| View previous topic :: View next topic |
| Author |
Message |
stealthy17 Expert Cheater
Reputation: 0
Joined: 10 Apr 2007 Posts: 144 Location: The Netherlands
|
Posted: Thu Jan 17, 2008 3:33 am Post subject: [ASM] Odbg - Patching client [+rep ofcourse. least i can do] |
|
|
Here's what I'm trying to do:
- In the middle of a function in the game i jmp to the end of the data section where i write my own (patching) code.
- I have a ptr that brings me to the start of the data to be patched how can i store this dword? (mov eax, dword ptr[offset] ?)
- I need to write a loop to do like this:
| Code: |
'(skillbma = data offset, skilladdy is offset to be patched)
'and this is VB6 (some old project of mine... im now directly writing these functions into the game client (no injection.. rewriting..)
'base ptr offset to start of data block to be patched
ReadProcessMem ProcessHandle, &HF66C4C, skillbma, 4, 0
For f = 1 To 410000 Step 516
tmp = 1
skillAddy = (skillbma + f) + 487
WriteProcessMemory ProcessHandle, skillAddy, tmp, 1, 0
skillAddy = (skillbma + f) + 488
WriteProcessMemory ProcessHandle, skillAddy, tmp, 1, 0
skillAddy = (skillbma + f) + 455
ReadProcessMem ProcessHandle, skillAddy, tmp, 1, 0
If tmp = 3 Then
tmp = 2
skillAddy = (skillbma + f) + 455
WriteProcessMemory ProcessHandle, skillAddy, tmp, 1, 0
End If
Next
|
My questions;
- is asm from inside the game client able to write to it's memory (outside data seg.)
- if so, can it do this WITHOUT calling API? (mov [offset], data?)
- since i jumped from the middle of a function will i still be able to use eax, ebx (whatever proper register i need) since it will already contain some data from the function?
- i can vaguely imagine a loop to do this but cant get it done somehow i managed to read the data from the offset by using push dword ptr[F66C4C] which will in game get the ascii at the ptr outputted so that works
Can someone maybe write a sample loop in (odbg-)asm? just to give me an idea...
i don't need to get the final working thing just an example of an equal loop which touches the memory (using mov?) from ptr offsets
Also if someone could help me real-time on MSN that would be really helpful since i can't put the right words together on a forum...
Also i can send some screenshots of what I'm doing and parts of the code (needed to fully understand my situation properly i guess)
Last edited by stealthy17 on Fri Jan 18, 2008 4:51 am; edited 2 times in total |
|
| Back to top |
|
 |
NINTENDO Grandmaster Cheater Supreme
Reputation: 0
Joined: 02 Nov 2007 Posts: 1371
|
Posted: Thu Jan 17, 2008 3:32 pm Post subject: |
|
|
I find it very unclear.. I've read it over and over and still don't understand what you are trying to do.
You could start making notes in your code you know, it really makes ur programs easier to understand.
_________________
Intel over amd yes. |
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Thu Jan 17, 2008 3:45 pm Post subject: |
|
|
yes you can modify data in different segments of the process. To save register data you can push/pop data.
and yes you can mov dword ptr ds:[XXXXXXXX], eax
_________________
|
|
| Back to top |
|
 |
stealthy17 Expert Cheater
Reputation: 0
Joined: 10 Apr 2007 Posts: 144 Location: The Netherlands
|
Posted: Thu Jan 17, 2008 3:52 pm Post subject: |
|
|
Well that's just a loop writing 3 bytes at a certain offset
namely
static offset + f + 487
static offset + f + 488
then read from
static offset + f + 455
if the read byte is 3 write 2 to it
f increases on each loop with 516 until it hits 410000 (which is the amount of loops needed to patch all data properly
u see the loop works perfectly fine and offsets and sizes are all correct
i just need to translate it to ASM
i think something like this
mov dword ptr[static offset+f+487], 1
mov dword ptr[static offset+f+488], 1
mov eax, dword ptr[static offset + f + 455]
if eax = 3 -> mov dword ptr[static offset+ f + 455], 2
then loop and inc f with 516
see i kinda do know how it should go but I'm not sure how to write the loop and if that's the way to write to the memory (using mov) etc etc
|
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Thu Jan 17, 2008 4:01 pm Post subject: |
|
|
is that a double level pointer?
_________________
|
|
| Back to top |
|
 |
stealthy17 Expert Cheater
Reputation: 0
Joined: 10 Apr 2007 Posts: 144 Location: The Netherlands
|
Posted: Fri Jan 18, 2008 2:16 am Post subject: |
|
|
1-level ptr.
Returns an offset at which the data block starts.
|
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Fri Jan 18, 2008 6:57 pm Post subject: |
|
|
if it was a 1 level pointer you wouldn't be needing to add F. all you'd need to do is just include it with the other offset.
_________________
|
|
| Back to top |
|
 |
stealthy17 Expert Cheater
Reputation: 0
Joined: 10 Apr 2007 Posts: 144 Location: The Netherlands
|
Posted: Sat Jan 19, 2008 11:59 am Post subject: |
|
|
Well you see it should use the pointer in the loop
more like this...
it gets the offset from the pointer
and in the loop its
offset + f (from the loop..)
not pointer + f
know what i mean?
look at my VB code thats what it should do
|
|
| Back to top |
|
 |
bump_stealthy How do I cheat?
