8 votes
Accepted

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

In PE files, sections are generally mapped at addresses that are multiples of 4kb (this is the default value, though it can be overridden). That means that even a section that is a single physical ...
user avatar
  • 4,511
6 votes
Accepted

Decrypting Lua Files

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
user avatar
  • 131
3 votes
Accepted

J2ME games obfuscator - Spyro and Tekken 5

No there isn't. You'll have to assign meangingful names yourself while reverse engineering. Just be glad that even with names stripped, Java is far easier to reverse engineer than native binaries.
user avatar
  • 1,972
3 votes

Does Microsoft's C++ compiler add functions?

That really depends. There are two primary explanations to this phenomenon, which point to opposite answers. First, a compiler optimization known as "inlining" inserts the body of the called ...
user avatar
  • 7,814
2 votes

OllyDBG - Game Hacking

It sounds to me like your problem is the code in VS, not what you've found through reversing. The beginning of the function there doesn't seem to matter in accordance to what you're trying to do. ...
user avatar
  • 2,154
2 votes

Unity game: Assembly dll embedded inside the exe

Nexide, wild guess but your game is complied with il2cpp. You could use Scylla to dump GameAssembly.DLL and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat ...
user avatar
  • 21
2 votes

Decrypting Lua Files from game

v5 = (_BYTE *)(*(int (__fastcall **)(cocos2d::CCFileUtils *, const char *, const char *, unsigned int *))(*(_DWORD *)this + 16))( this, a2, "...
user avatar
2 votes

Why is it "safe" to write to ModuleBase.exe+0x100, and possibly other header offsets after PE is mapped to memory?

Short answer: Because your average program will never access those values. Long answer: Peter ferrie's answer states there's usually nothing present at that offset. That is not true. The shortest ...
user avatar
2 votes
Accepted

What is the usual way to determine if a Game uses KernelMode or UserMode Anti cheat?

There is not a single Anti Cheat(AC) I am aware of that is kernel mode without using ObRegisterCallbacks to block access to the process. In fact a good number of the AC drivers I've looked at are ...
user avatar
2 votes

How to extract .nsh file?

The files you linked, whilst all having an NSH extension actually appear to be slightly different archive formats. Each of these archive file appears to contains a number of graphics shaders compiled ...
user avatar
  • 2,164
2 votes
Accepted

Finding function from pattern

In IDA, you can find sequences of bytes via Search->Sequence of bytes. That said, if your byte pattern is poorly-chosen (for reasons such as that it includes relocatable byte sequences, or it was ...
user avatar
  • 7,814
2 votes

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

Generic answer: When you want to unpack/decrypt files like this, the best idea is always to reverse the program that is able to read the file correctly. I think that in Windows operating system the ...
user avatar
  • 686
2 votes

Does Microsoft's C++ compiler add functions?

The generated machine code is going to vary by compiler, and even within the same compiler depending on compiler optimization settings. Sometimes optimizations will "inline" functions, ...
user avatar
1 vote

How could I find a call of a function thats only referenced inside a vftable?

From that screenshot you can see the base of the vtable is referenced - likely when the object is constructed. You'll need to keep an eye on where the object gets stored and follow it through the code
user avatar
1 vote
Accepted

How do I find a function and find out what it does using reverse engineering?

I'm kinda new to reverse engineering, but I'll tell you what I know. First things: The code is not decompiled, it is just a machine code, but a readable one. If you have an older version of that ...
user avatar
1 vote

How would I start to decode this? Asking for help from a friend (Alien Hominid Invasion)

If you're serious about RE-ing those .EXE files, then take a look into IDA. IDA https://www.hex-rays.com/products/ida/ There are other applications that work some what, such as Ollydbg
user avatar
1 vote

Stuck in finding the algorithm of a save game file CRC/checksum

It's definitely not a CRC32 of any kind. CRC calculation is linear under XOR. This means if you flip a certain bit in the input, the effect on the CRC (old value XOR new value) will always be the same....
user avatar
1 vote
Accepted

How can I get the correct offset from that instruction?

[RAX=0x33307EE0 + RCX=0x0 * 0x8] == [0x33307EE0+0x0] = 0x33307EE0 compare whatever is at Address 0x33307EE0 with r9 register [RAX=0x33307EE0 + RCX=0x377F1FD0 * 0x8] == [ 0x33307EE0 + 0x1bbf8fe80] = ...
user avatar
  • 14.9k
1 vote
Accepted

How do I find missing/undefined vtable functions in IDA64?

By finding the constructor for the structure type that you're looking at, making note of the VTable address, and adding the indicated offsets to obtain the concrete function pointers for the calls in ...
user avatar
  • 7,814
1 vote

Reverse Engineering API's of Browser games

This depends on the implementation of the game in the browser. The API is likely a RESTful API and the format for data exchange is likely JSON. A modern full stack web development course will often ...
user avatar
1 vote
Accepted

Modifying UnityPlayer.dll with dnSpy or other

UnityPlayer.dll is the engine itself - it doesn't contain any user-made scripts. Assembly-CSharp.dll is the main user script dll, and if, as you say, it isn't being affected, you're either modifying ...
user avatar
1 vote

How do you recommend going for applying minor changes in an executable through a dll?

I have no experience in writing a DLL, but what I understand is that I should be able to compile functions inside the DLL then somehow call them from the executable, and my hope would be that I don't ...
user avatar
1 vote

Get string from function and pass it to another program

Assuming you're trying to intercept function calls and manipulate / get the input to that function, you are going to need to hook it first. I'd recommend reading about function hooking (there's a ...
user avatar
  • 121
1 vote

Decrypting some possibly XXTEA encrypted lua/game files

Next time please include the original apk in your question. Luckily I'm working on the same game so I can help somewhat. Get the old apk (yzjlzl_2.80_1_20180918_170403_83de83.apk) from bilibili (...
user avatar
1 vote

J2ME games obfuscator - Spyro and Tekken 5

Maybe. If the Source File of the Classes are present you can reverse the Class names. Unfortunatly there are no ways to retrieve Methods and Fields names. The only thing that you can do for that is ...
user avatar
  • 141
1 vote
Accepted

Unity game: Assembly dll embedded inside the exe

I successfully dumped all the dlls using MegaDumper, I had to compile it myself since there are no binaries provided.
user avatar
  • 41
1 vote

Unity game: Assembly dll embedded inside the exe

You can use de4dot, its best to restore a packed assembly, if failed to unpack files try x64dbg and ScyllaHide plugin to dump and restore the dll. Edit: Win32 dumper doesn't show .Net assembly and ...
user avatar
1 vote

Finding lua C functions compiled binary

As you said, the Lua engine is embedded directly into the game. It's inside plugins/GameManagerVC.dll (or GameManagerVC64.dll in case of 64-bit). So, first step will be finding out, which version of ...
user avatar
1 vote
Accepted

x64dbg - Locating where data is initially written

If you know where the data is going to be before it's written, you can set a write hardware breakpoint and it should stop whenever that memory location is populated. Otherwise, you'll to reverse ...
user avatar
  • 231
1 vote

Issue with debugger - black screen and freeeze after loading game executable

I have found temporary solution to my issue. I have enabled option "Stay on top" (CTRL+F5) in x32dbg. This way I can go back to debugger to resume execution. It would be better to also enable window ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible