible to cross-redirect any type of data in between all available ids. Helper from your team or not, it can be accessed and their info can be checked directly from any id without any kind of hacking code that would only work on full games. IfElse on the other hand, can't be used to do that. It wont work.

Also it’s kinda weird that i've just came across this exploit 10 years later since the first time Cond was actually introduced but oh well.
Re: Redirects of Redirects and New Redirects.
#3  February 12, 2019, 09:19:41 pm
  • ******
  • A living Mugen dinossaur :)
  • 23 years of Mugen O_o
    • Brazil
    • www.brazilmugenteam.com
Oh, this sounds really useful.
Re: Redirects of Redirects and New Redirects.
#4  February 12, 2019, 11:54:12 pm
  • ****
  • it's me
  • Bat's a Wrap.
    • Chile
    • koakoa@jabber.org
    • Skype - koakumadevil69
This is an amazing breakthrough! My biggest question is though, would this exploit work in IKEMEN?
Yeaaaah im shootign ducks wiht the paino
Re: Redirects of Redirects and New Redirects.
#5  February 13, 2019, 05:08:13 pm
  • *****
  • Thanks and God bless
    • USA
    • ricepigeon.neocities.org
Did some testing with jade_midori last night and we both confirmed this to work in IKEMEN, with the exception that it doesn't affect the additional sysvars that Ikemen uses to handle constants (such as life, maxlife, power, etc) or, at the very least, that the values for these vars are precached before the match begins:



Since we did this in a closed fullgame environment, we knew what each character used its variables for, so using this trick it became possible to redirect the opponent's projectiles remotely (albeit only the first one in cases of multiple projectile attacks). This could theoretically be used to create a poison effect without having to make any sort of contact with the opponent (ie: a gas cloud). Of course, this would only work with dedicated variables in a fullgame environment, but I'm sure there are other practical applications of this.

Additionally, this method would also render using projectile state controllers as makeshift logic flags obsolete.
Last Edit: February 13, 2019, 05:11:30 pm by Ricepigeon
Re: Redirects of Redirects and New Redirects.
#6  February 17, 2019, 10:21:59 pm
  • ****
    • USA
    • twitter.com/inktrebuchet
I'm glad to hear these work for IKEMEN too!

I don't use IKEMEN normally but from my testing it already supported recursive redirection. So any IKEMEN creations taking advantage of recursive redirection will now work in 1.0 or 1.1 if they are written in this way.

IKEMEN ONLY:
Code:
[state n] ;IKEMEN test
type = DisplayToClipboard
trigger1 = 1
trigger1 = enemy,var(0) := var(0) + 1 ;IKEMEN only, not compatible with MUGEN
text="%d"
params = enemy,var(0)
Last Edit: February 17, 2019, 10:50:35 pm by ink
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#7  August 26, 2019, 09:36:25 am
  • *****
  • Resident Tosspot
  • Pftheh
    • UK
    • plasmoidthunder.neocities.org
Perhaps I am doing something incorrectly, but it appears as though using a trigger that returns a text value (name, command, etc.) with this exploit crashes MUGEN without error, so attempting to do the equivalent of root,target,name does not work.

Oh, I want a diagram. I fucking love diagrams.
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#8  August 27, 2019, 07:11:19 pm
  • ****
    • USA
    • twitter.com/inktrebuchet
I haven't had any trouble getting that one to work. here is how I wrote it.
Code:
[state n]
type = null
trigger1 = Root, Cond(NumTarget, Target, Cond(1, name = "urien", 0), 0)

Using command = " " will give you an error if that command doesn't exist. just as it would anyother time using redirects.

One that I have come across that doesn't work as expected is this:
Code:
[state n]
type = null
trigger1 = Root, Cond(NumTarget, Target, Cond(1,var(0) = [0,20], 0), 0)
[0,20] causes an error so it should instead be written like this:
Code:
[state n]
type = null
trigger1 = Root, Cond(NumTarget, Target, Cond(1,var(0) ,0), 0) = [0,20]

Last Edit: August 27, 2019, 07:14:26 pm by ink
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#9  August 27, 2019, 08:34:08 pm
  • *****
  • Resident Tosspot
  • Pftheh
    • UK
    • plasmoidthunder.neocities.org
Ah, I was writing the value outside the cond. Thanks.

