Why instant play?

For YoYo Games the answer is simple – they want people to go back to their website on a regular basis. Whilst an occasional visit and a handful of downloads may be what a gamer wants this will not generate the revenue that YoYo Games’ needs.

Many people like using Instant Play as it makes GameMaker games appear in a way vaguely similar to popular flash arcade games with which many GameMaker games are comparable.

The creator of one such “Instant Play” plugin, James Rhodes, has created a table comparing the features of the different instant play options. The chart has proved rather controversial with both the owners of other Instant Play services and general GMC members disputing the scoring method used.

Sites with features comparable to YoYo Games’ instant play are YAIPP, GMBed, GMArcade, GMX and launched just two days ago Revel Quick Play.

Chart reproduced with permission of James Rhodes

The “Instant Play” options is taken from: GameMaker Blog

One vulnerability can fetch the login hash of Windows XP user’s logged into YoYo Games if they have selected the “Remember Me” feature. This feature uses cookies to store login data and when Instant Play is run from Internet Explorer the cookie, and hence the hash, can be accessed.

The Remember Me feature gives the user one month of automatic logins, and the extracted data could easily be sent back to a server using 39dll which could give a hacker access to your YoYo Games account.

A simple path modification means that the same opperation can easily be performed to users of the Windows Vista OS.

This proves another point I’m going to make about Game Maker/Instant Play security.

Why does Game Maker have access to the user’s cookies? Why does Game Maker have access to the system32 directory?

None of these things should be able to be accessed by Game Maker, and certainly shouldn’t be allowed when it’s running as Instant Play.

This example grabs your login information for YYG (if you are using Internet Explorer), and shows it to you. THE DATA IS NOT SENT ANYWHERE.
- James Rhodes

Another vulnerability supposedly gives games an automatic 5-star rating however at the time of writing I was unable to verify this.

More YYG Instant Play Vulnerabilities is taken from: GameMaker Blog