Hook into a game

Originally Posted by somewhatpro

Sorry bro you can't find a static pointer for an emulated program.
one thing you can do is hook where it writes to the value (usually it WRITES to alot of values so you have to create filters to find the right address you want) then you can store it and play with it.

to create filters is also hard you have to find something to use as a filter for example i have made a really strong hack for an online multiplayer Flash game i used pretty much the same method, i hooked where it writes the position of the player(it wrote also positions to objects and bullets and other stuff) and i found out that the value 128 is stored in EAX everytime it writes position of a player and i used it as a filter to get my player's address.

So I posted a question about reading a value of an emulated game awhile back, got this response.

I've progressed a fair bit in C++, up to function declarations, parameters and arguments, and returning a value from a function. I don't think I'm anywhere close enough to being able to do the quote but can someone point me into the direction I need to be moving in order to be able to do stuff like this?

Or give me a snippit of code with some decent comments?

Learn how to handle pointers. Pointers will be the most important thing for what you want.
After that you'll have to learn a bit of Assembly. Learn how memory is stored in your computer.

Roger, so I'm not ready yet! I'll get there, one day. Until then I will continue to bug the C++/C sub-forum with questions

I've a pretty good understanding of pointers, dunno if that includes handling them. Memory, I've looked into stuff like cheat engine, only grazed the surface. I'll have to look into assembly.. if anyone has some references to share. I looked at the sticky but it really only tells you what to learn and talks about WinAPI functions.

I'll do some googling around later too.

If you have skype I'll explain what "one thing you can do is hook where it writes to the value" means. Might not get to actually writing code, but can go over the concept(s) (highly depends on how much you already know ...if I were to explain everything it would be a long post and I won't do that, and to be very vague probably wouldn't help you much..so..conversing is the best way to teach -- I won't try to send you any file, or links to any sites lol).

edit, the vague version

So the game.exe has a bunch of code in ram, and somewhere in that code is a line (..if you want to think of it that way) that changes some value you care about (speed, stamina, etc) -->

so you know (and this seems obvious but is important) that when that line of code is executing, it has access to the data you're watching -- usually in a register, but could also refer to memory location directly. Anyway, we overwrite some game.exe instruction with a JMP (jump, or call or push/ret) instruction somewhere near this game.exe code --> and have the process's execution continue at (jump to) some *code cave* we have created -- and in this codecave we will copy out the value we're looking for, then jump back to continue the program's execution where it left off (careful not to mess up the stack..but we all do it, a lot).

so we create a codecave in ram (with handwritten instructions...depending on the exact game code we're working with)
and then place a jump where the game.exe code modifies the value we're watching

so now any time the game.exe runs that function, it will run it's own code + some of ours.

this process is called "code caving" -- google 'how to code cave' and read a few articles, sorry I don't have one to recommend.

I probably forgot something, and left out a Lot of details. Ask questions if any of that makes sense.

Originally Posted by abuckau907

If you have skype I'll explain what "one thing you can do is hook where it writes to the value" means. Might not get to actually writing code, but can go over the concept(s) (highly depends on how much you already know ...if I were to explain everything it would be a long post and I won't do that, and to be very vague probably wouldn't help you much..so..conversing is the best way to teach -- I won't try to send you any file, or links to any sites lol).

edit, the vague version

So the game.exe has a bunch of code in ram, and somewhere in that code is a line (..if you want to think of it that way) that changes some value you care about (speed, stamina, etc) -->

so you know (and this seems obvious but is important) that when that line of code is executing, it has access to the data you're watching -- usually in a register, but could also refer to memory location directly. Anyway, we overwrite some game.exe instruction with a JMP (jump, or call or push/ret) instruction somewhere near this game.exe code --> and have the process's execution continue at (jump to) some *code cave* we have created -- and in this codecave we will copy out the value we're looking for, then jump back to continue the program's execution where it left off (careful not to mess up the stack..but we all do it, a lot).

so we create a codecave in ram (with handwritten instructions...depending on the exact game code we're working with)
and then place a jump where the game.exe code modifies the value we're watching

so now any time the game.exe runs that function, it will run it's own code + some of ours.

this process is called "code caving" -- google 'how to code cave' and read a few articles, sorry I don't have one to recommend.

I probably forgot something, and left out a Lot of details. Ask questions if any of that makes sense.

I think I understand, it sounds like when the game reaches a point where it executes the code we're trying to modify it moves to our code.

I'll do some googling. Thanks for the vague answer it is very easy to understand.

Did I really say 'So' at the beginning of each sentence : | oops. Anyway, ya that sounds about right...depending on what you're doing of course. Causing the program's execution to jump to a codecave you created can be useful in a lot of different scenarios, but the core idea is the same --> create a codecave somewhere and be able to get the game to run it.
C++ is very nice for this..and the source code actually looks pretty! In vb.net (my preffered language), the source code would contain a lot of... workarounds and hacks (?), anyway, not as fun when you're editing the source code (but I still manage).

If you find a good tutorial and have questions, please post it here so others who view this thread can benefit from your searching/experience (instead of creating a new thread -- unless you feel that is actually appropriate).

Hook into a game

Post a Reply

Similar Threads

Tags for this Thread