gamehacking.co.uk - It's an Addiction....Feed your Addiction

forgot password? register NOW! nick: password: remember me

### PART 1 OF 2:1ST AUGUST 2005:
Making a 1 hit kill & Kill All by apache

Start
Ok lets start
Open up TSEARCH
EXPLANATION:
Writing to our codecave address:
turn off this option
IF THERE IS ANYTHING YOU DO NOT UNDERSTAND
...
THE GAME :Hellforces

Making routines for 1 hit kill and flag routines for kill all options(see part 2)
Class: intermediate to advanced
be prepared for a very very long tutorial , i will go into as much depth as i can to get the point across
and attempt to make the people reading this understand fully whats going on ,
if your not prepared for a long lesson ,then u may aswell turn this off right now and go and do other things.
Start:
we will be creating a one hit kill option then moving on to PART 2
In part 2 we will create a double option of 1 hit kill and kill all in the same routine using flags as switches .
(no, not the wavy ones that flap in the wind :P)
TOOLS needed :
1.Tsearch or cheat engine or another memory searcher of your choice
2.Softice or a debugger of your choice
3.a codecave finding tool such as sheeps ray of sunshine or codecaver by spookie.
To begin :
This tutorial is for people who wish to discover a simple way to use one routine to make 2 or more options in a trainer
we will will start just past the point where we have establish the health routine address for the enemies,otherwise
this tutorial will be 30 meters long :)
Ok lets start
we have established the enemy health at
OFFSET 0042CE05 MOV EAX,[EBX+230]
so,we know we have to inject a value into [EBX+230] before its moved into EAX..
because this area is being READ all the time we also know that it will not matter when we use this option as it will work throughout the game
so the logical thing to do to make a 1 hit kill would be like this
run Sheeps ray of sunshine or spookies codecaver to find lots of spaces where we can write our code to
for this instance i used the address 4805331
Open up TSEARCH and then open up EASYWRITE
create a new option
and then type in
OFFSET 0042CE05
JMP 4805331
NOP
EXPLANATION:
offset 0042CE05 /this is the point we have to jump to our code cave
JMP 4805331 /Replace original instruction with the instruction to jump to our codecave
nop /to level the amount of bytes,original was 6 bytes and our jump instruct was 5
/bytes if we do not do this in most cases the game will more than likely crash.
Writing to our codecave address:
so first we write above our first instruction we just made in easywrite
OFFSET 4805331
MOV DWORD PTR [EBX+230],0x1
MOV EAX,[EBX+230]
JMP 0042CE0B
so now our 1 hit kill option looks like this
OFFSET 4805331
MOV DWORD PTR [EBX+230],0x1
MOV EAX,[EBX+230]
JMP 0042CE0B
OFFSET 0042CE05
JMP 4805331
NOP
I will give a little rundown to explain it again just so u have the correct idea about whats happening
OFFSET 4805331 /this is our codecave address
MOV DWORD PTR [EBX+230],0x1 /this is where we inject the value of 1 into the enemy life
MOV EAX,[EBX+230] /Replace the original instruction we destroyed
JMP 0042CE0B /now we have finished we can go back to the game,
OFFSET 0042CE05 /this is the point we have made our jump to our code cave
JMP 4805331 /instruction to jump to out codecave address
NOP /level out the amount of bytes
[notice how the return address is exactly 6 bytes ahead from where we jumped from?,
this is why it is important to level our bytes in the original jump]
to turn off this option just put this in the bottom box of EASYWRITE
OFFSET 0042CE05 / ORIGINAL ADRESSS
MOV EAX,[EBX+230] / ORIGINAL CODE
Then set a hotkey in the the new option..
when u hit the hotkey once it will turn on the option,
when u hit it again it will use the bottom box and turn off the option
Thats one hit kill all sorted :
IF THERE IS ANYTHING YOU DO NOT UNDERSTAND GO BACK AND RE-READ IT UNTIL YOU DO,
IT IS IMPORTANT YOU FULLY UNDERSTAND THIS PART OF THE TUTORIAL BEFORE YOU CAN MOVE ON TO PART 2

move on to part 2

all the above work is © www.gamehacking.co.uk 2005
no parts shall be changed/used/copied/linked in part
or in its entirity without prior full consent from www.gamehacking.co.uk

Home