| View previous topic :: View next topic |
| Author |
Message |
jeroendeman
Master Cheater
 Reputation: 0
Joined: 03 Jan 2007
Posts: 270
Location: netherlands
|
 Posted: Fri Oct 24, 2008 3:03 am Post subject: [REG] [C++] Example for tick zf |
 |
|
how would i tick zf in c++ i looked at ce source he uses SetThreadContext
but how would i do that for a certain adress ?
and how would i set the EIP for an adress ?
|
|
| Back to top |
|
 |
tdenisenko
Grandmaster Cheater
 Reputation: 0
Joined: 23 Oct 2007
Posts: 799
Location: Turkey
|
| Posted: Fri Oct 24, 2008 10:04 am Post subject: |
|
|
if you do this successfully we can hack forever 
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Fri Oct 24, 2008 1:11 pm Post subject: |
|
|
There's no such thing as "Tick ZF" 
How about you learn about Flags, Registers, etc.
Hell, go learn ASM.
_________________
|
|
| Back to top |
|
|
Hieroglyphics
I post too much
 Reputation: 0
Joined: 06 Dec 2007
Posts: 2007
Location: Your bedroom
|
| Posted: Fri Oct 24, 2008 5:21 pm Post subject: |
|
|
DUDE I LOLED SO HARD
Tick ZF isn't a thing dude, you change the RegisterSymbol or whatever, lurc is right, all that AA shit and all that is for ASM so learn ASM if you want to do all that
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Fri Oct 24, 2008 5:32 pm Post subject: |
|
|
| Hieroglyphics wrote: | DUDE I LOLED SO HARD
Tick ZF isn't a thing dude, you change the RegisterSymbol or whatever, lurc is right, all that AA shit and all that is for ASM so learn ASM if you want to do all that |
No, RegisterSymbol is a function Dark Byte created in his auto assembler.
_________________
|
|
| Back to top |
|
|
nog_lorp
Grandmaster Cheater
 Reputation: 0
Joined: 26 Feb 2006
Posts: 743
|
| Posted: Fri Oct 24, 2008 7:44 pm Post subject: |
|
|
Debug the process. When you want to set/unset a flag at a certain address set a breakpoint there. When the breakpoint is reached use setthreadcontext to set/unset the flag.
_________________
Mutilated lips give a kiss on the wrist of the worm-like tips of tentacles expanding in my mind
I'm fine accepting only fresh brine you can get another drop of this yeah you wish |
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sat Oct 25, 2008 8:56 am Post subject: |
|
|
My interpretation of how debug registers work:
You set a breakpoint on a process so that any threads that pass there will get paused. After that the thread contains a context containing eax, ebx, flags registers and all that crap. Now you use set thread context to change those contexts so that it fits you need so to do that u use getthreadcontext and setthreadcontext. after the context has been set you can use resume thread to let it go. So basically when a thread passes this point, no matter that the instructions are, it will change to that value you assigned:
push eax
mov eax,10 <- set bp change eax to 40
cmp eax,40 <- then this will always jump cause eax is 40 when it gets here
je [whatever]
nog_lorp: You cant just use setthreadcontext cause that will screw up everything before it. So I guess you need to use getthreadcontext into a variable and then change whatever and then set it back in.
MSDN says: Suspend the thread before you use setthreadcontext O.o
|
|
| Back to top |
|
|
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Sun Oct 26, 2008 1:38 am Post subject: |
|
|
| And it depends on what you want to do. Mostly changing a conditional jump to an unconditional jump or to a nop is enough. But if for some reason you don't want to change the code, you could do it this way, and the code keeps untouched.
|
|
| Back to top |
|
|
tdenisenko
Grandmaster Cheater
Reputation: 0
Joined: 23 Oct 2007
Posts: 799
Location: Turkey
|
| Posted: Sun Oct 26, 2008 2:25 am Post subject: |
|
|
| tombana wrote: | | And it depends on what you want to do. Mostly changing a conditional jump to an unconditional jump or to a nop is enough. But if for some reason you don't want to change the code, you could do it this way, and the code keeps untouched. |
changing offset like changing jumps or nopping them gives you "Hacking attemp detected" in MapleStory because of gameguard's CRC (it checks memory)
so we can use the flags (mostly zero flag) to nop it or change the function of it without touching the memory
maybe it can be done with C++ but i am not sure about EIPs
with EIPs we can use any ASM scripts we want without a bypass
but its still made by hand (tick the script and write the changed value to correct EIP)
so i dont think its as easy as ZF editing...
or just wait for lurc's C++ engine? :O
_________________
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sun Oct 26, 2008 8:37 am Post subject: |
|
|
| If you want a je to a jne just tick the zf at the prev cmp statement I think...
