4

This is my first time asking something on SE and I'll do the best I can to provide all of the required information, but I apologize in advance if I'm not clear enough.

I'm trying to reverse engineer a certain fighting game to be able to run the moves "manually". What I mean by this is, say a certain power move is run by pressing S A J quickly on the keyboard, I want to be able to just jump to the method to use that move in the code without having to press the keys.

so far I've tried using CheatEngine and OllyDbg to search for strings that match the move names, and also looked at what values changed before, during, and after executing the move, but neither seems to have done anything.

I'm relatively new to the assembly language, but have quite a bit of experience in c++, c# and other languages.

I looked for questions similar to this one before posting it, but couldn't seem to find anything that would help. If this has been posted before and I just missed it, sorry about that.

Thanks in advance for any answers.

  • 2
    Did you try keyboard emulators ? I'd try to simulate such a thing outside of the game. – w s Oct 28 '15 at 6:57
  • "I want to be able to just jump to the method to use that move in the code without having to press the keys" -- You don't say on what condition do you want to jump to the code? – Guntram Blohm supports Monica Oct 28 '15 at 7:29
  • Sorry. I meant that i want to jump to the method to use that move by just pressing one button instead of the three or more in quick succession. – SplitHorizon Oct 28 '15 at 16:34
  • I agree with @ws, it'd probably be way easier to just do this with keyboard macros outside the game – Dillinur Nov 29 '15 at 19:17
  • 1
    There is a way to do this in Cheat Engine using -> Memory View -> Tools ->Ultimap this will get to the functions required to run that move it logs all the functions the game uses an you just keep filtering the results until you get a few like 10 or 20.. then u check each function by hand to see which one you need – SSpoke Sep 29 '16 at 2:14
1

Considering that this is the RE forum, this is how I would find the function.

  1. Place a conditional break point on the input handling code. Depending on the game it might come from something like getchar() or be handled in a Windows message loop (assuming x86 Windows here since you mentioned OllyDbg).
  2. The condition for the breakpoint would be when the input data equals 'j'. You might get lucky and find a cmp/jmp (or similar) sequence for 'j' or 'J' in the disassembly, then you could just set a normal break point there.
  3. Run the game, and execute the combination on the keyboard.
  4. When the break point hits, you can then single step and keep track of the call statements that are hit, one of them is likely to be the function you care about.
| improve this answer | |
  • Thanks for the answer. i'll give this a shot and get back to you. Also, i'm running x64 windows with ollydbg. Pardon my ignorance, but does olly not work on x64 windows? I wasn't aware of this. – SplitHorizon Oct 28 '15 at 16:37
  • Nevermind i just answered my own question. Probably should've read the olly website more carfully. :/ – SplitHorizon Oct 28 '15 at 16:42
1

Assuming this game is a bit more complex than a 8bit console game I'm afraid hooking getchar() and the likes won't do you much good.

With Windows windowed/full screen games, input is received by handling window messages, usually in a message loop.

In such cases, each window has its own message processing loop, in witch it constantly calls GetMessage() to receive events it should react to, such as key presses. GetMessage()s first parameter is a pointer to MSG structure which it populates with the next message after removing it from the queue. Go here for a message loop example, here for GetMessage() documentation, and finally here for the MSG structure documentation.

In that case you should place breakpoints on:

  1. GetMessage
  2. PeekMessage

After you've got to the message loop, you'll probably encounter a medium sized switch-case handling the different message types. That switch-case should read the MSG structure's message member for message types that belong to the keyboard. most commonly those are:

  1. WM_KEYDOWN
  2. WM_KEYUP
  3. WM_CHAR.

Once you've found the case handling those types, you should be pretty close to the function you're looking for. That case will most-likely do a few lines for code worth of parameter preparations and then call the function you're looking for.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.