Skip to main content
8 votes
Accepted

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
peter ferrie's user avatar
  • 4,709
6 votes
Accepted

Decrypting Lua Files

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
user29082's user avatar
  • 131
3 votes
Accepted

J2ME games obfuscator - Spyro and Tekken 5

No there isn't. You'll have to assign meangingful names yourself while reverse engineering. Just be glad that even with names stripped, Java is far easier to reverse engineer than native binaries.
Antimony's user avatar
  • 2,012
3 votes

Does Microsoft's C++ compiler add functions?

That really depends. There are two primary explanations to this phenomenon, which point to opposite answers. First, a compiler optimization known as "inlining" inserts the body of the called ...
Rolf Rolles's user avatar
  • 9,198
3 votes

I am reverse engineering SkiFree, where is the code for the Abominable Snowman's movement?

Is the source encrypted? I took a quick look and appeared disassembly worked ok. No function names (debug strings stripped) but we got 2 versions at-least I got my hands on, the older msdos/win3.11 ...
CodeAsm's user avatar
  • 31
3 votes

How can I extract *.c file hidden in an executable file (SkiFree)

It's not common for executables to include their own source code, so in general, the answer to your question is "that's not possible". That string likely appears in the binary due to some ...
Rolf Rolles's user avatar
  • 9,198
2 votes

OllyDBG - Game Hacking

It sounds to me like your problem is the code in VS, not what you've found through reversing. The beginning of the function there doesn't seem to matter in accordance to what you're trying to do. ...
dsasmblr's user avatar
  • 2,234
2 votes

How to 'hack' the chat box in an online game

One approach is to use DLL Injection. You would have to identify the functions that prints chat, then you can install a hook and make it process a different text. Here's an example of this: https://...
Daniel Sloof's user avatar
2 votes

How to 'hack' the chat box in an online game

Yeah, there are multiple ways that this can be accomplished, depending on the type of game. If the network packets of the game aren't encrypted you could probably sniff the traffic for the "chat ...
codecustard's user avatar
2 votes

Unity game: Assembly dll embedded inside the exe

Nexide, wild guess but your game is complied with il2cpp. You could use Scylla to dump GameAssembly.DLL and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat ...
Micro's user avatar
  • 21
2 votes

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

Short answer: Because your average program will never access those values. Long answer: Peter ferrie's answer states there's usually nothing present at that offset. That is not true. The shortest ...
user2347953's user avatar
2 votes
Accepted

What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?

There is not a single Anti Cheat(AC) I am aware of that is kernel mode without using ObRegisterCallbacks to block access to the process. In fact a good number of the AC drivers I've looked at are ...
Pickle Rick's user avatar
2 votes

How to extract .nsh file?

The files you linked, whilst all having an NSH extension actually appear to be slightly different archive formats. Each of these archive file appears to contains a number of graphics shaders compiled ...
Ian Cook's user avatar
  • 2,558
2 votes

Decrypting Lua Files from game

v5 = (_BYTE *)(*(int (__fastcall **)(cocos2d::CCFileUtils *, const char *, const char *, unsigned int *))(*(_DWORD *)this + 16))( this, a2, "...
Minh Nguyen's user avatar
2 votes

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the ...
morsisko's user avatar
  • 696
2 votes
Accepted

Finding function from pattern

In IDA, you can find sequences of bytes via Search->Sequence of bytes. That said, if your byte pattern is poorly-chosen (for reasons such as that it includes relocatable byte sequences, or it was ...
Rolf Rolles's user avatar
  • 9,198
2 votes

Does Microsoft's C++ compiler add functions?

The generated machine code is going to vary by compiler, and even within the same compiler depending on compiler optimization settings. Sometimes optimizations will "inline" functions, ...
chentiangemalc's user avatar
2 votes

Assign a constant value to an ARM register

ARM limits the values of constants you can use in the MOV instruction: The complete MOV instruction needs to fit into 32 bits, so there is no space for an arbitrary 32-bit constant. Probably 0x25000 ...
Michael Karcher's user avatar
2 votes
Accepted

How can I extract *.c file hidden in an executable file (SkiFree)

the best you can get: https://github.com/yuv422/skifree_decomp A source code reconstruction of the 32bit version of Skifree (v1.04) back to C, compilable with Visual Studio 6. so someone already did ...
llm's user avatar
  • 336
2 votes

Creating the SkiFree 2 dream... An introduction

this is not about reverse engineering, you need to ask on stackoverflow about Windows/C programming to the "Progess" you talking about [x] Convert functions to C [x] Convert data to C [ ] ...
llm's user avatar
  • 336
1 vote

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg
user3288107's user avatar
1 vote

Retrieve user data as if it were the game making the request

EDIT: Just realized that I completely misunderstood your question. It seems you already have IPs. You're just trying to decode packet information, in which case I have no answer. However, I'll leave ...
Steve's user avatar
  • 66
1 vote
Accepted

How do I find missing/undefined vtable functions in IDA64?

By finding the constructor for the structure type that you're looking at, making note of the VTable address, and adding the indicated offsets to obtain the concrete function pointers for the calls in ...
Rolf Rolles's user avatar
  • 9,198
1 vote

Reverse Engineering API's of Browser games

This depends on the implementation of the game in the browser. The API is likely a RESTful API and the format for data exchange is likely JSON. A modern full stack web development course will often ...
pythonpython's user avatar
1 vote

Modifying UnityPlayer.dll with dnSpy or other

You can disassemble GameAssembly.dll with GHIDRA, IDA or any other disassembler that supports x86. Decompilation is also available but nowhere near as with dnSpy because code is not C# anymore. It is ...
argie's user avatar
  • 21
1 vote
Accepted

Modifying UnityPlayer.dll with dnSpy or other

UnityPlayer.dll is the engine itself - it doesn't contain any user-made scripts. Assembly-CSharp.dll is the main user script dll, and if, as you say, it isn't being affected, you're either modifying ...
redrosid's user avatar
1 vote

How do you recommend going for applying minor changes in an executable through a dll?

I have no experience in writing a DLL, but what I understand is that I should be able to compile functions inside the DLL then somehow call them from the executable, and my hope would be that I don't ...
mathiasxx94's user avatar
1 vote

Get string from function and pass it to another program

Assuming you're trying to intercept function calls and manipulate / get the input to that function, you are going to need to hook it first. I'd recommend reading about function hooking (there's a ...
stylo's user avatar
  • 121
1 vote

Decrypting some possibly XXTEA encrypted lua/game files

Next time please include the original apk in your question. Luckily I'm working on the same game so I can help somewhat. Get the old apk (yzjlzl_2.80_1_20180918_170403_83de83.apk) from bilibili (...
Minh Nguyen's user avatar
1 vote

J2ME games obfuscator - Spyro and Tekken 5

Maybe. If the Source File of the Classes are present you can reverse the Class names. Unfortunatly there are no ways to retrieve Methods and Fields names. The only thing that you can do for that is ...
Princekin's user avatar
  • 141

Only top scored, non community-wiki answers of a minimum length are eligible