Page 1 of 2 12 LastLast
Results 1 to 10 of 14
  1. #1
    Dwar
    Dwar is offline
    Veteran Dwar's Avatar
    Join Date
    2010 Mar
    Posts
    2,222
    Thanks Thanks Given 
    211
    Thanks Thanks Received 
    2,230
    Thanked in
    292 Posts
    Rep Power
    10

    Aika Zoom with CE and OllyDbg

    Aika Zoom hack with CE and OllyDbg

    Following tutorial was written for Aika Online, but it will be suitable to any (in general) mmo, where gamer can change zoom (distance between camera and char).

    Tools:
    • Cheat Engine, MHS
    • OllyDbg

    Requirements: Basic knowledge in CE


    So, we start game, scroll our camera to maximum (it’s not obligatory), than start and attach CE and choose float value in 5-50 range.

    Of course, we can use unknown value or at least choose e.g. 1-1000 range – it’s depended from game. For Aika, range in 5-50 will be enough.
    Begin searching.
    Now our aim – small list of addresses where one of them store zoom value. And next steps are same for every memory search process: find addresses, vanish addresses, continue searching “changed” values and so on.
    At the end we will get our address and (for Aika) it will store value = 10 (for maximum distance).

    Add this address to the list and call “Find out what writes to this address”.

    In window with opcodes we can choose and examine any opcode, but for Aika we will pay attention on following instructions:
    0048bd9d - fld dword ptr [ecx+14]
    0048bddb - fld dword ptr [ecx+14]

    Why this values? Hm, it’s another story (also I’ve already described this in some other tutorial, but I forgot where exactly).
    Call “Extra info” (just double click) for first instruction:

    and for second instruction

    What we see here?
    0048bdd0 - mov eax,[009f7998]
    0048bdd5 - mov ecx,[eax+0003f5f4]
    0048bddb - fld dword ptr [ecx+14]

    [009f7998] – Base address (for current Aika client)
    and offsets: [[[009f7998] + 0003f5f4] + 14]
    Every Float Argument has to be pushed on the co-processor stack or the Floating Point Unit Stack (FPU). Hence every Floating point instruction is preceded by a 'F'. Usually every float operation starts with a FLD INSTRUCTION which "LOADS A FLOAT NUMBER ON TOP OF THE FPU STACK". Then it can be stored in a variable with the help of the FST and FSTP Instruction
    fld dword ptr [ecx+14] – this operation take from ecx+14 some float value and push it into FPU. This value is our “zoom”.

    Let’s add them to CE

    Now we have current zoom. But this isn’t end of our tutorial, because we have found not only base address and offsets, but a little bit more…

    Now, we open Ollydbg (or any other debugger), and attach it to our game process (or we can just open client without execution). Press ctrl + G and enter address of our first instruction
    0048bd9d - fld dword ptr [ecx+14]

    Here is a piece of code that has been also shown by CE.

    Right after fld instruction we see
    0048BDA0 FCOMP dword ptr [5C65E0] ; FLOAT 1.700000
    and slightly lower
    0048BDDE FCOMP dword ptr [5EC058] ; FLOAT 10.00000
    FCOMP (Compare ST(0) to a floating point value and POP ST(0))
    This instruction performs a signed comparison between the value in the TOP data register ST(0) and the floating point value from the specified source (Src). The top data register is popped after the comparison is completed. This instruction is used when the value in ST(0) would no longer be needed for further computation after the comparison has been performed.
    So, what we have?
    5C65E0 – store minimal float value for “zoom”
    5EC058 – maximal value.
    Of course, these values we have got also from CE, but I like Ollydbg…


    Result:
    © Dwar
    Please, post your questions on forum, not by PM or mail

    I spend my time, so please pay a little bit of your time to keep world in equilibrium

  2. The Following 6 Users Say Thank You to Dwar For This Useful Post:


  3. #2
    yizheng
    yizheng is offline
    Awesome to the MAX yizheng's Avatar
    Join Date
    2010 Aug
    Posts
    743
    Thanks Thanks Given 
    124
    Thanks Thanks Received 
    728
    Thanked in
    187 Posts
    Rep Power
    14

    re: Aika Zoom with CE and OllyDbg

    ....you've made a zoom hack too. i was makin the post when you already made one -_-

    edit: i guess ours a bit different and nice tutorial, i was lazy to make screens.

  4. #3
    torrentsoo
    torrentsoo is offline
    Member-in-training
    Join Date
    2010 Sep
    Posts
    85
    Thanks Thanks Given 
    25
    Thanks Thanks Received 
    13
    Thanked in
    2 Posts
    Rep Power
    0

    re: Aika Zoom with CE and OllyDbg

    it just keeps helping us with diff tutorials, thanks a lot guys.
    Give a thanks for something useful, and not just words.

  5. #4
    ppg
    ppg is offline
    New member
    Join Date
    2010 Oct
    Posts
    11
    Thanks Thanks Given 
    1
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0

    re: Aika Zoom with CE and OllyDbg

    can i also edit hp with the base address 9f7998 with olly?

  6. #5
    Dwar
    Dwar is offline
    Veteran Dwar's Avatar
    Join Date
    2010 Mar
    Posts
    2,222
    Thanks Thanks Given 
    211
    Thanks Thanks Received 
    2,230
    Thanked in
    292 Posts
    Rep Power
    10

    re: Aika Zoom with CE and OllyDbg

    ppg
    0042BEE2  |> \A1 98799F00   MOV EAX,DWORD PTR DS:[9F7998]
    0042BEE7 |. B9 01000000 MOV ECX,1
    0042BEEC |. 68 0000A040 PUSH 40A00000 ; /Arg1 = 40A00000
    0042BEF1 |. 0FBFB0 FC5803 MOVSX ESI,WORD PTR DS:[EAX+358FC] ; |
    0042BEF8 |. 0FBFB8 FE5803 MOVSX EDI,WORD PTR DS:[EAX+358FE] ; |
    0042BEFF |. 8988 744F0300 MOV DWORD PTR DS:[EAX+34F74],ECX ; |
    0042BF05 |. 8B15 98799F00 MOV EDX,DWORD PTR DS:[9F7998] ; |
    0042BF0B |. 897424 20 MOV DWORD PTR SS:[ARG.8],ESI ; |
    0042BF0F |. 897C24 24 MOV DWORD PTR SS:[ARG.9],EDI ; |
    0042BF13 |. DB4424 20 FILD DWORD PTR SS:[ARG.8] ; |
    => 0042BF17 |. 898A 704F0300 MOV DWORD PTR DS:[EDX+34F70],ECX ; |

    Here is a piece of code that manipulates with char data.
    0042BF17 MOV DWORD PTR DS:[EDX+34F70],ECX - store Char MaxHP
    Please, post your questions on forum, not by PM or mail

    I spend my time, so please pay a little bit of your time to keep world in equilibrium

  7. #6
    torrentsoo
    torrentsoo is offline
    Member-in-training
    Join Date
    2010 Sep
    Posts
    85
    Thanks Thanks Given 
    25
    Thanks Thanks Received 
    13
    Thanked in
    2 Posts
    Rep Power
    0

    re: Aika Zoom with CE and OllyDbg

    Does that mean HP can be change?
    Give a thanks for something useful, and not just words.

  8. #7
    lionheart214
    lionheart214 is offline
    New member
    Join Date
    2010 Oct
    Posts
    27
    Thanks Thanks Given 
    2
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0

    re: Aika Zoom with CE and OllyDbg

    it can change visually but afaik it's server sided

  9. #8
    a4123278
    a4123278 is offline
    Member-in-training
    Join Date
    2010 Apr
    Posts
    68
    Thanks Thanks Given 
    2
    Thanks Thanks Received 
    15
    Thanked in
    1 Post
    Rep Power
    0

    re: Aika Zoom with CE and OllyDbg

    Dwar thx for a nice tutorial,
    now its really easy to find current Zoom value

    and i know its an Aika forum. but could u help me with Requiem, how to find there min and max Zoom values, and override Zoom max limit, so it will be working as in ur DarqReq program,
    right now i can only increase zoom by freezing the value in zoom current, but i want to zoom normally using a mousewheel.

  10. #9
    coolninja
    coolninja is offline
    New member
    Join Date
    2011 Apr
    Posts
    10
    Thanks Thanks Given 
    1
    Thanks Thanks Received 
    2
    Thanked in
    1 Post
    Rep Power
    0
    I like this tutorial, although it's more action based,
    but it did show me a way of how can i combine usage with CE and ollydbg.

    still not so familiarize with opcodes, i guess i will learn a lot in this forum~

  11. #10
    solarcity
    solarcity is offline
    New member
    Join Date
    2011 Feb
    Posts
    6
    Thanks Thanks Given 
    4
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    I don't know about another version of CE but in CE 6 check Fast scan for last 4 digits save me from scan error problem and make the search process much faster.
    However, I think this option is depended on what you are searching.

Page 1 of 2 12 LastLast

Similar Threads

  1. [Release] Argo Bot + RunSpd & Zoom
    By yizheng in forum Other MMO
    Replies: 331
    Last Post: 2012-09-24, 11:07 PM
  2. [Hack] Guide for Zoom Hack
    By yizheng in forum Aika Bots, Hacks, Cheats
    Replies: 8
    Last Post: 2012-05-07, 02:21 PM
  3. Problem using Ollydbg
    By smbogdan in forum General Programming
    Replies: 4
    Last Post: 2012-01-29, 02:45 AM
  4. [Help] OllyDBG Beginner
    By rhu10 in forum Aika Online
    Replies: 6
    Last Post: 2011-09-05, 02:49 PM
  5. [Release] Char delay & Zoom hack
    By yizheng in forum Aika Bots, Hacks, Cheats
    Replies: 64
    Last Post: 2010-10-19, 01:01 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •