5

Why do most hackers/modders use pointers instead of editing the static region of the game executable? For example I downloaded so many trainers and I can see most of them are using pointers. I prefer to set a break point on the value and track the caller function, this works 100% of the time where I only have to nop the instruction or alter it or at worst make my subroutine and code cave it.

Is there a downside with my method that i'm not aware of?

Improve this question

2 Answers 2

Reset to default
5

There are many reasons for this. I'll jot down a bunch that I can think of off the top of my head.

  1. Many hackers use things like Cheat Engine's built-in automatic pointer scanning functionality because it's easy. Even if they don't understand what's going on, the YouTube videos and/or tutorials they've followed in the past have pigeonholed their approach.
  2. Pointers tend to be easier to code into trainers than, say, an advanced script that requires code-caving/memory allocation to provision for a code injection. This is a subjective point, but something I've noticed. Of course, if all that's needed is to overwrite X number of bytes with NOPs and the person didn't do that, well, see my first point above or the last bit of point 5 below.
  3. Depending on the functionality of any given trainer, they may be choosing to give the user more flexibility with a value than simply NOP-ing or modifying writes/reads.
  4. There are countless trainer templates and libraries out there that make the process of making trainers as cookie-cutter as possible. Many of them emphasize the use of pointers to make trainer generation as straight-forward as possible.
  5. Depending on where you obtained the trainers from, between CE's pointer scanning functionality and custom tooling that more prominent cheat makers make use of, it's just faster for some to go the pointer route so as to get a trainer out there ASAP and not have to initially worry about bugs/testing requisite of fleshing out script-based cheats.
  6. Cheat persistence across game updates, possibly. Pointers are as apt to change as anything else with an update of a game's code, but it's worth a mention insofar as what someone could be thinking with their choice.

There are plenty more, but hopefully that will get you thinking in directions as to why someone might choose pointers over something script-based.

Improve this answer
3
  • I had one more thing in mind, pointers do not change on any updates, is that true?
    – Cyb3r
    Commented Apr 22, 2018 at 7:16
  • That's what I addressed in point 6 above. Pointers are as liable to change as anything else, depending on the update. But depending on the time spent on researching any given game, you may find that pointers for something will persist across updates. You really don't know what the case will be until you dig in (or, as can be the case, you pick an approach and hope for the best, then deal with whatever you might have to if the cheat breaks later).
    – dsasmblr
    Commented Apr 22, 2018 at 15:44
  • 1
    Sorry I just noticed that you edited the post, I have read your post earlier but didn't have time to comment.Thank you for contributing!
    – Cyb3r
    Commented Apr 22, 2018 at 15:49
2

Some programs don't like it when you change their code, some protectors check for memory modifications. Once I used a hack that patches directly the code and got instantly banned from the server.

Improve this answer
5
  • 1
    Good point. Can you please elaborate on how could they implement such anti-cheat. Are they calculating the executable hash and then check it on run time? Because I had a trouble once on finding the anti cheat function in a game which they was banning players who modify any bytes in the executable.
    – Cyb3r
    Commented Apr 22, 2018 at 7:21
  • 1
    Good addition, COB RCE. To add to this, some programs also check the values in memory addresses for any modifications, so pointers won't necessarily work, either (this is very game-dependent, so you learn what you're up against as you dive in). Two games I hacked recently had some fun anti-cheat implementations that watched for value modifications in addresses, as well as modifications to game code (like Dark Souls 3, which cyclically scans code and restores any modified bytes). In those two games, one would insta-kill your character if you modified a value, and the other would close the game.
    – dsasmblr
    Commented Apr 22, 2018 at 15:49
  • @dsasmblr Did you get around it and make your cheats work somehow?
    – Cyb3r
    Commented Apr 22, 2018 at 15:55
  • Regarding your question, 0x00, your guess is as good as any. There are many, many tricks used in anti-cheat. A great way to learn and familiarize yourself with many of them is to spend time in communities like MPGH and UnknownCheats (Google them), and put what you learn into practice. Depending on what your targets tend to be, it can get expensive. Expect to be banned and then have to purchase the game again. As for your second question, yes, I got around them. They were fun challenges. Give them a try sometime: Caveblazers and UnEpic are the two games. Try modifying gold in each game... =)
    – dsasmblr
    Commented Apr 22, 2018 at 15:58
  • I guess every protection has its own implementation, the ones that come to my mind (not specific to games though) are VMProtect and Themida, the first one says that it secures not writable sections before OEP is reached, the second one talked about CRC and didn't precise its scope, as @dsasmblr said it should be a cyclic scan that checks the code and restores/crashes the game (if the game is packed there's no way to restore the modified bytes because they are calculated at runtime so its probably done by checking some CRC and crash in case of failure)
    – COB RCE
    Commented Apr 22, 2018 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.