V.O.I.D. — Volatile Output Investigation & Discovery

A Serious Game for Computer Forensics education, focused on Memory Forensics and Live Incident Response.

🔎 Game Concept

V.O.I.D. is a browser-based Live Incident Response simulator built entirely with a Command-Line Interface (CLI). It puts the player in the role of a SOC Analyst responding to an active ransomware attack on a corporate server.

The machine cannot be shut down — critical decryption keys exist only in volatile memory (RAM). The player must race against the clock, using forensic analysis tools to identify the malicious process, extract the AES encryption key from its memory, and terminate the ransomware before all corporate data is encrypted.

Gameplay Flow

The game follows a structured, pedagogical sequence designed to introduce concepts before time pressure begins.

1. Interactive Tutorial Overlay. On a first visit, the player receives a guided tutorial that explains the terminal interface and the learning panel.
2. Terminal Mission Briefing. The briefing prints directly into the CLI with the operational context and objectives.
3. Timer Activation. The countdown starts only after the player confirms readiness by pressing Enter at the mission prompt.
4. Live Investigation. The player performs memory forensics actions while encryption progresses in real time.
5. Post Game Sequence. The end of the session is ordered as follows: transparent cyberpunk Game Over screen, knowledge assessment quiz, and final forensic report.

Key Features

• Dual OS Scenarios - Choose between a Linux (Ubuntu Server) or Windows (Windows Server 2019) investigation, each with a distinct attack chain
• Three Difficulty Tiers - Beginner, Intermediate, and Expert with escalating encryption speed, reduced hints, and masquerade mode
• Guided Onboarding - A first run tutorial clarifies interface elements before the briefing starts
• Terminal Native Briefing - The mission context is delivered through the CLI to maintain immersion
• Controlled Time Start - The timer begins only after explicit analyst confirmation
• PID Scrambling - Process IDs are randomized every session to prevent metagaming
• Forensic Notes Panel - Real-time educational insights triggered by player actions
• Post-Investigation Quiz - 3 randomly sampled questions per session from a per-tier question pool
• Structured Post Game Assessment - A Game Over screen, quiz, and report deliver feedback in a fixed order
• Exportable Reports - Download your forensic report as .txt or .json for grading
• Persistent Leaderboard - Track scores across sessions per difficulty tier (localStorage)
• Order of Volatility as Core Mechanic - Terminating the ransomware before extracting the key causes irreversible data loss
• Two-Stage AES Extraction - Perform memory dumps and execute cryptographic S-Box reversals to find encryption keys
• Kernel-Level Exploitation - Bypass Windows Protected Process Light (PPL) using vulnerable drivers (BYOVD)
• Thread Freezing - Surgically suspend malicious threads without triggering catastrophic system crashes

🎯 Learning Outcomes

This project was developed as a supplementary activity (Serious Game) for the course "Computer Forensics and Cyber Crime Analysis" (Prof. Atzeni, Politecnico di Torino).

• Live Response Under Stress — Perform memory triage during an active high-impact incident
• Order of Volatility — Understand why volatile evidence must be captured before remediation
• Malware Chain Identification — Trace parent-child PID relationships to find the attack origin
• Memory Analysis — Apply Volatility-style tools (pstree, malfind, yarascan, memdump) on dynamic outputs
• Evidence-First Methodology — Learn that remediation without evidence preservation leads to data loss
• Bring Your Own Vulnerable Driver (BYOVD) — Exploiting Ring-0 access to bypass PPL on Windows
• S-Box Reversal — Advanced cryptographic analysis to recover key schedules from memory dumps

📊 Pedagogical Assessment & Telemetry Framework

To measure the educational effectiveness of the simulator and evaluate the student's learning outcomes, V.O.I.D. implements a dual assessment framework:

1. Direct Theoretical Evaluation (Post-Investigation Quiz)

   • Immediately after completing (or failing) the simulation, the player is presented with a 3-question multiple-choice quiz.
   • The questions are dynamically sampled from a level-specific pool focusing on the forensic concepts encountered (e.g., Order of Volatility, memory protection flags, parent-child PID structures).
   • This provides immediate reinforcement and tests the conversion of practical actions into theoretical knowledge.

