1

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am looking to do this for is Train Simulator (i know, don't laugh) and the game uses lua to script all of the engine functionality within the game. All the 3rd party devs get to see is the lua script that they write.

Inside the games lua there is core functions. The main ones:

function Initialise()

end

function Update(time) -- time is the interval since the last update

end

There is also C functions that are used as such:

Call("SetControlValue", name, index, value)
or
Call("GetIsPlayer")

These return different values.

What i have so far with my DLL is as follows:

#include <windows.h>


BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        /* The DLL is being loaded for the first time by a given process.
        Perform per-process initialization here.  If the initialization
        is successful, return TRUE; if unsuccessful, return FALSE. */
        MessageBoxA(0, "TSDll has been attached !", "Train Sim Dll", MB_ICONEXCLAMATION | MB_OK);
        break;
    }
    return TRUE;
}

And this works. In my train sim engine script i am using the loadlib library to load the DLL.

libinit, err = loadlib("plugins\\TSDll.dll", "libinit")
if _G["libinit"] then 
    Print("TSDll Library Loaded!")
    libinit()
else
    Print("loadlib on TSDll failed: ")
    Print(err)
end

And i get this result: Dll Popup

So the dll initialises properly.

The problem i face is that the Lua library is directly built in to the game binary (as far as i know) which means i am unable to reference lua.dll for fundamental functions such as lua_pushstring. Does anyone here know how i can find the address of these functions. I know a dll like this has been made before but the person who did it has been very secretive about how it has been done.

Thanks, Dan

  • What tools have you been using to reverse engineer your target? It stands to reason if you were using IDA that FLIRT/signatures could be of help. However, you may need to figure out first whether you are dealing with Lua or LuaJIT and (roughly) which version. The strings utility should be of help here. – 0xC0000022L Feb 26 at 9:43
  • I haven't been using anything to reverse engineer yet, that is what i am trying to figure out how to do. – Daniel Holmes Feb 27 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.