Cheat Engine

Chaosis13 · Posted: Tue Aug 04, 2009 5:19 pm Post subject: Finding packet buffer...

If I wanted to find the location of the packet buffer (before encryption) in a game how would I do that?

What I have so far would be to hook the send function and have it get me the place where it was called from the registers. Then above that code would be the encryption and the place where it got the unencrypted packets? Or would I look for an allocated region around where the function was called?

Any thoughts or experience would be helpful. I want to get some experience making packet editors and hooking functions.

smartz993 · Posted: Tue Aug 04, 2009 5:33 pm Post subject:

Keep tracing back the calls until you can see the decrypted buffer (pointer) in the stack before a call.

Slugsnack · Posted: Wed Aug 05, 2009 2:04 am Post subject:

it's probably easier for you to keep tracing FORWARDS then when you see a ret, follow it and the instruction before it is the one that is calling the send. then keep going 'out' if that is a sub-routine until you find their main function. after that and before that should be the decrypt/encrypt procedures respectively

Anden100 · Posted: Wed Aug 05, 2009 3:56 am Post subject:

smartz993 · Posted: Wed Aug 05, 2009 10:52 am Post subject:

Slugsnack · Posted: Wed Aug 05, 2009 11:29 am Post subject:

yeah but you can't 'trace backwards' so you need to find out where to start from first. which can be done with the method i described

or you could do it like pros like void which is code INLINE which means all your code is on 1 line

Chaosis13 · Posted: Wed Aug 05, 2009 12:24 pm Post subject:

Ok... I think I've got it. I will whip something up and tell you guys if it works. (Or need help...)

&Vage · Posted: Wed Aug 05, 2009 12:35 pm Post subject:

Chaosis13 · Posted: Wed Aug 05, 2009 7:06 pm Post subject:

I just saw that... Do you know what you are talking about?
_________________________________________________

But onto something more important my hook isn't working and I don't know why... Could it be that they changed functions preamble in Windows 7 (what I am using)? I am also using Visual Studios 10...

Maybe compatability mode will work... I will try that now.
EDIT: Compatability mode doesn't work...

EDIT: I did some debugging the preamble is the same, I will have to figure it out later... If someone wanted to help me with my hook PM me (experienced people only).

Anden100 · Posted: Thu Aug 06, 2009 2:47 am Post subject:

are you sure that the function even got the preamble?
did you look at the start of the function using a debugger?
If yes, and it doesent use the preamble, you could post up the asm of the start of the function you are trying to hook, and ill have a look

Slugsnack · Posted: Thu Aug 06, 2009 2:52 am Post subject:

dnsi0 · Posted: Thu Aug 06, 2009 4:38 pm Post subject:

Well... I just find all references to the place that called send() then trace up until the stack preservation header or in ms's case the thiscall crap. Then keep looking for references until you get a list of calls (from each game function) and that should be it.

Chaosis13 · Posted: Thu Aug 06, 2009 5:55 pm Post subject:

Ok, that makes a lot of sense, but I still can't get my hook to work...
I am using a modified version of this hook. http://theundead.atspace.com/Blog/Cplusplusssendhook.txt
I inject the DLL and it calls HookSend(), but it doesn't call SendHookFunc() when send is called.

smartz993 · Posted: Thu Aug 06, 2009 6:49 pm Post subject:

Try WSASend.

Chaosis13 · Posted: Thu Aug 06, 2009 9:06 pm Post subject:

Ah... *face palm* That might explain why I haven't been able to get packet editors to work. I am trying that now...

EDIT:
Problem still is unknown, although it seems as though my DLL is instantly hooked then unhooked, which could explain the problem...

EDIT:
*double face palm* I had to make a looping thread, which is better because I can activate/deactivate it. And it uses WSASend. But it works now, I will update if I find the buffer. Thanks to all that helped!