Author Topic: Trouble creating a trainer for a game my friends play...  (Read 2554 times)

0 Members and 1 Guest are viewing this topic.

Coronel_Niel

  • Insane Joker
  • ****
  • Posts: 846
  • Why can't I pick my own profile picture...
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #15 on: February 21, 2010, 02:41:42 am »
Ive only had experiance with Cheat Engine, but you'r looking for what changes the value. If HP goes into a decimal use floats.

So, whats the game first? that helps.

what game is it ?

xD
"Now we are going to watch my boys do it" - Joopig

M. O.

  • Administrator
  • MasstKer
  • *
  • Posts: 9185
    • View Profile
    • http://www.tkc-community.net
Re: Trouble creating a trainer for a game my friends play...
« Reply #16 on: February 21, 2010, 03:16:18 am »
You should check what ECX contains in order to be sure, and then see what happens if you modify the value at ECX.


About that tutorial:

[esi+0x4] is your money. It is stored at esi+0x4. Eax could contain some building cost.

The money address you find seems to be esi+0x4 . So to get esi you subtract 0x4 from the address you found. (If you don't read the register directly). Then you search for "esi" which returns a static address which holds the address of the pointer. So you get "esi" every time by reading that static address. Then add 4 to it to get the money.



Heckling is an art, and game hacking a science.

Mojoguy01

  • Intentional Cheater
  • **
  • Posts: 26
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #17 on: February 21, 2010, 04:46:50 am »
See, I REALLY don't want to say the game because it's one currently in beta (about 11 of those, so I hope they don't guess it  :wink2), so I'm being very cautious about this since I know they watch this forum :)!

Anyways, my current problem is not understanding how to read the address to follow it back to it's point of origin. I know it's not an anti-cheating method since there are similar things I've found that I could EASILY NOP right away. This particular address is simply being compared to for like 3 or 4 other different things.

I hope that made sense  :icon_confused2. If you absolutely MUST know the game to help me any further I can PM it to you, and hope you don't tell everyone else  :icon_thumbsup.

Mojoguy01

  • Intentional Cheater
  • **
  • Posts: 26
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #18 on: February 21, 2010, 04:55:16 am »
[Deleted original reply, due to me being stupid  :icon_thumbsup]

OK, so I read/watched some tutorials from the GHA and on youtube, and found out how to "look" what's inside said address. What I got was this quoted below (I edited out what game's EXE was given full access....so please bare with me!)

Quote
Alloc( MyCode, 2048 )    ; Allocate 2,048 bytes and store the allocated address into MyCode, which we use as the location where our new code goes.
Label( OverwrittenCode ) ; The code that was overwritten by the JMP to MyCode will go here.
Label( Exit )            ; JMP here to exit our custom code and go back to the original code.
Label( Return )          ; The location of the next instruction of the original code.

FullAccess( BlahBlahBlah.exe+0x0013E1E2, 2048 )
BlahBlahBlah.exe+0x0013E1E2 :
jmp MyCode
Return :

MyCode :                 ; The allocated address.  Put your code after this.

OverwrittenCode :        ; The overwritten code (code that was overwritten by the JMP to MyCode).
fstp    dword ptr [ecx]
retn    14

Exit :                   ; Automatic JMP back to the original code, or you can JMP Return directly to avoid coming here.
jmp Return

I'm unsure where to progress from here  :icon_confused2?

[edit] I also took an educated guess from following what you guys have been saying in this thread, and the GHA. So I looked at 53E1E2 ECX, and looked above him....there being a MOV ECX,DWORD. Inside that MOV I found this:
Quote
Alloc( MyCode, 2048 )    ; Allocate 2,048 bytes and store the allocated address into MyCode, which we use as the location where our new code goes.
Label( OverwrittenCode ) ; The code that was overwritten by the JMP to MyCode will go here.
Label( Exit )            ; JMP here to exit our custom code and go back to the original code.
Label( Return )          ; The location of the next instruction of the original code.

FullAccess( BlahBlahBlah.exe+0x0013E1DE, 2048 )
 BlahBlahBlah.exe+0x0013E1DE :
jmp MyCode
nop
Return :

MyCode :                 ; The allocated address.  Put your code after this.

