Cheat Engine

Xoujiro · Posted: Fri Aug 15, 2008 8:13 pm Post subject:

Ok, so ive got the addy and all, but the same address is obtained whether wolfteam is running or not, does this mean it isnt hooked?

and rapion, i ran olly, ctrl+g and typed in CreateProcessA, it brought me to kernel32.dll, now i right click -> breakpoint -> toggle , and then run wolfteam, now what do i do?

dnsi0 · Posted: Fri Aug 15, 2008 8:33 pm Post subject:

k. Look for createprocessA in intermodular calls. Now you should find 3.
(well... thats for gameguard) then you look for one that has PUSH 01 above it by a few bytes. Change the PUSH 1 to PUSH 0.
(well... thats for gameguard so I don't know if its gonna work for xtrap)

Xoujiro · Posted: Fri Aug 15, 2008 8:52 pm Post subject:

rapion124 · Posted: Fri Aug 15, 2008 8:55 pm Post subject:

Wow!!!!! Do you need to be spoonfed? Breakpoint on CreateProcessA. Run Wolfteam. Look in the lpFileName or lpCommandLine parameters. Look for "XTrap.xt" in those parameters. Then go to [esp] to get the address the game calls to load XTrap.

Note: you will get multiple hits, it's expected.

Xoujiro · Posted: Fri Aug 15, 2008 10:01 pm Post subject:

nvm i give up

sponge · Posted: Fri Aug 15, 2008 10:57 pm Post subject:

Slugsnack · Posted: Sat Aug 16, 2008 4:18 am Post subject:

atom0s · Posted: Sat Aug 16, 2008 5:49 am Post subject:

Does WolfTeam do packet checks with XTrap? (I assume they do cause the game is made by Softnyx..)

If not you can unhook Xtrap from the game completely fairly easy.

dnsi0 · Posted: Sat Aug 16, 2008 8:27 am Post subject:

K. Look for intermodular calls but use sort->by name

then its in alphabetical order.

Wintermoot · Posted: Sat Aug 16, 2008 9:16 am Post subject:

Lok for all intermodular calls then start typing and look at the window's titlebar...

Slugsnack · Posted: Sat Aug 16, 2008 9:21 am Post subject:

As I said before, if the game is packed, it is unlikely the method you two are describing will work.

But by placing a breakpoint on the actual function itself, it will catch it unless the breakpointed instruction is not executed or the breakpoint removed.

Xoujiro · Posted: Sat Aug 16, 2008 9:52 am Post subject:

i dont know anything about olly... and there are checksums to check for xtrap too

rapion124 · Posted: Sat Aug 16, 2008 10:18 am Post subject:

I think what he wants to accomplish is debugging the game without XTrap, so no need to worry about the checks.

@Slugsnack:
lpApplicationName doesn't always give you the application name lol. Sometimes, it's null so you should look at lpCommandLine.

Slugsnack · Posted: Sat Aug 16, 2008 11:38 am Post subject:

I wouldn't know. I only said it was gonna be that cause of your previous post lol. I have only messed around with removing protections a few times before and that was in GunBound in which it was a simple case of unpacking armadillo and stripping it with a similar method outlined in this thread. Anyway if you're looking in Olly after breakpointing at the first instruction of a call you can look at the stack and see all the parameters very easily.