Reputation: 0
Joined: 23 Jan 2008 Posts: 1
|
Posted: Wed Jan 23, 2008 2:47 am Post subject: |
|
|
Okay i gave up waiting.
Seems this stuff is too hard for the supposedly 'die-hard' hax0r ch34tz0rs on this forum.
This is my last bump I'm out of here.
|
|
| Back to top |
|
 |
atom0s Moderator
Reputation: 205
Joined: 25 Jan 2006 Posts: 8587 Location: 127.0.0.1
|
Posted: Wed Jan 23, 2008 3:00 am Post subject: Re: [ASM] Odbg - Patching client [+rep ofcourse. least i can |
|
|
| stealthy17 wrote: | My questions;
- is asm from inside the game client able to write to it's memory (outside data seg.)
- if so, can it do this WITHOUT calling API? (mov [offset], data?)
- since i jumped from the middle of a function will i still be able to use eax, ebx (whatever proper register i need) since it will already contain some data from the function?
- i can vaguely imagine a loop to do this but cant get it done somehow i managed to read the data from the offset by using push dword ptr[F66C4C] which will in game get the ascii at the ptr outputted so that works |
I'm not an ASM expert so bare with me on these responses...
1.) Yes, you can access any part of the memory if you are inside the process (like injection and so on).
2.) Yes, you can do it without ASM as well. If you are writing in C/C++ you can use pointers and set the memory to what ever.
3.) Depends, as long as the code before where you jumped to has been executed already and the registers are loaded, they will contain their values. If not you will probably either crash the program or have to update the registers yourself before doing anything.
4.) Can't really help, I don't program in ASM much other then a few things in the past.
_________________
- Retired. |
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Wed Jan 23, 2008 7:08 pm Post subject: |
|
|
| bump_stealthy wrote: | Okay i gave up waiting.
Seems this stuff is too hard for the supposedly 'die-hard' hax0r ch34tz0rs on this forum.
This is my last bump I'm out of here. |
more like i can't understand VisualSHIT.
_________________
|
|
| Back to top |
|
 |
stealthy17 Expert Cheater
Reputation: 0
Joined: 10 Apr 2007 Posts: 144 Location: The Netherlands
|
Posted: Thu Jan 24, 2008 6:00 am Post subject: |
|
|
It uses standard ReadProcessMem api to get the data offset from the pointer
Then it's a normal for-loop which you should understand since it's pretty much the same in any language
Just to make you happy;
for (int f = 0; f < 410000; f += 516) (better?)
So within the loop it does (keep in mind data offset is the start of the very first data block...)
data offset + f (each loop += 516) + 487
data offset + f (each loop += 516) + 488
using WriteProcessMemory api
Then within the same loop it checks a value at
data offset + f (each loop += 516) + 455
using ReadProcessMem api
Then when the checked value is 3 change the value at
data offset + f (each loop += 516) + 455 to 2
using WriteProcessMemory api
As if that's so hard to see/understand.
The data blocks are 516 bytes and it patches each data block at (start of (first) data block + step + 4XX)
| sponge wrote: | | more like i can't understand VisualSHIT. |
I think it was just an excuse not to try and answer my question and dis me acting like I'm a 'shit' for i used VisualBasic 6 long ago.
|
|
| Back to top |
|
 |
sponge I'm a spammer
Reputation: 1
Joined: 07 Nov 2006 Posts: 6009
|
Posted: Thu Jan 24, 2008 8:22 pm Post subject: |
|
|
When you ask for help you do not insult the people who are helping you... (referring to your post by you're "bump" account.)
and im serious i do nto wish to understand VisualSHIT.
_________________
|
|
| Back to top |
|
 |
FerrisBuellerYourMyHero Master Cheater
Reputation: 0
Joined: 14 Feb 2007 Posts: 401 Location: Inside your <kernel>
|
Posted: Fri Jan 25, 2008 1:42 pm Post subject: |
|
|
just forget it! use a real coding language!
VB is far too weak to make anything but a simple GUI! GET OVER IT!!
use a more powerful language! then people can actually help you!
VB is for people that like to waiste time!
C++, MASM, DELPHI
all great choices and you choose VB? why?
Nothing good has been created in VB! what does that tell you about it?
_________________
You know, life moves pretty fast. If you don't stop and look around once in a while, You could miss it!
 |
|
| Back to top |
|
 |
XxOsirisxX Grandmaster Cheater Supreme
Reputation: 0
Joined: 30 Oct 2006 Posts: 1597
|
Posted: Fri Jan 25, 2008 10:00 pm Post subject: |
|
|
| FerrisBuellerYourMyHero wrote: | just forget it! use a real coding language!
VB is far too weak to make anything but a simple GUI! GET OVER IT!!
use a more powerful language! then people can actually help you!
VB is for people that like to waiste time!
C++, MASM, DELPHI
all great choices and you choose VB? why?
Nothing good has been created in VB! what does that tell you about it? |
Live with that, people don't thinks as everyone else. You're acting like "Damn it, this is damn hard, why don't you better use the easier way??"
If you recommend those programming language as to solve his problem, gave him the answer of this at your recommend languages them.
_________________
|
|
| Back to top |
|
 |
|