nopping engine crashcode; finding pointer?

Hi,

After my last thread getting some help on finding the EU pointer and writing my own console (thanks guys) i was told to find the crash code to null it as that's the problem i was facing.

My knowledge of ASM is limited so i've been having some issues.

Firstly, is it the engine.dll file we're working on here? Just to make sure i'm in the right place!

Secondly, if this is the case, i assume we're working on the "__security_init_cookie" routine? I'm assuming we can't just nop the call to this function and everything is ok, so we have to be clever about it?

I counted 9 "blocks" the execution could go through, with a main chunk doing a performance test that apparently checks for buffer overrun. Is it the jump at the end of this we need to change (i.e. JNZ to JZ) ... alternatively could we change the comparison (CMP esi,edi) to CMP esi,esi or CMP edi,edi which will always return correct?

I also noticed a few hard coded values for the checks ... wouldn't that make it possible (if you were bored) to add your DLL size to the value so that once injected, it can't be detected by the program? ... Just a thought (i know it'd be pointless and tedious).

Am i on the right lines? right file, right procedure, right sort of area? Or am i completely wrong?

Sorry if these questions are stupid. I've not looked at ASM for 4 years and i never got into any depth with it.

Thanks for any help!

Should be engine.dll yea. And I don't think its connected to that cookie thing

How do we go about finding the pointer then? is there some label to look for or do i have to inject and crash the game with a debugger attached or something to find where the code exits and look for pointers to there to work backwards?

Originally Posted by jammiey2k3

I'm actually not quite sure how I found it back then. I think I checked HD's address and searched around that.

So does that mean that this pointer doesn't change very often? I'm assuming it's different between NA and EU?

I'll have another look once the DLL has been processed again at its entry and see if anything sticks out. The security cookie looked promising, but if it's not been used before i guess it's not the part i need. I guess the check is done near the entry of the DLL?

Thanks for your help so far. If i can't work it out, any chance i could get a copy the current NA engine.dll and the pointer so i can find the call structure and apply it to the EU file to pull it out? Even a dated pointer and dll would do tbf, just need to know what i'm looking for!

nopping engine crashcode; finding pointer?

Post a Reply

Similar Threads

Tags for this Thread