Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
After playing around with pointers I'm trying to get the address of a specific function in a game. this function prints player input to the screen and broadcasts it to all online players since it's a multiplayer game. One can say that it's a chat.
I have really no clue how to find the address because I got no real entry point. Any clues are much appreciated.
My goal is to call this chat function within a simple Dll.
I'm using OllyDbg if this matters.
The usual approaches to this:
Start typing what you want to say, but don't submit it yet. Use Cheat Engine to perform a memory scan for the string you have typed. Once you've found it, set a read-only HWBP, then submit the chat. The chat function should perform a read on the memory holding your chat string, setting off the BP.
Hook strcpy() and related functions, compare the arguments to whatever you will be typing into chat. This is unlikely to succeed as the string copying code in the chat function will most likely be inline.
Hook the function(s) the game uses to actually send your chat to the server/other players. It's possible that your game could be sending chat packets unencrypted, in which case you could simply hook send()/sendto()/WSAsend() and strstr() the send buffer. However if the game is an MMO it definitely encrypts all its packets. In this case, you'll want to intercept said packets before the encryption happens. Some games will implement a fairly simple function with parameters similar to send(), which will simply encrypt the send buffer and pass everything on to send(). Other games may have a loop which reads unencrypted send packets from some internal buffer and encrypts them before passing them on to send(). You can generally find this send function/loop by tracing back from send()/sendto()/WSAsend(). Once you have this function/loop hooked, you'd apply a method commonly referred to as "packet editing" in the game exploits sphere. Simply roll a GUI to output all the packets going through, and matching the timing of your chat activity to the packets you see in your GUI. Once you figure out which packets correspond to your chats you can just trace back from the calls for those packets and you'll end up at the chat function.
user3262342 gave a good answer; you can also try setting breakpoints on the following common text-drawing functions and then look at the callstack to see what function in your program drew the text:
