gamehacking.co.uk - It's an Addiction....Feed your Addiction

forgot password? register NOW! nick: password: remember me

#### PART 2 OF 2: 1ST AUGUST 2005- MAKING A ONE HIT KILL and KILL ALL by apache

making routines
break on execute
We immediatly see the break
Below this we see the code to the game (snippet)
lets take a look and se what we need to change
so lets take a look at what we have now
so the new routine looks like this
for on hit kill we put this
so the whole routine will look like this
making routines for 1 hit kill and flag routines for kill all options
class:intermediate to advanced
Before we start,(put wordwrap on your editor to ON)
be prepared for avery very long tutorial ,i will go into as much depth as i can to get the point
across and to make the people reading this understand fully whats going on ,
if your not prepared for a long lesson ,then u may aswell turn this off right now and go and do other things.
This is PART 2 If you have not read PART 1 then i suggest you go back and do so :
in part one we created a simple routine to make the enemies die with just one hit
OFFSET 4805331
MOV DWORD PTR [EBX+230],0x1
MOV EAX,[EBX+230]
JMP 0042CE0B
OFFSET 0042CE05
JMP 4805331
NOP
As you can see it appears it would be quite simple to create an option for kill all enemies by replacing the value 01 and injecting 00 instead eg:
MOV DWORD PTR [EBX+230],0x1
and making it
MOV DWORD PTR [EBX+230],0x0
On applying this technique it was noticed that when you placed 00 into the health value it had an unexpected result
what it actually did was make the enemies totally inactive and ignored you ,plus you could not inflict any damage to them
i had to see why this was ..this is where using softice comes into its own and u can trace the games code from start to finish and see whats happening .
so..
what we need to do is start the game (with softice enabled)
place a break on execute to the heath address
BPX 0042CE05.. We immediatly see the break,in softice you will see something lilke this
EAX=0000000C EBX=02659210 ECX=00000000 EDX=0265921 ESI=431013CD
EDI=C5E009FF EBP=00000009 ESP=0012EB48 EIP=0042CE05
Below this we see the code to the game (snippet)
0042CDF8 SUB [ESP+170]
0042CDFE MOV EBX,[ESP+184] /mov the player structure base into EBX
0042CE05 MOV EAX,[EBX+230] /mov the value of ebx+230 into eax
We see that if you keep hitting F5 the values change meaning its moving more then one thing into EBX then just enemy life structure and switching with every break ..
if you keep hitting F5 you see a pattern emerging where,
when ECX=00000000 its = to the player health structure and when ECX=something else its doing other things
(sounds like another option to be had doesnt it :) ).but thats for another tutorial :)
having found that when ECX=00000000=the enemy health we can now make a routine for it
So if we go back to our Original ONE HIT KILL routine we can make 2 flags up to be used as switches for both one hit kill and kill all
lets take a look and se what we need to change
OUR ORIG ROUTINE
================
OFFSET 4805331
MOV DWORD PTR [EBX+230],0x1
MOV EAX,[EBX+230]
JMP 0042CE0B
OFFSET 0042CE05
JMP 4805331
NOP
Now we need to find some more code cave areas to make our routine bigger and allow us to make 2 flags (switches)
so now we need 6 in all ,4 for the following code,and 2 for the switches(flags)
i chose these you can choose whatever ons suit you :
#cave #1 = 4805331 /cmp code cave (1st landing)
#cave #2 = 4805350 /flag check(check to see if the flags are set to on)
#cave #3 = 480536D /1hit kill codecave
#cave #4 = 4805382 /kill all codecave
#flag #5 = 4805342 /on hit kill flag
#flag #6 = 4805347 /kill all flag
ok if you look below you will notice how..the same routine as the original one we did has changed
we have removed comepletly any trace of the original one hit kill
(this will be in a new codecave location)
we have replaced MOV DWORD PTR [EBX+230],0x1 with
CMP ECX,0
JZ 4805350
-so lets take a look at what we have now
OFFSET 4805331 /1st landing point from orig jump
CMP ECX,0 /check comp for who is who (remember when ECX=0=enemy life)
JZ 4805350 /if it is zero then jump to #cave #2
MOV EAX,[EBX+230] /if it isnt then ignore the jz