Oh, I want a diagram. I fucking love diagrams.
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#10  August 28, 2019, 08:03:39 am
  • **
  • Sr. Símio Enfermo
    • Brazil
    • www.mediafire.com/folder/utha9mw5dg7tn/My_Chars
It works that way too:
Code:
[state n]
type = null
trigger1 = Root, Cond(NumTarget, Target, Cond(1,(var(0) = [0,20]), 0), 0)
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#11  August 28, 2019, 11:45:48 am
  • *****
  • Resident Tosspot
  • Pftheh
    • UK
    • plasmoidthunder.neocities.org
Yeah, with square brackets, MUGEN often requires you to wrap them in parentheses or it'll have a hissy-fit.

Oh, I want a diagram. I fucking love diagrams.
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#12  September 01, 2019, 12:57:29 am
  • ****
    • USA
    • twitter.com/inktrebuchet
Mason Rees I'm glad you found that! I never thought to try it that way. Thanks for posting it here.

I'm going to slip this one in that I found the other day, when thinking about a new reflector type code. This would go in your projectile(Helper(1005)) and write to your target's var(0), letting them know what helper hit them. Long story short, this piece of code was written to ensure the same projectile wasn't reflected twice. Maybe someone will find some use in the example.
Code:
trigger1 = numtarget ; contact
;tell your target what your id is.
trigger1 = target,cond(1,var(0):= Enemy(cond(enemy(0), Cond(NumHelper(1005), Helper(1005), Cond(numtarget, target, cond(1, ID, 0), 0), 0) = ID, 0, cond(enemy(1), Cond(NumHelper(1005), Helper(1005), Cond(numtarget, target,cond(1 ,ID , 0), 0), 0) = ID, 1, 2))), Cond(NumHelper(1005), Helper(1005), Cond(1, ID, 0), 0), 0)
Last Edit: September 01, 2019, 01:28:41 am by ink
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#13  March 09, 2020, 03:15:06 am
  • avatar
  • **
    • Vietnam
Late reply, but adding more to it:

Explaining a bit on how it actually works, without any of the examples Ink posted.

Cond was made with the intention to get information out of the source, check if its true/false and return a or b

Code:
Cond( Condition, a, b)
Cond( Condition = true, return a, b)
Cond( Condition = false, a, return b)

(IfElse works similarly but won't work for this kind of application).


with that in mind you can almost see how it works

If I Write

Code:
Cond(1, ID, 0)

100% of the time, that code will get me the ID value, since the info that cond is checking is ‘1’, which means ‘true’, it will return the id. if 1 would be considered ‘false’ then it would return 0 (but that won’t happen. (Unless you’re from a parallel universe lol).

But, why would you use cond that way? because all we care about its the “return a - b” scenario.

The other way around to do that would be by writing:
Code:
Cond(0, 0, ID)

this will prefetch the b-data.

and using that with other instances inside mugen, give you the same. Catch my thought yet?

What if we could get the id of a helper that’s attacking the player in just 1 line?
We need to do as it follows:
-Check if there’s a player nearby
-Check if that same player, has an active helper with attacking properties
-If everything above is true - return it’s ID.

 Coding that in game:

Cond(NumEnemy,
Cond(Enemy, NumHelper,
Cond(Helper, MoveType = A
Return ID.

I’ve separated just so you get the jist of it.

Lost?

All we are doing is redirecting data inside other objects(players/helpers) until it gets to the object you need. Its like a chain of redirects that go 1 by 1, until it reaches it's destination. That's why there's cond on top of conds.


The var setting using the := operator also works using this method:

Code:
Helper(200), Cond(1, Var(10) := 1, 0)

This will set the var 10 of that Helper(200) to 1. Remember that, mugen works like this:

Check condition > if true, apply whatever effect from whatever sctrl; While true, do not check for any more objects that this is not true.

What does that mean in practice? That’s gonna check for the first spawned helper(200), and set its var while the helper is ingame. if by any chance another helper 200 is summoned. it won’t get the same effect as long as the first helper is still there. To overcome this problem, there’s a lot of different solutions. I’ll leave that as an open topic.



