Cheat Engine

[mitch92]

Hi! I am really noob about all these hacking stuffs. There is a program I wanna try to hack. The program uses a dll library to execute one of the function and I am hoping to "overwrite" the function with my own. I cannot just create another dummy dll with my own function to overwrite his because the program detects if the dll file is modified in any way before loading it.

The function I want to replace takes in a string parameter and then outputs a string as the result. I want to modify the string output with mine.


I tried creating my own function in a dll, inject the dll, overwrite the first line of the subroutine of the original function with a call to the "fake function". And second line of the original subroutine to the a ret to prevent loading the original function at all. However, it does not work.

[ulysse31]

The string is an HWID ?
Have you tried loading the dll in ollydbg, hooking the function which your program calls and hook it to a memory page with space already present in your dll, write your stuff here, then return the code to the usual execution flow, save modified DLL.
That's how i proceded, i'd be very surprised if that didn't work.

[atom0s]

There are a few methods you could use to get around this.

1. Determine how the parent application detects changes to the DLL and bypass that. Would be the easier method if the detection is weak and easily bypassed.

2. Inject a new DLL and hook the original DLLs functions. You can do this a number of ways to ensure that your hook is working and being handled properly.

If you have issues hooking at the right time, simply hook the parent application instead. Either find and hook where the DLLs function is called, or hook LoadLibrary and monitor for when the DLL is loaded. When it is being loaded, allow it to load normally, then load and run your own code as needed after it loads the original DLL.

[mitch92]

Hi! Thanks for the reply! Sorry I am still not getting it, currently what I did is

I coded my own dll with a function that passes in a String and returns another String that I wanted.

I then inject the dll to the process and intercept the calls to the original function like this in auto assemble.

[panraven]

"The function I want to replace takes in a string parameter and then outputs a string as the result. I want to modify the string output with mine. "

"replace" or hijack(?) the output?

In hijack case

[atom0s]