1

There's one function I want to find in a game. When you fall through the game map you are "teleported" to specific xyz coordinates. I used to have the memory address of this function, but since then the game has been patched and it no longer works. Also, this value was given to me by someone, so, I haven't found it myself. However, I did build the DLL injection program.

I have found the player's xyz coordinates and the safe xyz coordinate's pointer and offset values. So, this is the last piece of the puzzle.

I would guess you could use Ollydbg somehow to find this function, but I'm unsure of where to start and I usually just use cheatengine to find all of my values.

Improve this question

2 Answers 2

Reset to default
3

If you can start the program under Ollydbg (many game clients have code that detects if the software runs under a debugger and terminate in one way or another if it does), you could set a hardware breakpoint on the memory address where your player coordinates are.

This breakpoint will probably trigger quite often, everytime your player moves, so you should make it a "logging" breakpoint that logs the current address when it gets triggered, but allows the game to continue. After moving around and falling through the geometry, you will probably have a few memory addresses that triggered very often (when you moved), and some others that triggered only a few times (when you fell through and were repositioned). If you know what your function should look like, you'll probably recognize it when you disassemble around those few positions.

Another possibility would be getting the free version of IDA, use it to analyze the .exe file, then use the cross reference feature to find where a specific memory location is referenced. This has the advantage that it could work even if the executable has anti-debugger code, but if the executable doesn't access the memory location directly, you won't find anything. This could happen, for example, if the xyz coordinates are part of a larger structure, the software stores a pointer to the start of the structure somewhere, and only accesses the coordinates through that pointer.

A third approach, if you have the original code where your patch worked, would be to try and identify a byte sequence within the code that's uncommon enough (for example if it uses a specific constant somewhere) but doesn't depend on memory addresses, and search the new binary for the same byte sequence, in the hope the compiler produced the same code in the new executable.

Improve this answer
4
  • s27.postimg.org/5w7jiewdf/Untitled_1.jpg That's the function I need to find.
    – Jacob Fliss
    Jun 17, 2014 at 15:28
  • s13.postimg.org/uaesk9t1j/ollydbg.jpg Here is ollydbg
    – Jacob Fliss
    Jun 17, 2014 at 15:37
  • 2
    Your images are unclear, as the first one (the IDA screenshot) shows a function that doesn't seem to involve 3 co-ordinates at 4B4572, and doesn't show the disassembly at 4b459c; while ollydbg shows the function at 4b459c, which stores a lot of 0.0 values into a structure (fldz / fstp to some offset of the pointer in 7f94cc), which seems a strange start to a function that compares player coordinates and resets the player to a fixed value. But if that's the function you want, i'd search for the D9 EE D9 58 XX bytes in the hope the structure definition hasn't changed.
    – Guntram Blohm
    Jun 17, 2014 at 18:49
  • Actually, I just need to trigger a camera reset function. This is somehow connected to the game thinking the character has fallen through the map, so nothing else needs to be passed other than just triggering the function.
    – Jacob Fliss
    Jun 18, 2014 at 19:11
3

So you are looking for the teleport function if I understood you correctly.

The address you had will not work obviously, because the binary has changed. What I would do in your position is to get the previous version of the binary, for which you had the address of the function.

Open the old binary in IDA/Olly and observe that function (Ctrl+G or G and paste the address). Look at the instruction opcodes, and try to get a pattern out of it. Just an example for a pattern, but you should end up with something like: D9 05 B4 ?? 66 4C D1 ?? ?? ??.

You should Google "memory pattern scanner" if you don't know about the concept, or how to create the pattern, you can find a lot of topics about it.

Since IDA can search for bytes, all you have to do is open the new binary in IDA and "search for sequence of bytes", paste your byte pattern, and if your pattern is valid and you are lucky, you'll have a few results, one of them will be the teleport function most likely.

enter image description here

The other way I'd try it is this: You said you have the address + offset combination to the coordinates. Add that memory location in Cheat Engine, and observe where it gets accessed in cheat engine, and hope that there is nothing quirky behind the scenes, you should get a list of places that reads/writes your coordinates, one of them will be probably your teleport function you're after.

enter image description here

Don't forget about rebasing the addresses if necessary.

See this question.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.