This exploit was found in mid-ish 2018. Me and a couple of friends have stress tested this and we can say it's totally reliable. (As long as you know how to use it, and you're fully aware of how mugen checks conditions).

Funny enough, Electbyte coded Cond, because IfElse had problems with how it had try to check the conditions, and to fix that they created Cond, which makes it possible to cross-redirect any type of data in between all available ids. Helper from your team or not, it can be accessed and their info can be checked directly from any id without any kind of hacking code that would only work on full games. IfElse on the other hand, can't be used to do that. It wont work.

Also it’s kinda weird that i've just came across this exploit 10 years later since the first time Cond was actually introduced but oh well.

A bit more additional note is if you want the helper to use the root var but the caller of this operation is not from the helper but root instance. You may to use this:

[State -2]
type = null
triggerall = !ishelper ;Owner is not the helper, by all mean is Root himself.
trigger1 = 1||fvar(36):=... ;assign value to fvar(36).
trigger1 = 1||cond(numhelper(...),(helper(...),cond(1,fvar(36):=root,fvar(36),0)),0) ;THIS WILL TELLING THE HELPER TO TAKE HIS ROOT'S FVAR(36)

This is very useful in some advance technique like sending the damage back to the enemy who hit him.
You can also do the same trick in reverse caller sign. Also you can do the same if you want sending the value to enemy's helper without a custom state.
------Tremble Mortal and Despair. Doom has come to this world------
Last Edit: March 09, 2020, 03:21:12 am by Archimonde
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#14  May 23, 2020, 09:08:12 pm
  • avatar
    • Venezuela
Hi guys, I have tried the code in different ways but it never returns the helper's iD, why would it be?
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#15  June 16, 2020, 10:08:22 pm
  • ****
    • USA
    • twitter.com/inktrebuchet
You'll have to be much more specific. Which helper's ID are you trying to get etc.

feel free to post the code you have tried and I'm sure we can help you with it. *Sorry for the late reply
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#16  July 06, 2020, 12:00:48 pm
  • avatar
  • **
    • Vietnam
Hi guys, I have tried the code in different ways but it never returns the helper's iD, why would it be?

Helper ID or Helper's playerID.
HelperID like helper(123): helper with an ID 123
Helper's player ID is an ID which be generated by an engine itself and it CANNOT be assign by your own code.
------Tremble Mortal and Despair. Doom has come to this world------
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#17  July 23, 2020, 03:06:26 am
  • avatar
    • Venezuela
You'll have to be much more specific. Which helper's ID are you trying to get etc.

feel free to post the code you have tried and I'm sure we can help you with it. *Sorry for the late reply

I was trying to get what david11 was saying, I was looking for the id number of a helper that had attack properties with a hitdef attr: SAC, SA. but it returned the id of the player.
Re: Redirects of Redirects and New Redirects. Cond() Exploit
#18  July 28, 2020, 03:31:00 am
  • ****
    • USA
    • twitter.com/inktrebuchet
That one is a little tricky unless you know the helper(id). The two example below will return the helper's PlayerID as long as it's the only helper the enemy has spawned. if more than one helper is spawned by the enemy, these codes will only check the first helper unless you know the helper(id).

Code:
;returns enemy,helpers player id (if enemy helper exists)
Enemy, Cond(NumHelper, Helper, Cond(1, ID, 0), 0)

;returns enemy,helpers player id if hitdefattr = SAC, SA (if enemy helper exists)
Enemy, Cond(NumHelper, Helper, Cond(hitdefattr = SAC, SA, ID, 0), 0)

This one will only return the playerid if you know the enemy helper(id) ahead of time.
Code:
;returns enemy,helper(1234) player id (if enemy helper(1234) exists)
Enemy, Cond(Numhelper(1234), helper(1234), Cond(1, ID, 0), 0)


If you are looking to check every enemy helper for a specific hitdefattr and you don't know the helper(id) you can checkout this code. It checks each playerid for a specific hitdefattr as they spawn.
https://mugenguild.com/forum/msg.2351100

Hopefully one of these helps out but just let me know if that's not what you're looking for.