A bit of help REing this game?

[benjameen]

Hallo!

I'm a pretty sound Python guy - so I'll always contribute and return the help wherever possible!

Wish I could speak German as it is a beautiful language but I'll have to stick to the good ol' English, so there goes my question:

This game that I am testing on is a random MMORPG picked and it's called Talisman Online, the thing with this game is that it employs IsDebuggerPresent / Does (By the looks of it) a windows strings search for known debuggers and perhaps a ton more. Please note that I am currently learning, so I am a total newbie!

Actually, this game could be an unicorn, nobody has ever done an advanced bot/hack for it, it's small, that's true - but still, it's a good place to practice and some developer once said that the protections were crazy.

The code, when trying to RE it, won't even allow me to jump anywhere, it just plainly goes on exit the minute I press "Open Process", which makes it super-difficult for me! I understand the concept of an anti-debugger bypass and what it implies, but this one just killed me.



Here's the stack:


For a newbie like me, this is super frustrating. I'd appreciate some directions.
(You can download the game from
Usually the torrent is super-fast)

Has anyone had experience with it? I would dearly appreciate the help.
(Sorry for the unliked links, apparently I'm doing something wrong and I don't know what.)

[Mostey]

Protections are crazy in terms of what?

IsDebuggerPresent can be detoured using different strategies. Which debugger do you use? I had a game similar to yours which also closed after attaching OllyDbg and found out, that they used the IsDebuggerPresent function, just like your game does. I came up with attaching OllyDbg2 (the new version) and the function did not trigger.

Anyways, you could inject your dll, hook the ExitProcess function and place a sleep of some seconds in there. You'd probably have enough time to attach your debugger to the process and get access to the assembler code.