Cheat Engine

homer_simpson · Posted: Fri Jul 04, 2008 3:38 pm Post subject: [Help] MapleStory WPM/RPM bypass

First of all I would like to know how to do it in delphi or C++. Would a trampoline work?
Or would I need a hookhop?
And also I would like a sample on how to do it.

Cx · Posted: Fri Jul 04, 2008 5:11 pm Post subject:

Noooo.
The kernel equivalents are hooked.

homer_simpson · Posted: Fri Jul 04, 2008 5:49 pm Post subject:

oib111 · Posted: Fri Jul 04, 2008 5:51 pm Post subject:

Hm...aren't there other ways to write and read memory? Something less obvious?

EDIT:

Do WPM/RPM have a hotpatch prologue or w/e it is.

rapion124 · Posted: Fri Jul 04, 2008 6:15 pm Post subject:

You can read/write memory by injecting a DLL into the process and using a pipe or file-mapping to control the DLL and request memory reads.

oib111 · Posted: Fri Jul 04, 2008 6:21 pm Post subject:

You could. Or you could also make your program inject a dll to write and read the memory and listen on to see if you hit a hotkey. And really your program is just a injector for many dll files. But a pipe may be easier.

homer_simpson · Posted: Sat Jul 05, 2008 6:07 am Post subject:

So if I would make a dll and inject it and use WPM/RPM it would work?

oib111 · Posted: Sat Jul 05, 2008 7:44 am Post subject:

No, look inject a dll that has the capabilities to send information to your program (presumably through piping). The way you write and read memory is through pointers. Here's an example:

Slugsnack · Posted: Sat Jul 05, 2008 8:17 am Post subject:

When you inject your DLL, your DLL shares the virtual memory space of the target process which means you can essentially treat the memory as that of the DLL and hence directly access/read/write memory.

eg. in ASM it might be something like:
mov dword ptr ds:[virtual_address], eax

You could always try functions like RtlCopyMemory or RtlMoveMemory.

@oib, the 5 byte prologue that enables hot patching is not actually necessary if you do want to trampoline. You can copy the first 5 bytes, whatever the case. However if it is not the often seen: