Finding the player animation function of a game

Question

I'm currently working on a small multiplayer modification for an old game from 2001. For now, I'm able to move the player remotely by its X, Y, and Z coordinates I found by reversing. But I don't know how to get to the animation function of the player. How do I start from this point? In the disassembly, should I search for something like a state that is set (PlayerRun, PlayerTurnLeft, etc.), or should I try to trace back where the coords are set?

I'm kinda stuck and don't know how to start at this point. I'm working with CheatEngine and OllyDBG.

EDIT: I finally found the animation state value in memory with Cheat Engine. Changing it to the "jump"-animation works great, but not for the "moving"-animation. Probably the game checks for the user to press the key that moves the player forward. Anyway, I took a look at the disassembly that writes the animation state. I played around with some jumps and comparisons and in some cases, the animation won't show up, which means I'm basically in the right function. At this point I'm kinda stuck, because I don't know on how to find out the correct function (there are multiple) and its arguments.

Answer 1

Are you looking for the function to modify locally on the client, or are you trying to identify a function that will handle outgoing coordinate data to move a player remotely? I'm going to assume the former for this answer. I'm also going to stick 100% to Cheat Engine. This isn't comprehensive by any means, but it should get you headed in the right direction from a dynamic analysis standpoint.

The coordinate data you've found is likely being fed through the function you're interested in at some point, but the question is how deep into subroutines are you potentially when your coordinate data is being passed through instructions. Thus, you can start by checking out what writes to any of three coordinate addresses you've found.

You may have multiple results, and at that, any given result might be a shared instruction, so check for that by right-clicking on an instruction and choosing to view addresses that instruction writes to. If only one address pops up after a bit of testing, then you're good to go.

Once viewing that instruction in the disassembler, you'll be in some sort of routine that's presumably related to coordinate data. Is it directly the function you're interested in? This is where you'll have to spend some time reversing to find out.

A couple of things that might help you along the way are as follows:

1. Enumerate DLLs: In the Memory Viewer window, click View -> Enumerate DLLs and Symbols. Any information that CE can glean in relation to function names, will populate there, so you could then search for names you might be interested in. A video demonstrating this can be viewed here.

2. Dissect Code: In the Memory Viewer window, click Tools -> Dissect Code. That will give you a lot of additional information where applicable as you reverse, like which CALLs are calling a routine you may find yourself in, etc.

You can also utilize CE's break/trace to find arguments being passed to functions. I like to begin with a cursory view of functions/methods being called that led to the one I'm in. To do that, in the Break and Trace window, check the box that says "Step over instead of single step". I also like to check "Save stack snapshots" as well so I can potentially pick out some things.

Finally, you may want to consider using Ultimap or Ultimap 2, found in the Memory Viewer window under Tools. They allow you to log function calls and filter out all the ones you know aren't the function(s) you're interested in. Two videos discussing Ultimap can be viewed here and here. If your target is 32-bit, then you can use an awesome little tool called CDA: Code Dynamic Analysis (tutorial video here) to do the same thing as Ultimap, but in a different manner (timeline-based) AND without the added headache of Ultimap requiring DBVM to work (Ultimap 2 doesn't require DBVM, but does require the right CPU as it utilizes Intel Processor Trace).