Results 1 to 9 of 9
  1. #1
    Dwar
    Dwar is offline
    Veteran Dwar's Avatar
    Join Date
    2010 Mar
    Posts
    2,222
    Thanks Thanks Given 
    211
    Thanks Thanks Received 
    2,230
    Thanked in
    292 Posts
    Rep Power
    10

    [Tutorial] Game Hacking for beginner, Video + Source Code

    Basics of game hacking by UgLy-NeRd. Article is provided with video and C source code. Will be suitable for beginners.


    The game I'll be using is Minesweeper and making it so it shows where the mines are (automatically flagging them).

    Ok. First you need to start Minesweeper and MHS (Memory Hacking Software).

    Open Minesweeper's process (winmine.exe) with MHS.


    Now, we need to search for 10 (number of mines left).

    You will be left with a bunch of results. We need to narrow these down, so, flag a mine (any mine, it does not matter), and make it so you only have 9 mines left.

    Now, sub search for value 9 (number of mines left).


    You should now be left with 1 result. This is the offset where minesweeper stores the number of mines left.

    Go ahead and copy the address down.



    And opon OllyDbg. Attach Minesweeper's process (winmine.exe) to OllyDbg.


    Your screen should now look like this. This is just minesweeper's code. Don't worry, you don't really need to understand any of this.

    Un-pause Minesweeper by clicking the Play button.

    Now, go to the offset that you found in MHS.


    Change the text formatting of the dump area to ASCII (32 chars).

    When you're looking at the dump, what do you see? You should see something like this. The box that is shown in the dump area would be the minesweeper boxes. It shows which are mines and which aren't.

    We need to find what code changes the boxes to be mines and not mines. We do this by breakpointing on write. Go ahead and do this (as shown below).

    Click the smiley on minesweeper, this will re-draw all the boxes with different mines.

    Wait.. It just paused. Why? Because when you breakpointed on write, and you go to minesweeper and click the smiley, it re-draws the boxes with mines. So, we breakpointed on write, meaning it changed that value. It will take us to the bit of code that does so.

    Continue by pressing F7 (or step into button) to find which piece of code actually writes where the is. Just hold F7 until you notice a mine is drawn (it will look like an A with a squiggly line in the dump area). You might have to draw a few mines until you find which line of code draws the mine.

    If your having trouble, go slow, once you see the A pop up in the dump area, it will be the line of code that was just called.


    I found it. It is at offset 010036FA. The code that draws the mines is
    OR BYTE PTR DS:[EAX],80

    OR BYTE PTR DS:[EAX],80

    So, we know this function draws a a blank box where the mine is, we need that blank box to be a mine. 80 would be the overlay for the blank box.

    OR - Logical inclusive OR of the two operands returning the result in the destination. Any bit set in either operand will be set in the destination.

    MOV - Loads the current task register with the value specified in "src".
    Lets change that OR to a MOV.

    To find what the hex code for the flag is, just click play in OllyDbg, go to Minesweeper, make a flag in a box, go back to OllyDbg, change the dump area view to Hex Ascii 16 Chars. Find the flag in the dump. Once you find it, it should be 0E.

    So, change
    OR BYTE PTR DS:[EAX],80
    to
    MOV BYTE PTR DS:[EAX],0E

    by double clicking that piece of code. The assemble box should come up, just put the changed code in there, and click assemble.

    Remove the breakpoint we made so it doesn't always pause when drawing the boxes.

    Click the smiley on minesweeper, and it should draw the flags as shown below.


    Ok. Now we need to put ALL of this into programming language (C++). Which can be done very easily with a function called WriteProcessMemory().
    #include <windows.h>
    #include <iostream>
    using namespace std;
    int main()
    {
    /* Offset that we changed the code in OllyDbg */
    LONG address = 0x010036FA;
    /* The new bytes that we write */
    /*010036FA C600 0E MOV BYTE PTR DS:[EAX],0E*/
    BYTE newvalue[] = {0xC6,0x00,0x0E};
    HWND hwnd;
    HANDLE phandle;
    DWORD pid;
    /* Get Minesweeper's window */
    hwnd = FindWindow(NULL, "Minesweeper");
    if (hwnd != 0) {
    GetWindowThreadProcessId(hwnd, &pid);
    phandle = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
    } else {
    cout << "Minesweeper is not running.";
    cin.get();
    return 0;
    }
    /* If we can open Minesweeper's process, it will change the code, else, it will return "Couldn't get a handle" */
    if (phandle != 0) {
    WriteProcessMemory(phandle, (LPVOID)address, (LPVOID) &newvalue, 3, 0);
    cout << "Mines revealed!";
    cin.get();
    } else {
    cout << "Couldn't get a handle";
    cin.get();
    }
    }

    Please register or login to download attachments.

    Please, post your questions on forum, not by PM or mail

    I spend my time, so please pay a little bit of your time to keep world in equilibrium

  2. The Following 2 Users Say Thank You to Dwar For This Useful Post:


  3. #2
    lemmings
    lemmings is offline
    Guest
    Join Date
    2011 Mar
    Posts
    2
    Thanks Thanks Given 
    0
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    thx, it's the first tim i'm doing something like that, and i dont understand all, but it's work
    ps: where is the function called WriteProcessMemory()?

  4. #3
    Consedep
    Consedep is offline
    New member
    Join Date
    2011 Jan
    Location
    Where bears drink vodka
    Posts
    11
    Thanks Thanks Given 
    1
    Thanks Thanks Received 
    3
    Thanked in
    3 Posts
    Rep Power
    0
    Kernel32.dll exports 'WriteProcessMemory'

  5. #4
    xseed
    xseed is offline
    Guest
    Join Date
    2011 Mar
    Posts
    1
    Thanks Thanks Given 
    0
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    Why i get "Couldn't get a handle"

  6. #5
    crata
    crata is offline
    New member crata's Avatar
    Join Date
    2011 Mar
    Posts
    12
    Thanks Thanks Given 
    4
    Thanks Thanks Received 
    1
    Thanked in
    1 Post
    Rep Power
    0
    Why do I try to press the play button.
    It does not run the program olldy.
    It's like running a new bar opening at the bottom.
    Then when I press the play button.
    It is not already running.

  7. #6
    adinkkasef
    adinkkasef is offline
    Guest
    Join Date
    2011 Mar
    Posts
    2
    Thanks Thanks Given 
    0
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    nice, very nice... would you explain us another function like, mov, jump, push, eax etc...??? im a newbie here but i'm really really interesting about this...
    we have game here that the engine have been packed by the mida, how to unpack and not making the game crashed..??? sorry for my english..

  8. #7
    (o3o)
    (o3o) is offline
    New member
    Join Date
    2011 Jan
    Location
    Earth
    Posts
    13
    Thanks Thanks Given 
    2
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    I dont get it im using windows 7 ultimate and i cant find the Minesweeper Process in OllyDbg. Can anyone help?
    Last edited by (o3o); 2011-07-15 at 11:26 PM.

  9. #8
    warbeak1245
    warbeak1245 is offline
    New member
    Join Date
    2010 Nov
    Posts
    6
    Thanks Thanks Given 
    2
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    Quote Originally Posted by Dwar View Post
    Basics of game hacking by UgLy-NeRd. Article is provided with video and C source code. Will be suitable for beginners.
    When you're looking at the dump, what do you see? You should see something like this. The box that is shown in the dump area would be the minesweeper boxes. It shows which are mines and which aren't.


    Ugh, my problem is, what innovation lets you know that simply looking up the number of remaining flags will lead you to what is essentially a map of the minesweeper field? It seems like such a huge leap to me... :/

  10. #9
    jc2013
    jc2013 is offline
    New member
    Join Date
    2013 Mar
    Posts
    7
    Thanks Thanks Given 
    2
    Thanks Thanks Received 
    0
    Thanked in
    0 Posts
    Rep Power
    0
    Thanks for a nice tutorials.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •