Direct Memory Access (DMA) to Static Memory Addresses

[[MPGH]Dave84311]

Direct Memory Access (DMA) to Static Memory Addresses
Written by Dave84311

Tool(s) Needed:
TSearch

Knowledge Needed:
How to use TSearch
Basic ASM

Intro
Hacking in TSearch is one of the easiest things to do. Mainly because anyone can find values and change them. Anyways, the biggest problem with using TSearch to hack is that the memory addresses from computer to computer are different. This is because of something called "DMA" or "Direct Memory Access." Besides being different on from computer to computer, DMA addresses are never static. In this tutorial I will explain how to obtain a static address for a DMA address.

Indepth Description of DMA: https://cnx.rice.edu/content/m11867/latest/

Defeating DMA
I am assuming you know how to use TSearch otherwise you shouldn't be reading this tutorial. You should attempt to use this tutorial when you have a DMA address that you want to convert to a static address.

Setting A Breakpoint
Lets say you have an address and it is B02DCE9. This address needs to be converted to a static address. What we would need to do is set a breakpoint on this DMA address so we can find out what is accessing this address. What we need now is the "TSearch Debugger." Goto the main menu and click on "AutoHack" > "Enable debugger". Now we need to procede and set the breakpoint. Procede by clicking "AutoHack" > "AutoHack window". A window called "AutoHack" should be opened. Click on the little green window or go to "Edit" > "Set BreakPoint". In the "Address" field enter your DMA address, changing it to whatever byte size it is (BPM Size), change type to "Read/Write" and finally click "Set". There we go! We set the breakpoint.

Returning Offset Addresses
To get a DMA address you must have the value passed to you. These values are passed to you by actions that occur in game. When setting a breakpoint you will need to go through the same - PRIMARY - actions that got you the value in the first place. So go head and go into game and do those actions again.

Now... Go back to the "AutoHack" window. You should see a whole list of Offset Addresses.

For Example:
301771: fld dword ptr [eax+0x777]
305CBA: fld dword ptr [ebx+0x777]
30A667: fld dword ptr [ecx+0x777]
309FCC: fld dword ptr [eax+0x777]
30FFA6: fld dword ptr [ebx+0x777]
335A9D: fld dword ptr [ecx+0x777]
378C11: fld dword ptr [eax+0x777]

Those are the memory address that are accessing (reading/writing) to your DMA address. What needs to be done next is check if these addresses are what we want. Usually some of these addresses are "Junk addresses" or addresses that have little or no value to what we are doing. What we must next do is set a "Break On Execution" or "BPX" for each address. So, click "Edit" > "Disassemble", this should open a small box for you to enter an address. Enter the first offset address. Click "Disassemble" and find the "Disassembler" tab near the bottom of the window and click it. Here is a list of addresses relating to the offset address added. Right click on the first memory address on the list and click "Register". Doing this should make it appear on the "Register" tab. Anyways we need to look for another address to register. This has to do with the ending tag of the offset addresses you got, e.g. [eax+0x777], since thats the ASM related to your memory address. Using the ASM specified, look for another address that contains it (Third Column) and register it. NOTE: There may no other values or there may be more then one. Next you must enable these addresses to be debugged. So click on the "Register" tab and click on the little checkbox on the farthest left for all values; the box should turn red. Now go in game and procede by doing the same action again that got you the DMA value. Now go back to "AutoHack" window. If the values of a memory address goes crazy or fluctuate's (Depends on what kind of hack your making). Then value is of no use to you. Keep it anyways because you may screw up. Now go through every memory address and save the ones that work (and that don't - if you are uncertain you know what your doing). There you go boys! A nice little tutorial on converting DMA to Static Memory Addresses.

NOTE: I am kinda rusty with my uber l33t haxoring skills... So some of this may be off a bit. If you notice anything wrong, be kind and point it out!

Post your replies and comments at: https://mpgh.net/showthread.php?p=1442#post1442