JMP 0042CE0B /jump back to the game
OFFSET 0042CE05 /this is the point we have made our jump to our #cave #1
JMP 4805331 /instruction to jump to out codecave address
NOP /to level the amount of bytes
ok we have established our base cave ,
now to sort out what to do when it gets sent to OFFSET 4805350
So first off we create the cave
#cave #2
offset 4805350
CMP BYTE [4805342],01 /compare switch one-is it off or on?(one hit kill)
JZ 480536D /if its on then jmp to next cave //if its off then carry on down the line
CMP BYTE [4805347],01 /compare switch two-is it off or on?(kill all)
JZ 4805382 /if its on then jmp to next cave //if its off then carry on down the line
MOV EAX,[EBX+230] /redo the original instruction then jump back to game
JMP 0042CE0B
this establishes what, if anything has been set such as.
(1).has one hit kill been pressed
(2)has kill all been set ..
(3) has nothing changed
so the new routine looks like this
/#cave #2
offset 4805350
/compare switch one-is it off or on
CMP BYTE [4805342],01
/if its on then jmp to #cave #3
JZ 480536D
/if the above was not on ,carry on down the line
/compare switch 2 to see if is ON
CMP BYTE [4805347],01
/if it is then jump to the #cave #4
JZ 4805382
/if its off then carry on down the line
/redo the original instruction then jump back to the game
MOV EAX,[EBX+230]
JMP 0042CE0B
/#cave #1
OFFSET 4805331
/check sets the correct conditions for the jump
cmp ecx,0
/if the condition has been met then jump to switch #cave #2
jz 4805350
/if it isnt then redo original instruction and jump back to the game
MOV EAX,[EBX+230]
JMP 0042CE0B
/replace original instruction with the jump code
OFFSET 0042CE05
JMP 4805331
HEX 90
[I know its looking complicated ,if you dont understand anything ,go back to the top
read it all again, and again until you do]
right ..now we have set
[1.]established a jump from the game to our codecave
[2.]set a point where in the game code it is the right time to inject our code and when it isnt
[3.]set a point to check if one hit kill has been selected ,kill all has been selected or if any has been pressed at all
now we are going to finish it off by making out codecave to the relevent options
for kill all we use this
OFFSET 4805382
MOV DWORD PTR [EBX+230],0X0
MOV EAX,[EBX+230]
JMP 0042CE0B
for on hit kill we put this
OFFSET 480536D
MOV DWORD PTR [EBX+230],0X1
MOV EAX,[EBX+230]
JMP 0042CE0B
so the whole routine will look like this
OFFSET 4805382
MOV DWORD PTR [EBX+230],0X0 /kill all
MOV EAX,[EBX+230]
JMP 0042CE0B
OFFSET 480536D
MOV DWORD PTR [EBX+230],0X1 /one hit kill
MOV EAX,[EBX+230]
JMP 0042CE0B
offset 4805350
CMP BYTE [4805342],01 /is flag on?
JZ 480536D
CMP BYTE [4805347],01 /is flag on?
JZ 4805382
MOV EAX,[EBX+230]
JMP 0042CE0B
OFFSET 4805331
CMP ecx,0 /is condition right to jump>?
JZ 4805350
MOV EAX,[EBX+230]
JMP 0042CE0B
OFFSET 0042CE05
JMP 4805331
HEX 90
and then you would
poke 01 @4805342 to switch one hit kill on
poke 01 @4805347 to switch kill All on
poke 00 @4805342 to switch one hit kill off
poke 00 @4805347 to switch kill All off
Thats it all done , i hope you have grasped a better idea as to how this routine works ,
there are other ways and indeed other people can say they would have done it a differant way.
in certain conditions so would i , but this way is simple enough to write a complete tutorial about it
when you have mastered this technique why don't you check out the option that i mentioned earlier in this tute?
remember what i said about if you apply zero to everything in [ebx+230],then the enemy become inactive..
well if we have seperated the enemy health from all this dont you think its possible to single out the inactive routine also :)
give it a try ..
if you feel this tutorial has helped you in anyway why dont you give me an email and let me know
if you think that i could have written it better or made it easier to understand give me an email and let me know
all the best and happy hacking :)
Apache-

email: apache1[at]gamehacking.co.uk [at]=@

all the above work is © www.gamehacking.co.uk 2005
no parts shall be changed/used/copied/linked in part
or in its entirity without prior full consent from www.gamehacking.co.uk

Home