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun Oct 26, 2008 8:44 am Post subject: |
|
|
| dnsi0 wrote: | | If you want a je to a jne just tick the zf at the prev cmp statement I think... |
There is no "TICK ZF" ffs. You either set the bit, or keep the flag bit unset.
And no, you place a breakpoint on the address that you want to set the flag bits on, so you would put it on the jump instruction.
The thread halts before the instruction is executed so no, you don't put it on the compare before.
| tdenisenko wrote: | | or just wait for lurc's C++ engine? :O |
If I do start it again, I'd recode it from scratch again. (Never finished it before, got some of the memory view working tho)
| tdenisenko wrote: | maybe it can be done with C++ but i am not sure about EIPs
with EIPs we can use any ASM scripts we want without a bypass
but its still made by hand (tick the script and write the changed value to correct EIP) |
It can be done with EIP's aswell. A lot easier in C++ than Auto Assembly too.
All AA scripts do is make a RegistrerSymbol to place the address of the newly allocated memory into that RegisterSymbol, allowing you to copy that address into the instructions EIP, which changes where it goes after the instruction is executed.
_________________
|
|
| Back to top |
|
|
tdenisenko
Grandmaster Cheater
Reputation: 0
Joined: 23 Oct 2007
Posts: 799
Location: Turkey
|
| Posted: Sun Oct 26, 2008 10:22 am Post subject: |
|
|
| lurc wrote: | | tdenisenko wrote: | maybe it can be done with C++ but i am not sure about EIPs
with EIPs we can use any ASM scripts we want without a bypass
but its still made by hand (tick the script and write the changed value to correct EIP) |
It can be done with EIP's aswell. A lot easier in C++ than Auto Assembly too.
All AA scripts do is make a RegistrerSymbol to place the address of the newly allocated memory into that RegisterSymbol, allowing you to copy that address into the instructions EIP, which changes where it goes after the instruction is executed. |
well did you ever tried to make it or thought that you can make something like that?
so every1 can hack much easier this way
_________________
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sun Oct 26, 2008 1:26 pm Post subject: |
|
|
| lurc wrote: | | dnsi0 wrote: | | If you want a je to a jne just tick the zf at the prev cmp statement I think... |
There is no "TICK ZF" ffs. You either set the bit, or keep the flag bit unset.
And no, you place a breakpoint on the address that you want to set the flag bits on, so you would put it on the jump instruction.
The thread halts before the instruction is executed so no, you don't put it on the compare before.
| tdenisenko wrote: | | or just wait for lurc's C++ engine? :O |
If I do start it again, I'd recode it from scratch again. (Never finished it before, got some of the memory view working tho)
| tdenisenko wrote: | maybe it can be done with C++ but i am not sure about EIPs
with EIPs we can use any ASM scripts we want without a bypass
but its still made by hand (tick the script and write the changed value to correct EIP) |
It can be done with EIP's aswell. A lot easier in C++ than Auto Assembly too.
All AA scripts do is make a RegistrerSymbol to place the address of the newly allocated memory into that RegisterSymbol, allowing you to copy that address into the instructions EIP, which changes where it goes after the instruction is executed. |
... I keep saying tick.. How about set the zf to 1...
|
|
| Back to top |
|
|
Spawnfestis
GO Moderator
 Reputation: 0
Joined: 02 Nov 2007
Posts: 1746
Location: Pakistan
|
| Posted: Sun Oct 26, 2008 1:32 pm Post subject: |
|
|
| tdenisenko wrote: | | lurc wrote: | | tdenisenko wrote: | maybe it can be done with C++ but i am not sure about EIPs
with EIPs we can use any ASM scripts we want without a bypass
but its still made by hand (tick the script and write the changed value to correct EIP) |
It can be done with EIP's aswell. A lot easier in C++ than Auto Assembly too.
All AA scripts do is make a RegistrerSymbol to place the address of the newly allocated memory into that RegisterSymbol, allowing you to copy that address into the instructions EIP, which changes where it goes after the instruction is executed. |
well did you ever tried to make it or thought that you can make something like that?
so every1 can hack much easier this way |
Apparently you didn't recognize that Cheat Engine is a program developed for over 5 years now. You think (even if the language is a bit faster) that lurc can do that in one, two months? It takes a lot of time, and most of the people that codes professionally does not have the time to code something all day, they have to learn new stuff constantly as well as they go to school or work at the same time.
_________________
CLICK TO HAX MAPLESTORAY ^ !!!! |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
