View Single Post
  #2  
Old 05-04-2009, 00:45
DABhand DABhand is offline
Banned
 
Join Date: Nov 2004
Location: Near my PC
Posts: 5,406
Thanks: 0
Thanked 3 Times in 3 Posts
DABhand is on a distinguished road
Some games share the opcodes responsible for the players health, if you can find where your own health routine is then breakpoint on that opcode and hit an enemy keep an eye on the registers, also check on yourself when hit.

For example,

The player when hit may have a constant value in EAX perhaps for example say 0023FF1A

If that is so, then you code inject.. ((this is an example not the same for all games))

code cave:

CMP EAX,0023FF1A --- check that eax contains this value
JE <address for working out player health> -- if so jump to the address for our players forced value, if not then...
MOV [EBX+13],00 --- force a zero value into the pointer, i.e. non players will have 0 health ((beware incase you have party members also in some games))
JMP <address to go back to game> --- back to the game coding ((after the jmp you made there))
MOV [EBX+13],FFFFFFFFF --- if EAX equals that value, force this value into pointer making players health huge constantly
JMP <address to go back to game> - back to the game.

game code:
JMP <code cave>


Again this may not be for the game your working on, but it could be similar..

There is a chance that registers wont have this kind of check, to which you will have to find the Player Structure and from there where it works out enemy health.


Remember JMP's are usually 5 bytes in size, so if you have to destroy 2 op codes to do so, then you will have to replace those opcodes in your own code cave.. And always write your code cave first before setting the jmp in the game code or else you will crash :P

Last edited by DABhand; 05-04-2009 at 00:47.
Reply With Quote