Cheat Engine

[ileandros]

Hello,

Can anyone help me get the memory of the chat of the RGC?
Since i can't post url's yet please check it on google.
The Client doesnt requir any installations and its only 20mb size so please take a look someone who has nothing to do and he is booring

Thanks in advance

[jucce]

What if you just search for the latest typed string in Cheat Engine and then look at that memory region? You can also look at "what accesses this address" to try and find the code that triggers updates of the chat.

[ileandros]

[jucce]

Okay, try this. Find the addresses for the latest 10 lines of chat text. Then see if you can find a pattern in the memory locations or pointers to the locations. If that is possible you can predict the address of the next line to be added. Then manually add that address and do "what accesses this address", when the next chat message comes you should see the originating code.

Also try taking a look at the memory region where you are finding the strings from the chat, it is likely that they will be grouped together.

Could you explain what the end goal is, what are you trying to accomplish?

[ileandros]

[ileandros]

Anyone else wanna do the dirty job???
Give me a hand guys, i see these forums are pretty active...

[jucce]

Okay so I tried downloading the client. First of all scan with Unicode checked since that gives better results.

I did manage to find a range of memory where the chat text is located and indeed if I observe that memory range in the memory viewer I can see the new lines being added at the end. When you see that it is possible to add a memory location that you know is going to be written to shortly and monitor it for writes. When doing that I typically see it using functions such as QtCore4.ZN7QString6appendERKS_+3D or QtCore4.ZN7QString7reallocEi. See the image for what I find writes the new text lines. So if you can rewrite the code near that location or hook the string handling functions in QtCore4.dll that should be a good start.

The location of the chat text moves in memory. It is also possible to find it and then simply read the strings in that area. The chat text has a fixed format starting with [XX:XX] too which helps with parsing.

Another way is to observe the incoming network traffic since it is sent in clear text and the chat messages can be observed in the incoming TCP packets.

[ileandros]

[jucce]

Try to replicate this:
1. Start RGC and wait for people to write stuff in the chat.
2. Search for a word or part of what someone else wrote in the chat a while ago (not the latest). Choose some normal text written by a user, not a status message or some weird characters people post.
3. Now hopefully you will get one result, right click this and choose "Browse this memory region". Scroll down until you see the end of the strings from the chat and start seeing other nonsense data. Now you should see the end of the string section blink red from time to time when new lines are being added.
4. Right click below this area where you know new lines will be added in a while. Select "Add this address to the list".
5. Now in the main window right click the address you added in step 4 and choose "Find out what writes to this address".
6. Wait for the red lines being written to reach the address you are watching.
7. You should now have the assembler code and memory location from where new strings are written.
8. At this point try hooking the functions, injecting code or reading the pointer to the string being added.

However when doing these steps you need to be fast and also lucky. The reason is that the chat text is sometimes reallocated and will therefore jump away, not writing to the address you are monitoring. So when choosing an address choose it close enough for it to reach but not too close since you won't have time to start the "what writes to this address".

Try those steps and tell me how it went.

[ileandros]

[jucce]