I am trying to hack a game (not for cheating though) by introducing new built-in methods and functions in order to communicate with the game using sockets. Here is a small "pseudo code" example of what I want to accomplish:
Inside the Lua code I am calling my_hack()
and pass the current game state:
GameState = {}
-- Game state object to be passed on
function GameState:new()
-- Data
end
local gameState = GameState:new()
-- Collect game state data and pass it to 'my_hack' ..
my_hack(gameState)
and inside my_hack
the object is getting sent away:
int my_hack(lua_State * l)
{
void* gameState= lua_topointer(l, 1);
// Send the game state:
socket->send_data(gameState);
return 0;
}
Now, the big question is how to introduce my_hack()
to the game?
I assume, that all built in functions must be kept in some sort of lookup table. Since all Lua code is getting interpreted, functions like import
etc. will have to be statically available, right? If that is correct, then it should be "enough" to find out where this code is residing in order to smuggle my code into the game that would allow me to call my_hack()
in a Lua script.
There should be two options: The first is that the Lua built is embedded inside the executable and is completely static and the second is that all Lua code gets loaded dynamically from a DLL.
This question goes out to anybody who has a slightest clue about where and how I should keep looking for the built in functions. I've tried a few things with Cheat Engine but I wasn't too successful. I was able to cheat a bit ^^ but that's not what I'm looking out for.
This is what my current "progress" looks like:
I found some hints I'm trying to go after in the data section of the executable. For example IDA is giving me
.rdata:00D44210 dd offset aLoadfile ; "loadfile"
.rdata:00D44214 dd offset sub_90ECE0
.rdata:00D44218 dd offset aDofile ; "dofile"
.rdata:00D4421C dd offset sub_90ED20
.rdata:00D44220 dd offset aLoadstring ; "loadstring"
.rdata:00D44224 dd offset sub_90EC80
Now, I know that these strings here (loadfile, dofile, etc.) are actually the names of built-in functions that modders can use in Lua - a script language in order to change stuff in the game.
I am trying to find out at which point this address is being accessed for reading. For that I am using Cheat Engine and at this point I would like to stress that I am not trying to cheat here but to introduce new built-in functions in order to have more flexibility when it comes to modding.
However, the addresses which I see in IDA do not seem to be the actual virtual addresses. If I look at this address with Cheat Engine, which is just reading out the memory, I'm getting nothing.
So the question is if I will be able to find the correct virtual address of e.g. dofile
in order to read that out from my RAM.
What I hope to see in the end is from where these methods are getting accessed and in a much later step maybe find out where the actual code of dofile
resides. At the end I want to smuggle my code into the right place and introduce a new function my_hack
in order to get control of the program.