Cheat Engine

[pkedpker]

I think call means function.. and retn means (RET) returns back to where call was is +1 and since call was in my naked function it should stay in my naked function should leave it so i got no comment.. Plus i dont know where to learn more.

I gotta learn where CALL holds the number that tells it where to retn and modify it joking i dont think its possible!

u cant do jmp to Game Decrypt because it requires arguments I believe.

call takes arguments from pushes..

[sponge]

Call pushes EIP onto the stack so that RETN knows where to go. Thats why push ADDRESS + RETN = a jump. RETN uses the [esp] to return and the number with retn is to clean up the parameters if there are any.

[nog_lorp]

I'd advise learning x86 assembler first :/

Sponge is right cept it pushes address of next command, eip + size of call . But that is definately not eip+1 as pker suggests.

Additionally, JMP just changes the eip. If you JMP into a function, the RETN will ABSOLUTELY NOT go back the the command after the JMP. It will pop the first dword on the stack ([esp]) into eip.

Your options:
A - Call call
B - Jmp call jmp

A:
Change the call to Orig to call Hack
In Hack, call Orig with proper arguments (repush args to Hack)
Orig will complete its task and return into Hack
Do what you want with the now available decoded content. (if the function does not return a pointer to the decoded packet, you may have to store the pointer before the call)
Adjust stack if necissary, and return

B:
Change the call to Orig to a jump to Hack
In Hack, call Orig. No stack fuddling is necessary since you are in the same stack frame / stack isn't smashed.
Orig will complete its task and return into Hack
Do what you want with the now available decoded content.
No stack adjustments are necissary. Now you must jump to the command after the modified call to Orig, the spot Orig would normally return to.

~nog_lorp
PS: Hi spongeh!

[sponge]

you know what i meant nog. where'd you go?

[the_undead]

yeah nog dude, I havent seen you around for a shit long time, but i guess im not really here anymore ever either.

[&Vage]

Code cave the entire instructions

[pkedpker]

in a naked function if i did.

int and char*'s outside the assembly inline function wouldn't that mess up assembly.. also I think im almost done anyways without using tempsize tempbuffer's its going alright atm.

just crashes but atleast I see first RECV undecrypted.



yes

Causes crash because EBP is my packet size -__- and
program does [EBP-4] to store values on stack... but EBP is my size so its not possible to store there..






MAN this is soo crazy...

AT LOGIN SCREEN
EBX = PACKET
EBP = SIZE

INSIDE GAME
ESI = END OF PACKET PACKET=PACKET-SIZE;
EDX = SIZE

now if i load up hack before inside game -.- will crash game

[nog_lorp]

EBP is the base pointer of the stack. You are confused.

Sponge/undead: I went to sleep oO. Naw I got bored of MS hacking, moved on to a couple legit games and some other hacking.

[pkedpker]

d\w man.. this topic is old.. needs lock... i fixed all all works perfectly..

[atom0s]

Locked due to request of OP.