1

I am messing around with a game made with CryEngine. It's a MMORPG, but I found out that I can manipulate the X/Y/Z coordinates of my character through cheat engine. And I also found out that I can switch the targeted enemy by changing a value in my memory.

This game is made up by a launcher.exe and many dlls. One of them is called CryGame.dll in which is most of the game code I guess. I made a pointer scan on the memory which saves the targeted enemy, but most pointer chains which store my desired memoryregion are saved in the CryGame.dll.

Now to my question: Is it possible to inject code into the CryGame.dll or something similar in order to get this memory region and manipulate it (I am trying to make a simple bot for myself).

Or does anybody have another idea how to get this value? Normally I would simply make a dll injection into the games process and manipulate it, but since this game is made up of dlls, I can't really hook functions, since dlls change address after every reboot of the game, right?

Hope you understand what I meant, sorry for my enlgish.

Improve this question

1 Answer 1

Reset to default
2

You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs.

First, you'll need to get the address/handle (these are the same when discussing loaded modules) of the module you're trying to hook. A simple method to get that is to call either LoadLibrary or GetModuleHandle. The biggest difference is that GetModuleHandle will not load the dll in case it's not already loaded and will return null instead. You can probably load the dll yourself using LoadLibrary, so both APIs are valid.

Second, you'll need to get the address of the function you're interested in. You could use the return value of either GetModuleHandle or LoadLibrary as the current position of the dll and calculate the specific offset of certain functions using it. Alternatively, you can call GetProcAddress to get the address of any function that's exported by the DLL.

Keep in mind there are other ways to modify a behavior of a dll:

  1. You could patch the dll on disk (assuming there's no integrity checks employed).
  2. You can create a DLL proxy using DLL redirection.
Improve this answer
2
  • Wow thank you for your answer! Is there also a way to inject code at a specific location in a dll? For instance in an exe/process I can inject my code to put the value of the hp into my C++ variable and keep the rest of the function as it is. Can I do something similar?
    – QDA
    Sep 27, 2016 at 15:27
  • No. You'll need to find some manual way to find those structures in memory every time the process is started. The address may be fixed and you may use that but those may change between versions. You could also find pointers to those structures and use those to find the actual object you're looking for.
    – NirIzr
    Sep 27, 2016 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.