View Single Post
  #14  
Old 11-09-2007, 17:11
Synaesthesia Synaesthesia is offline
Registered User
 
Join Date: May 2007
Location: Incensed
Posts: 92
Thanks: 0
Thanked 0 Times in 0 Posts
Synaesthesia is on a distinguished road
Quote:
ok, let presume that you know how to "debug"(if you know what it realy mean) a trainer to actually "change" where it write for example... but the publisher has updated the whole file; updating the trainer mean re-search again all the values then redebug and rewrite a totally different code, change the call and the content of the code cave. So to know what new byte to write, you would have to go through all that youself.
Quote:
game.exe - trainer.exe

1. Olly, SoftICE or w.e. debugger you can think of - start debugging trainer.exe

2. Is trainer packed?
a. Yes - proceed to unpacking (manually, using tools or scripts) Unpacking is useful only if you plan on reversing the whole trainer (e.g. : modify stuff in it)
b. No - move on

3. For both of the above cases, running trainer.exe in a debugger will be enough to be able to set breakpoints

4. What does trainer.exe do? Writes both injected code and memory pokes. Injected code - WriteProcessMemory (again, you have to analyze the trainer to check if author uses tricks to catch WPM - e.g.: check first 5 bytes of the API for a hook or a CC); Direct "editing" - ReadProcessMemory, add value, WriteProcessMemory to update the value...

5. Is trainer using game pointers? If yes, then they need updating (in case of a new game version) - proceed to retrieving the pointers; if not, move on to code-injection - since addresses are obviously changed, so will the bytes in the trainer's pokes. Proceed to updating. Any specific offsets in the code-injection that might have updated on the new version? Yes - find them and update them. No - leave code alone...

6. Write original trainer code in game's memory at updated addresses, and fix it with the right jumps and all. Save your work.

7. Most authors are caught up in projects or simply don't want to update the trainer anymore (they deleted/uninstalled the game and are lazy to reinstall - C&C3 has 9 GB). Proceed to asking them if you can post the updated trainer (nothing is changed in it, but the functionality - author is still the same). Yes - go ahead. No - use it to yourself...
Quote:
At this point, you could just do you own trainer while you are at it.
Why would I? If I already saw what he did, why would I bother trying to? Imagine this - the author has trained the game to death that there's nothing left in it to train. What next? Train it on your own to test your abilities? I'm way past that, and after a while it becomes so boring...

Quote:
And i would't anyway risk to run a "modified" file from a noob and risk some damage to my computer. Yes, some code badly writed might trigger a windows message or event that might do some nasty thing to you files; the possibilities are small but there anyway. You are not dealing with dos here.
Websites check the content of submitted applications. It's your choice whether you believe them as safe or not. Same, it's your choice to use the said trainer. No one forces you. Regarding wanting something in return - no way, lol. I never asked for anything in my life when posting cracks/trainers/etc. I do it for fun and fun alone. Digital drama...

Last edited by Synaesthesia; 11-09-2007 at 17:13.
Reply With Quote