[Guide] Basic DLL Editing 1: One Charge Fireball

12/04/2009 22:00 Kevsprk#1
Well, this isn't the guide I said I would do, but I think this better shows the basics to get people started editing. The only problem with doing a guide on this one is that not all people have fireball, so they can't test it. I'll post the 2nd guide in a few days and show something more general that all people can test their work..

Step 1: Download [Only registered and activated users can see links. Click Here To Register...] and [Only registered and activated users can see links. Click Here To Register...]. Install IDA and extract Olly to a folder where you can access it.

Step 2: Open Skill.dll up in IDA Pro and let the auto analysis complete. (This can take a while) You will know its complete when, down at the bottom, it says "The initial autoanalysis has been finished." You can go try doing this before it finishes, but its best to wait.

Step 3: Find the Fireball section. This can be done by using the search function at the top of IDA. Make sure the search choice is on "Text" and search for "CSkillFireball" until you find this.

[Only registered and activated users can see links. Click Here To Register...]

Step 4: This is the beginning of the skill section on Fireball. Now, we need to find where it checks for 5 charges being loaded. This is always the hardest part for me: finding what to edit. The rest is easy. Look through the code until you find this.

[Only registered and activated users can see links. Click Here To Register...]
[Notice: Look for the CMP al, 5]


Step 5: This is pretty easy to understand: It CMP's (compares) the number of current loaded charges against the number you need, five. If you have five, it JNB's (jump if not below) to the attacking sequence. Instead of JNBing, we need it to JMP (jump no matter what).

Step 6: Open up OllyDbg and Skill.dll. Go back to IDA and look to the left of where you saw the code with the JNB. You should see ".text:" and then a number. Copy the number. In Olly, press CTRL+G. Paste the number into the box, and click "Ok". Olly will go to the code you found in IDA.

[Only registered and activated users can see links. Click Here To Register...]

Step 7: Editing. This is the easy part. Just double click the code in Olly (where it says "JNB SHORT Skill.xxxxxx") and change the JNB to JMP. As explained above, this will make it always jump to the code saying you can fire. Olly makes the code you changed appear red, so you can keep track of your changes.

[Only registered and activated users can see links. Click Here To Register...]

Step 8: Save the file. Right click in the CPU screen in Olly, and press "Copy to executable" and "All Modifications". Then click "Copy All". Now, right click the new box that came up and press Save file. Over write your old one, and presto! You can now fire fireball with any number of charges.

Please feel free to ask any questions, or tell me if I forgot something. And don't forget: In a few days I'll make a more generic guide that anyone can use. This was just so simple, I though it would be good to show the basics with it.
12/04/2009 22:13 Black Fomor#2
See, this is a REAL guide. unlike this piece of (fill in blank) ---->[Only registered and activated users can see links. Click Here To Register...]

(bi-polar moment)
Nice job on the guide. :D
12/04/2009 22:19 AKB990#3
Good job ^_^
12/04/2009 22:32 Dark Raccoon#4
Nice. :3
12/04/2009 22:37 jets2fly2#5
my Olly's fucked up too, i cant seem to save any thing once i make it :l

i cant even open it in olly tho >> (LOADDLL.EXE has failed blah blah blah.)
12/04/2009 22:42 Uncreative.#6
Very nice. :3
12/04/2009 22:54 Kevsprk#7
Thanks for the kind words, everyone :D
12/04/2009 23:05 Uncreative.#8
Um.. is it me or does this get detected O.o
Because I just tried running Mabi and Hackshield detected something..
12/04/2009 23:09 jets2fly2#9
its just you
12/04/2009 23:10 Uncreative.#10
Quote:
Originally Posted by jets2fly2 View Post
its just you
I don't get what went wrong then, because I did the guide right.. ><
12/04/2009 23:10 Kevsprk#11
... Make sure you close Olly.

And IDA. For me, IDA gets detected when I have it open with
mabi for about 25 minutes.
12/04/2009 23:31 jets2fly2#12
got any ideas about why LOADDLL.exe fails for me? >>
12/04/2009 23:33 Uncreative.#13
Quote:
Originally Posted by jets2fly2 View Post
got any ideas about why LOADDLL.exe fails for me? >>
Run olly as admin, if that doesn't work, then reinstall olly. If that still doesn't work, then right click LOADDLL.exe in your olly folder and make it so it always runs as administrator.

Quote:
Originally Posted by Kevsprk View Post
... Make sure you close Olly.

And IDA. For me, IDA gets detected when I have it open with
mabi for about 25 minutes.
I closed olly, and IDA. Does it take 25 minutes for IDA not to d/c or does it take IDA 25 minutes to d/c
:P
12/04/2009 23:36 jets2fly2#14
nice double post. btw i AM the administrator, its my pc.
im on the root admin account, and i have reinstalled it a couple times
12/04/2009 23:36 lagtard#15
This is the guide I wanna see! Thanks a lot.

BTW, can I do

cmp al, 1 instead?