In the last Tutorial, we learned, how to unpack the Client, and remove the hacking-protection.
This enables us to use Debuggers, to analyze the Client.
Some stuff might become realy annoying, if we have to do the same things over and over again,
whenever the client changes. This tutorial will show you, how you can automate such operations,
if you've managed to find out stuff once.
Our goal in this tutorial will be, to filter usefull stuff from the client, without even having to run it
Step 1: Find out Stuff
This enables us to use Debuggers, to analyze the Client.
Some stuff might become realy annoying, if we have to do the same things over and over again,
whenever the client changes. This tutorial will show you, how you can automate such operations,
if you've managed to find out stuff once.
Our goal in this tutorial will be, to filter usefull stuff from the client, without even having to run it
Step 1: Find out Stuff
Step 2: Realize how the Client handles themQuote:
we've analyzed the DE client, and found the MainBaseAdress, and the offset to the CharStruct.
in the current DE client, they look like this:
Code:DWORD mainBaseAdress: 0x0070D968 DWORD charStructOffset: 0x00000ADC
Step 3: Search the Client for the desired adressQuote:
All Character informations are stored in one and the same struct in 4Story.
if the Client want's to access the struct, he needs to figure out the Adress too.
in asm that might looks like this:
the CPU parses adresses from the right, to the left.Code:mov eax, [mainBaseAdress] // eax now stores the adress, the mainBaseAdress points to mov eax, [eax + charStructOffset] // eax stores the adress of the Character Struct
this means our mainBaseAdress (00 70 D9 68) have to be stored as (68 D9 70 00) somewhere in the client.
Step 4: Grab the CodeQuote:
I will use OllyDbg, since i did it in the last tutorial too.
1. Get into the main Modules code (check the last tutorial if you don't know how to)
2. Press CTRL + B to start a Binary Search, and search for the reversed mainBaseAdress
3. Press CTRL + L, untill you've found a nice piece of code, containing your adress
Quote:
to be able to filter the information from the client, it shouldn't be just 2 lines of code.
the best thing would be to scan for a full function.
even better would be a function containing more than just one information, we wanna filter.
the TClient got one small function containing both of the named informations.
Step 5: Eliminate useless and variable StuffQuote:
the easiest way to get the code out of olly, is to mark it and press CTRL + C
now it's stored in the clipboard, and can be pasted into your favorite editor.
the code looks like this in my case:
Step 6: Write the ToolQuote:
now it's time to decide which method we wanna use to filter the code later. i will use AutoIt to build the final tool.
the most efficient way, to handle such a lot of characters in autoit, are the regex functions.
if we compare the function to the same one in other clients, we notice, that the main code stays the same.
the only thing that might differ, are the values in the code.
regex offers realy easy to use placeholders. since we're scanning HEX-code only, we can simply replace all numbers by:
beside that, we only need the binary code. the asm code, adresses and special stuff can simply be removed.Code:.{[length of number]}
the cleaned up table looks like this:
as you can see, i've added brackets, to the values we wanna filter later. This tells regex, to only save those values, and ignore the rest.
the last step now is, to remove the newlines to get one single string, we can use as pattern later in our tool =)
Step 7: Proof of conceptQuote:
As allready mentioned before, i'll use AutoIt to build the final tool.
since most people in this section seem to be kinda familar with autoit, the code shouldn't need any further explanation:
(i've added lots of comments, which should be self explaining)
Bonus:Quote:
just as a proof of concept, i'll attach the script and coimpiled versions for x64, x86 and add a screenshot,
showing the script used on 4Story DE/EG, to proof, that it works not only with the current DE client.
Quote:
knowing the path to the charStruct can speed up finding other offsets (the first time) extrmely, it's pretty easy to build a tool, which scans the charStruct for specific values.
here's a simple example for an extremely easy tool:
screenshot:
