dsasmblr
  • Member for 4 years, 6 months
  • Last seen more than a week ago
Inject code into exe
Accepted answer
8 votes

Start here--specifically, the third technique: "The CreateRemoteThread & WriteProcessMemory Technique". To quote: Another way to copy some code to another process's address space and then ...

View answer
What is the difference between IDA and OllyDbg?
7 votes

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...

View answer
REPL for x86 assembly?
7 votes

WinREPL is a solid go-to! WinREPL is a "read-eval-print loop" shell on Windows that is useful for testing/learning x86 and x64 assembly.

View answer
Stone's PE Encrypter v2.0
Accepted answer
6 votes

Depending on what you're looking to accomplish, you have a handful of options: Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, ...

View answer
Dealing with instructions that are accessed by multiple pieces of data
Accepted answer
6 votes

The joy of shared instructions! Here are a couple of ideas for you to consider, both of which I'm going to be using Cheat Engine to demonstrate, because it's fast becoming the superior dynamic ...

View answer
How to decrypt encrypted script files for a game?
6 votes

There are two noteworthy communities dedicated to reversing file formats with video games: XeNTaX and ZenHAX Both of them have their own respective applications used for creating scripts that unpack ...

View answer
Change binary without damage
5 votes

If I'm understanding your question correctly, then what you need to do is be mindful of your bytes when patching. Ideally, your patch will be less than (in which case you can use NOPs [byte 0x90] in ...

View answer
Check if exe is 64-bit
5 votes

Here's a fun, quick little trick if in a Windows environment and you're checking for an x86 or x64 binary: Right-click on the application. Click Properties. Click the Compatibility tab. In the ...

View answer
Is it possible to access the higher part of the 32-bit and 64-bit registers? If so, which ones?
5 votes

Update: Thanks to Nirlzr, I see I missed the emphasized point at the bottom of the post. This answer, though not what OP is looking for, may serve useful for anyone down the road who is looking for a ...

View answer
What are the steps to reverse engineering a Shockwave .DCR file?
Accepted answer
5 votes

There's a lot to Google on the topic, so take some time to do that and learn about what the *.dcr format is. A great initial point of reference for you is this post on the ZenHAX forum, where a script ...

View answer
Game cheating: Pointers vs Static memory editing
Accepted answer
5 votes

There are many reasons for this. I'll jot down a bunch that I can think of off the top of my head. Many hackers use things like Cheat Engine's built-in automatic pointer scanning functionality ...

View answer
Information about packers
Accepted answer
5 votes

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...

View answer
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
4 votes

Outside of maybe custom plug-ins or perhaps buried features and usability differences, there's really no incentive to use OllyDbg over x32dbg/x64dbg. Since OllyDbg was the debugger of choice for so ...

View answer
Prevent game from pausing on lost focus (Fallout New Vegas)
Accepted answer
4 votes

Wouldn't it be great if there was a way to filter through functions that have been called vs. ones that haven't, such that you could weed out the thousands of useless function calls and hone in on one ...

View answer
Moving integer to xmm register
Accepted answer
4 votes

To move a number into an XMM register, you'll first need to move that number into a memory address since you can't move an immediate into an XMM register (meaning, you can't do something like mov XMM1,...

View answer
Visual Win32 (UI) style?
4 votes

That looks to be Sciter, previous known as HTMLLayout. That should lead you to the appropriate documentation necessary to study what those functions do. Source: The Google Machine

View answer
What is a "goodboy/badboy"
4 votes

The "good boy" is the thing that lets you know you were successful in your cracking/patching. The "bad boy" is the thing that lets you know you're unsuccessful. In a commercial app, a "good boy" ...

View answer
my question is what means proc near?
Accepted answer
4 votes

Insofar as proc and endp, start here. A good explanation for nearcan be found from this document, which states as follows: Attribute is NEAR if the Procedure is in the same code segment as the ...

View answer
How to get rid of this error during pointer scan?
Accepted answer
3 votes

That is not an error. It's a message you will receive the first time you start a pointer scan with a new address. After you've scanned once, you can save that pointermap with which to compare against ...

View answer
How decrypt hexadecimal javascript code?
Accepted answer
3 votes

Those hex values could represent anything. Look for online converters that convert hexadecimal to text (consider various formats), dec, etc. and see if the results make any sense. If not, then they ...

View answer
Finding the player animation function of a game
3 votes

Are you looking for the function to modify locally on the client, or are you trying to identify a function that will handle outgoing coordinate data to move a player remotely? I'm going to assume the ...

View answer
Using cheat engine to activate a modified version of a lua script
Accepted answer
3 votes

Unfortunately, as a beginner, there's a LOT for you to learn where this topic is concerned. It's not that it's particularly outside of your grasp to understand, but rather that it's going to take ...

View answer
How to deobfuscation the public class names .NET
3 votes

Converting multiple comments of mine to an answer for future readers: You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name ...

View answer
reverse engineering a website for the Html, css and javascript
3 votes

If what you see rendered on the page is sufficient, then just save the complete page via your browser and modify what you want changed. If you want to be more granular about seeing what the page is ...

View answer
Getting the correct memory address for a specific value
3 votes

The reason his memory addresses weren't changing in that scenario is because the game is 32-bit and loaded into memory conventionally per this and this (do a CTRL + F for 0x400000 and read the ...

View answer
How to bypass or block GetSystemTime?
3 votes

I'm going to reply to this without making any assumptions. I have had to do this very thing before for a client regarding non-copyrighted abandonware. Your results may vary. As for your specific ...

View answer
How to locate dynamic instructions?
3 votes

Being an avid Cheat Engine user and game-hacker, I can walk you through a specific example that should give you solid clarity. First, we'll use this arbitrary bit of code to work with: 7A1A7A162 - ...

View answer
Are there any crackme sites made for cheat engine or to practice game hacking particularly?
2 votes

Your best "crack-mes" for games are games themselves! If spending money on games is a barrier to entry you'd rather not venture, then consider the following: Demo/trial/free-to-play games on Steam. ...

View answer
Inversion of input parameters in ASM
Accepted answer
2 votes

Calling Conventions: You may be referring to calling conventions and order of parameters being pushed. If so, here is an answer addressing as such. You can read more about calling conventions in ...

View answer
OllyDBG - Game Hacking
2 votes

It sounds to me like your problem is the code in VS, not what you've found through reversing. The beginning of the function there doesn't seem to matter in accordance to what you're trying to do. ...

View answer