2

After playing around with pointers I'm trying to get the address of a specific function in a game. this function prints player input to the screen and broadcasts it to all online players since it's a multiplayer game. One can say that it's a chat.

I have really no clue how to find the address because I got no real entry point. Any clues are much appreciated.

My goal is to call this chat function within a simple Dll.

I'm using OllyDbg if this matters.

7

The usual approaches to this:

  1. Start typing what you want to say, but don't submit it yet. Use Cheat Engine to perform a memory scan for the string you have typed. Once you've found it, set a read-only HWBP, then submit the chat. The chat function should perform a read on the memory holding your chat string, setting off the BP.

  2. Hook strcpy() and related functions, compare the arguments to whatever you will be typing into chat. This is unlikely to succeed as the string copying code in the chat function will most likely be inline.

  3. Hook the function(s) the game uses to actually send your chat to the server/other players. It's possible that your game could be sending chat packets unencrypted, in which case you could simply hook send()/sendto()/WSAsend() and strstr() the send buffer. However if the game is an MMO it definitely encrypts all its packets. In this case, you'll want to intercept said packets before the encryption happens. Some games will implement a fairly simple function with parameters similar to send(), which will simply encrypt the send buffer and pass everything on to send(). Other games may have a loop which reads unencrypted send packets from some internal buffer and encrypts them before passing them on to send(). You can generally find this send function/loop by tracing back from send()/sendto()/WSAsend(). Once you have this function/loop hooked, you'd apply a method commonly referred to as "packet editing" in the game exploits sphere. Simply roll a GUI to output all the packets going through, and matching the timing of your chat activity to the packets you see in your GUI. Once you figure out which packets correspond to your chats you can just trace back from the calls for those packets and you'll end up at the chat function.

  • Hello and thanks for your reply. Sorry for the late answer - been very busy. I tried to follow your approaches and came to the result, that nothing really was working for me. The game's called GTA San Andreas and the dll of the multiplayer mod SA:MP is loaded straight into the gta_sa process. 1. input string showed up not completely, the last character was cut off and I actually don't know why. WSA functions (send, recv, connect) are located in the gta_sa module which is some kind of a joke because it's a offline game with no possibilities to do anything online if you don't use the mod. – user3183815 Feb 28 '14 at 19:52
  • However I tried to breakpoint it - didn't even trigger. I was exploring the use of the packets, how they are send and what is send. I came to the result that these packets have been encrypted and send via UDP but I did not found anything in the dll module about WS. Quite confusing. Looking to hear from you. – user3183815 Feb 28 '14 at 19:52
  • The packet-related functions you want to hook should be located in ws2_32.dll or wsock32.dll. The packets being encrypted and sent by UDP is normal and what I would expect from a multiplayer game, especially if they're using a peer-to-peer model. Hook/BP send/sendto/WSASend/WSASendTo in the dll's I mentioned, then trace back and attempt to reverse engineer the packet encryption process. – higaki Mar 2 '14 at 22:51
5

user3262342 gave a good answer; you can also try setting breakpoints on the following common text-drawing functions and then look at the callstack to see what function in your program drew the text:

  • Very useful, thanks. Going to try this now. – user3183815 Feb 28 '14 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.