Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


By experience, how do you find filters in shared code

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions
View previous topic :: View next topic  
Author Message
Stregum
Advanced Cheater
Reputation: 0

Joined: 17 Jun 2014
Posts: 56
Location: We make baguettes there !

PostPosted: Tue Jul 19, 2016 6:01 am    Post subject: By experience, how do you find filters in shared code Reply with quote

Hi CEF Wink ,

As the title says; by experience, when encoutering shared code and (e.g) you want to segregate good guys from bad guys, what is your method ?

Would you analyze the data first using the data structure tool or memory regions ?

Would you analyze the code messing around with breakpoints, traces/stack ?

I'm asking that because in CE's tut, analyzing data is very easy because the structure is very simple, it's obvious that the id is the 10th offset.

However, when I look at other games, the data structure is way bigger and sometimes the ID is not 4-Bytes aligned, it could be a 1-Byte or 2-Byte value and CE could take that byte and interpret it as a 4-Byte value, making the ID very hard to find if the adjacent bytes are "random" to each entity.

By experience, do you have any tips to find filters ? I'm aware that this could be a noob question, I'm neither a complete begger nor a pro, I'm just learning.

Thank you for your time Smile

_________________
Rhaa Stregum Vitae Smile
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Tue Jul 19, 2016 6:14 am    Post subject: Reply with quote

++METHOS wrote:
There are other things that you can try.
  • You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
  • You can use pointer trees inside of the data structure to find something viable.
  • You can shift the data structure (+ or -) and/or expand its size to find something useful.
  • You can use the structure spider to find workable strings and/or for comparative analysis.
  • You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
  • You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
  • You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
  • You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
  • Et al.
Back to top
View user's profile Send private message
Stregum
Advanced Cheater
Reputation: 0

Joined: 17 Jun 2014
Posts: 56
Location: We make baguettes there !

PostPosted: Tue Jul 19, 2016 3:33 pm    Post subject: Reply with quote

There is some interesting stuff, thanks !
_________________
Rhaa Stregum Vitae Smile
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites