Grand Larceny Auto — Robbing a Vault That Won't Give You Six Stars

shadowe1ite — Sat, 22 Aug 2026 00:00:00 +0000

the setup</h2>

This was tagged as a game hacking challenge, so the first thing I did was just play it.

It’s a small GTA parody called Grand Larceny Auto. You drive around, steal cars, knock over traffic cones, and your wanted level goes up. There’s a big VAULT sign — walk up, press F, and it says you need six stars. The catch is the game stops you at five.

So the whole thing is: get six stars when the game won’t let you.

poking at it first</h2>
Unzip it and look around.
unzip -q GrandLarcenyAuto-windows-*.zip cd GrandLarcenyAuto-windows ls</code></pre>GrandLarcenyAuto.exe ~105 MB GrandLarcenyAuto.pck 2.3 KB data_GrandLarcenyAuto_windows_x86_64/ 188 files</code></pre> A huge exe with a tiny .pck</code> is a Godot export. The data_/</code> folder is a bundled .NET runtime (coreclr.dll</code>, GodotSharp.dll</code>, and so on), so it’s Godot with C#. One file stands out from the 188: data_.../GrandLarcenyAuto.dll 93 KB</code></pre> That’s the game. Since it’s a .NET assembly, I decompiled it with ILSpy: export DOTNET_ROOT="$HOME/.dotnet" export PATH="$HOME/.dotnet:$HOME/.dotnet/tools:$PATH" export DOTNET_ROLL_FORWARD=LatestMajor ilspycmd -p -o ./decompiled \ "data_GrandLarcenyAuto_windows_x86_64/GrandLarcenyAuto.dll"</code></pre> The class names survived (WantedSystem</code>, SafehouseVault</code>, CryptoUtil</code>, PlayerState</code>), so it was easy to find the interesting stuff. But the method bodies are ConfuserEx-obfuscated — control-flow flattening, so every method is a while (true) { switch ((num ^ 0x...) % N) }</code> state machine with a bunch of junk arithmetic. Readable, but annoying. Here’s the raw SafehouseVault</code>: public string TryOpen() { if (player.WantedStars >= 6) { while (true) { int num = -399529747; while (true) { switch ((uint)(num ^ 0xD4D51D3A) % 6) { case 1u: array = CryptoUtil.DeriveKey(player.WantedStars); num = ...; continue; case 3u: array2 = CryptoUtil.Xor(SealedBlob, array); ... num = ...; continue; // ...more fake states... } } } } return "...shut..."; }</code></pre> The num =</code> lines are all dead — they just pick the next fake state. I fed the obfuscated dump to an LLM and asked it to strip the control-flow junk into plain pseudocode, which gave me this: // WantedSystem — the cap public void EscalateHeat(int amount) { int s = player.WantedStars + amount; if (s > 5) s = 5; // you can never go past five player.WantedStars = s; } // SafehouseVault — the door if (player.WantedStars < 6) return "The vault stays shut. (You need SIX stars.)";</code></pre> WantedStars</code> is just a normal int</code>. The only thing keeping me at five is that if (s > 5)</code>. Normal play never puts a 6 in there, but nothing stops me from writing it myself while the game runs. No patching, no rebuilding — just change the number in memory. So, Cheat Engine. There’s a cheat console in the game (press K</code>) that spits out a THM{...}</code> string. It’s a decoy — it ends in _4r3_f0r_t0ur1sts</code>. Ignore it, the real flag comes from the vault. </blockquote> opening the vault with Cheat Engine</h2> Start the game, then attach Cheat Engine to it. WantedStars</code> is a 4-byte int and I don’t know its address, so I let the game find it for me by scanning for the number on the HUD and narrowing down. 1. Scan type 4 Bytes, Exact Value, type my current star count (0</code> at spawn), then First Scan. Thousands of hits — that’s fine. 2. Commit one crime, boot a traffic cone. Stars go to 1</code>. Back in Cheat Engine, Next Scan for 1</code>. 3. Do that a few more times. Each scan drops the addresses that didn’t move with my stars, so the list shrinks fast. after a few rounds you’re down to one or two. 4. Double-click the one that’s left to add it to the table, then the only thing that really matters: set it to exactly 6. I tick freeze too, so the game can’t drop it back down while I walk over. 5. Walk to the vault and press F. THE VAULT SWINGS OPEN Six stars. All you had to do was rob the dang vault. FLAG: THM{...}</code></pre> Done. The flag (hover to reveal): THM{h0tf1x3d_my_0wn_w4nt3d_l3v3l}</code> I ran Cheat Engine itself under Wine. If you’d rather stay native on Linux, scanmem / GameConqueror does the exact same job against the wine process: 4 bytes, scan, next-scan on change, set to 6. </blockquote> wrap up</h2> I don’t have a Windows machine, so I ran the whole thing under Wine and cracked it with Cheat Engine. It was a good learning experience. thanks for reading.

shadowe1ite - godot

Grand Larceny Auto — Robbing a Vault That Won't Give You Six Stars

wrap up</h2>
I don’t have a Windows machine, so I ran the whole thing under Wine and cracked it with Cheat Engine. It was a good learning experience.</p>
thanks for reading.</em></p>

shadowe1ite - godot

Grand Larceny Auto — Robbing a Vault That Won't Give You Six Stars

wrap up</h2> I don’t have a Windows machine, so I ran the whole thing under Wine and cracked it with Cheat Engine. It was a good learning experience.</p> thanks for reading.</em></p>

wrap up</h2>
I don’t have a Windows machine, so I ran the whole thing under Wine and cracked it with Cheat Engine. It was a good learning experience.</p>
thanks for reading.</em></p>