OverwrittenCode :        ; The overwritten code (code that was overwritten by the JMP to MyCode).
mov     ecx, dword ptr [esp+4]
fstp    dword ptr [ecx]

Exit :                   ; Automatic JMP back to the original code, or you can JMP Return directly to avoid coming here.
jmp Return

I'm not exactly sure what I'm looking at, but it "looks" to a novice like me that this is looking at my ECX in some way :)!
ps: To recap thus far, this is me auto-assembling + injecting to get to this screen on the address:
 "0053E1E2 FSTP    DWORD PTR [ECX]" & "0053E1DE MOV [ECX, DWORD PTR[ESP+4]"
« Last Edit: February 21, 2010, 05:26:46 am by Mojoguy01 »

M. O.

  • Administrator
  • MasstKer
  • *
  • Posts: 9185
    • View Profile
    • http://www.tkc-community.net
Re: Trouble creating a trainer for a game my friends play...
« Reply #19 on: February 21, 2010, 05:36:14 am »
Ok, but what about the values at the addresses? (ecx etc)
Heckling is an art, and game hacking a science.

Mojoguy01

  • Intentional Cheater
  • **
  • Posts: 26
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #20 on: February 21, 2010, 06:10:46 am »
Ok, but what about the values at the addresses? (ecx etc)

That's the thing, I'm not quite sure how to look AT the values stored in those addresses. How might I go about that using MHS  :icon_sad2?

[edit] I took a wild guess, and am "manually" adding said address using the search page's address listing (where I rightclicked and went "find what writes to this address" on the original address that LEAD me to 0053E1E2 :)! I hope that's right :O
« Last Edit: February 21, 2010, 06:15:55 am by Mojoguy01 »

Mojoguy01

  • Intentional Cheater
  • **
  • Posts: 26
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #21 on: February 21, 2010, 06:33:23 am »
Ok, but what about the values at the addresses? (ecx etc)

I re-read your post (the part in parenthesis), and was confused. Any values with ecx etc are in the screenshot I originally posted on the first page near the bottom? Unless, that's not what you're looking for?

M. O.

  • Administrator
  • MasstKer
  • *
  • Posts: 9185
    • View Profile
    • http://www.tkc-community.net
Re: Trouble creating a trainer for a game my friends play...
« Reply #22 on: February 21, 2010, 05:10:32 pm »
Yes you add it manually.

ecx is a kind of variable (register) it contains a value (any number, an address or something else). Here ecx will be an address. What happens if you change the value at ecx manually? Or freeze it?

You need to verify that ecx is what you're looking for.

Heckling is an art, and game hacking a science.

Mojoguy01

  • Intentional Cheater
  • **
  • Posts: 26
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #23 on: February 21, 2010, 10:54:16 pm »
Yes you add it manually.

ecx is a kind of variable (register) it contains a value (any number, an address or something else). Here ecx will be an address. What happens if you change the value at ecx manually? Or freeze it?

You need to verify that ecx is what you're looking for.

I added them manually last night (was guessing then) and I had the data type set to "pointer", since the long (4byte) version of it looked like it should be in HEX. The problem being, ANY addresses that were in some way or another associated with the one I was directly linked to had addresses that had 0 information or were null it seemed. I'll work on it more today after I finish playing Supreme Commander with my buds, and I'll get back to you m8.


Btw, thanks again for all the help so far  :icon_magician!

Mojoguy01

  • Intentional Cheater
  • **
  • Posts: 26
    • View Profile
Re: Trouble creating a trainer for a game my friends play...
« Reply #24 on: February 22, 2010, 01:42:50 am »
I'm unsure where to go from here  :icon_confused2. Only a handfull of addresses associated with the two directly linked to HP have actual game.exe addresses. Most of the others are pointing outside the game (all).


The following addresses that are linked in some way or another to HP (directly or not) that I tried to NOP or change their addresses froze the game:
0053E1E2, 0053E1DE, 0053E1DC, 0053E1D8

So at this point I'm lost  :icon_sad2. I however, started to see these "jnz" addresses that seemed to jump the function containing HP to different areas of memory  :icon_o_o.

Guess I'm stuck just using temp addresses with a memory editor for now  :icon_sad2.