Kör Geçit
One game. Six lessons. We will open the code together.
Start at the gate
- Health
- 22/28
- Light
- 36
- Turn
- 194
The Sealed Archive. You are at column 30, row 17. The sealed gate is right next to you.
The game's latest message
You read the keeper's journal. +25 score on first reading.
This gate is the subject of lesson two.
Follow the stringWhere this starting point comes from
I have walked you up to the gate of the Sealed Archive. It is waiting for one particular piece of text, and that text is written inside the game's file. Try whatever comes to mind, or look at the hints first.
I started the game in the Atrium and ran the first 197 commands of the instructor's walkthrough through the real game engine with seed 20261021. They leave you on turn 194 at column 30, row 17, right beside the gate. On the way the Atrium gate opens with the brass key and this region's journal is read. None of these commands contains the text the Sealed Archive gate wants.
A test checks that these commands match the raw walkthrough and that both routes reach the same game state. It compares position, health, light, turn, pack, journal and the state of the gate. The full list of commands is below.
dsstakeddssssssssssaatakewwaatakewwddddwwwwwwwdddddddddddwwwdddddddtakeuse 5aaalookdddddduse 2dsssdunlockuse 1dddddddstakeuse 1dddssssssdddssssdescenddsstakeddssssssssssaatakeuse 4wdddddddddddddwwdddddddddtakewaaaawwwwwuse 2wdwwwwaawwalookdssddssssassssdddddsssd
The game in your browser
The game on this page is the C source carried over line by line into JavaScript. I tested it against the Windows build. In 69 scenarios I gave both versions the same seed and the same commands and compared their screen output byte for byte, and none showed a difference. That does not mean every possible sequence of commands has been tried. I deliberately left out the Watcher's Hall commands that depend on the debugger check, because there the two versions behave differently.
In the Watcher's Hall the Windows build asks the operating system whether a debugger is attached to it. A browser cannot ask that question. Where the C code gets no answer it keeps the seal shut, and the browser version does the same. That is why the Memory Labyrinth and the Clockwork Heart do not open here. In the course, the debugger, Frida and memory analysis happen on the Windows executable, and the browser game does not stand in for any of them.
I do not give the gate answers in the text of this page. They are not hidden, though. As with the executable, they can be found in the game code your browser downloads.
The map at the gate comes with the page. The game code only loads when you send your first command or choose to start in the Atrium, and it sends no data anywhere. This edition displays the original English game messages. The Turkish edition translates the display without changing engine records or commands.
Controls
- Arrow keys or W A S D
- Walk. Walking into an enemy attacks it.
- F
- Strike the enemy next to you.
- G
- Pick up the item under your feet.
- 1 to 6
- Use or equip that pack slot.
- I
- Open the pack.
- L
- Look around and read a journal next to you.
- J
- Open a journal you have already read.
- R
- Eat a ration, or use a spring next to you once.
- Full stop
- Wait one turn.
- Greater-than sign
- Go down while standing on a stair.
- U
- Move to the box for words to the gate.
- Enter
- Move to the command box. Any command, attune included, can be sent from there.
- Esc
- Release the keyboard from the game and return to the page.
On a phone, use the buttons that Walk around the map opens. Each button sends the game the same command.
What I will show, and how
You walk around, fight whatever comes at you and fill your pack. The first gate opens with a brass key you find on the floor. The ones after it want exact words instead, and those words are somewhere in the game's file. One sits there in plain text, one is encrypted, and one only appears in memory while the game is running. I will show how I found each of them, including the attempts that went nowhere.
Most of each lesson will be real terminal and analysis recordings. You will see the command I type, the output that comes back, the guess that turns out wrong and how I correct it. If I use a drawing or an animation to explain something, I will say so.
The six lessons are planned and the recordings have not been published yet. For now this page shows the plan and a playable copy of the game.
Six regions, six methods
Lesson 1C, Python, Ghidra
Build the game, identify the file
Is the file I am analysing really the game I am playing?
The first region, the Atrium, teaches the game itself. Walking, fighting, managing the pack, keeping the lantern lit and finding the brass key. Then I build the source and read the size, SHA-256 hash and PE header of the executable it produces. The hash works like a fingerprint, so changing a single byte gives a completely different value. This is also where the file first goes into Ghidra.
By the end A game running on your own machine, with its identity checked.
This lesson starts by confirming that the file I am analysing really is the game I am playing. The lines below come from the Python output in the lab record. Size, SHA-256 hash and PE header pin down the file's identity.
File: kor-gecit.exe Bytes: 159744 SHA256: 9d0a988946f4b1f23dc23fbc23ececa16519cb96be0b7ccd49757b53c15e1566 Signature: b'PE\x00\x00' Machine: 0x8664 (AMD64)Recorded Python output, unchanged. Original output The executable package cannot be downloaded from this page yet. I will add the link here when it is ready.
Lesson 2Ghidra, Python
Which gate does the string open?
Is finding a readable sentence in the file enough to open the gate?
The Sealed Archive gate compares your words with a fixed string in the file. Spotting a candidate in the strings output is the easy part. The real work is finding the code that uses it. I map the string's position in the file to its address in memory and follow it to the function that does the comparison. Then I try a wrong candidate, an uppercase version and the exact match in the game, one after another.
By the end A path traced from the recovered string to the gate's condition, and tested in the game.
Lesson 3Python, Ghidra
Decode the hidden bytes
If the answer is not in the file as plain text, what do you follow instead?
The word the Cipher Well wants is not written anywhere in the file. The code XORs a run of encoded bytes with a short key. XOR compares each byte with a byte of the key bit by bit, and applying the same key a second time gives the original back. I start with a wrong guess and show where it went wrong. The correct calculation ends up in a small Python script, and the word it produces gets tried at the gate.
By the end A small decoding script you can explain line by line.
Lesson 4x64dbg, Terminal
Same code, different result
Why does the clue disappear when a debugger is attached?
The mechanism in the Watcher's Hall stays silent if it notices it is being watched. The game asks Windows whether a debugger is attached to its own process and takes a different branch depending on the answer. Using x64dbg, I attach only to our own game process and find that branch. I set a breakpoint, change the condition for a moment and put the original bytes back at the end. This lesson also explains why that gate stays shut in the browser version on this page.
By the end A recorded explanation of the condition that also undoes its own change.
Lesson 5Frida, Python
Find the word in memory
Where do you start if the clue only exists while the game is running?
The Memory Labyrinth's word is not in the file at all. The moment you activate the resonator, the game builds four linked objects in memory, and the word sits in the last one. I put a hook on one function with Frida. A hook is a small piece of code that steps in whenever the function is called and reads its values. From there I follow the pointers one by one and check what I find against a separate memory read and a checksum.
By the end A memory investigation that reaches the same word by two separate routes.
Lesson 6Python, Ghidra
Read the virtual machine
What do you do when the game runs its own little instruction set?
The last gate is guarded by a tiny virtual machine in the Clockwork Heart. Think of it as a processor built into the game, with four registers and ten instructions. First I read the bytecode and work out what each instruction does. I do not move on to a solution until I understand what the machine computes from the input in the forward direction. The model belongs to this game only and is not a general account of virtual machines.
By the end An explained model of the machine and the last gate opening in the game.
Before you start
You will be comfortable if you can read basic C and find your way around a command line. The recordings are made on Windows x64. Ghidra, x64dbg, Python and Frida are used only on the game I wrote for this course, and no other program is targeted.
Where this course stands
This page announces a plan. I am not promising a release date, a price or a certificate. Links to the lessons will appear here as they are recorded. This English page describes the same plan and does not mean English-narrated lessons are ready.