2. Stealth Behavioral Assessment (Procedural Telemetry)

   • The game silently tracks the analyst's investigative actions (commands executed, timeline of events, hints accessed, and critical mistakes).
   • A Methodology Score is computed using a positive base + bonus model based on compliance with forensic best practices. The score can exceed 100% if the analyst performs a deep investigation using advanced tools beyond the core requirements of the difficulty tier.
   • Based on this score and the redundancy/error rates, the student is assigned one of five Behavior Profiles:
     • 👑 Exhaustive / Comprehensive (Score > 100%): Exceptional rigor. Completed all required validation steps and conducted a thorough, exhaustive investigation beyond the standard requirements.
     • 🎯 Systematic (Score 80% - 100%): Strong methodological rigor. Executed the core validation steps efficiently with minimal redundant commands.
     • ⚡ Targeted (Score 50% - 79%): Fast and effective, but skipped some standard forensic validation steps before acting.
     • 🔍 Exploratory (Score 20% - 49%): Investigation successful, but lacked methodological depth. The analyst either relied on trial and error, or skipped crucial forensic validation steps before acting.
     • ❌ Chaotic (Mission Failed): Critical errors recorded (e.g., innocent process terminations, or failure to extract the key). Review the Order of Volatility.

This telemetry framework exports full performance reports (as .txt or .json), enabling instructors to gather anonymized classroom metrics and perform statistical evaluation of students' procedural forensic growth.

💻 Architecture & Technologies

The game runs entirely client-side in the browser — no backend, no VM, no installation:

• Frontend: HTML5, Vanilla CSS (cyberpunk terminal theme), vanilla JavaScript (ES6 modules)
• Level System: Each difficulty tier (beginner, intermediate, expert) is a self-contained module (js/levels/*.js) with its own config, scenarios, quiz pool, and hints
• Data Engine: Scenario state stored as mutable JSON, manipulated by player actions in real-time
• Audio: Synthetic sound effects via Web Audio API (no external files)
• AI-Assisted Development: As approved by the professor, the technical scaffolding (terminal UI, command parser, game loop) was developed with AI assistance, allowing the author to focus on forensic accuracy and educational content design

🚀 Quick Start

Play on GitHub Pages: https://botti01.github.io/VOID-Forensics-Game/

# Clone the repository
git clone https://github.com/Botti01/VOID-Forensics-Game.git
cd VOID-Forensics-Game

# Option 1: Just open index.html in your browser
# Option 2: Start a local server (recommended)
python3 -m http.server 8080
# Then open http://localhost:8080

See TUTORIAL.md for a detailed gameplay guide and command reference.

📁 Project Structure

VOID-Forensics-Game/
├── index.html                  # Entry point (start menu + game)
├── css/style.css               # Cyberpunk terminal theme (CRT, glow)
├── js/
│   ├── main.js                 # Bootstrap, menu → game, HUD, report modal
│   ├── terminal.js             # Terminal UI renderer (input/output/scroll)
│   ├── parser.js               # Command tokenizer & dispatcher
│   ├── commands.js             # 15 forensic command implementations
│   ├── gameState.js            # Central mutable state + PID scrambler
│   ├── levels/
│   │   ├── beginner.js         # Beginner tier: config, scenarios, quiz pool
│   │   ├── intermediate.js     # Intermediate tier (placeholder)
│   │   └── expert.js           # Expert tier (placeholder)
│   ├── gameLoop.js             # Timer & encryption progression
│   ├── scoring.js              # Score tracking, report builder, leaderboard
│   ├── quiz.js                 # Post-investigation quiz system
│   ├── telemetry.js            # Stealth assessment and behavior profiling engine
│   ├── learning.js             # Forensic Notes panel & toast system
│   └── audio.js                # Synthetic sound effects (Web Audio API)
├── TUTORIAL.md                 # How to play guide
└── README.md                   # This file

---

Educational project by Andrea Botticella — Politecnico di Torino, 2025/2026.