INDEX A anti-cheat software, 245–246 anti-cheat rootkit, defeating, About text field, Trainer generator 261–262 dialog, 9 binary validation, defeating, accessing memory 259–261 in injected DLL, 145–146 bot footprints, managing, for writing and reading, 122–124 250–256 Action Message Format (AMF), 169 ESEA Anti-Cheat toolkit, 247 actor functions, 216 GameGuard toolkit, 248–249 actuation, 216, 223 heuristics, defeating, 262–263 Address column PunkBuster toolkit, 246–247 Event Properties dialog, 55 screenshots, defeating, 258 OllyDbg disassembler pane, 27 signature-based detection, addresses, memory. See memory evading, 256–257 addresses VAC toolkit, 247–248 Address Space Layout Randomization Warden toolkit, 249–250 (ASLR), 128 anti-crowd-control hacks, 218 bypassing in injected DLL, anti-debugging techniques, 251, 146 –147 255–256 bypassing in production, arithmetic instructions, 90–92 128–130 A* search algorithm, 234 disabling for bot cost, 233 development, 128 creating node, 234–237 in Process Explorer, 56, 57 creating path list, 239–240 Adobe AIR hooking, 169 score, 234 decode() function, 172–173, uses for, 240–241 174 –175 writing search function, 237–239 encode() function, 171–172, ASLR. See Address Space Layout 174 –175 Randomization (ASLR) placing hooks, 173 –175 Asm2Clipboard plug-in, 42 RTMP, assessing, 169–170 assembly code Adobe AIR.dll, 173 –175 copying, 42 airlog tool, 170 tracing, 32–33 alignment viewing and navigating in in numeric data, 68 OllyDbg, 27–29 of variables, in data structures, assembly language, 78. See also 70–71 x86 assembly language ambient light, adding, 190–192 assembly patterns, searching for, AMF (Action Message Format), 169 19–21 AStarNode class, 234–236 intercepting network traffic, AT&T syntax, 80 206–211 autocombo, 219 monitoring memory, 204–205 autododge, 219 obfuscation, 251, 255–256 autokite bots, 244 sending packets, 215–217 automatic healer, 218, 225–228, spell trainers, 219 230–232 branching, 92–94 autonomous bots, 221–222. See also breakpoints, 30, 34, 38 control theory; state Breakpoints window, OllyDbg, 26 machines BSOD (Blue Screen of Death), 256 cavebots, 241–243 BYTE data type, 67 complex hypothetical state bytes, machine code, 78 machine, 228–230 error correction, 230–232 C healer state machine, 225–228 pathfinding with search C++, 66 algorithms, 232–234 callee, 94–95 warbots, 243–244 caller, 94–95 autoreload, 219 callHook() function, 154 autosnipe bots, 244 call hooking, 153–156. See also Adobe autowall bots, 244 AIR hooking calling conventions, 95 for call hooks, 155 B __cdecl, 95, 155 ban waves, 246 __fastcall, 95 Bigger Than scan type, Cheat __stdcall, 95 Engine, 6 __thiscall, 95, 217 binary arithmetic instructions, 90 for trampoline functions, 168 binary validation, 248, 259–261 for VF table hooks, 156–158 bits, EFLAGS register, 84 CALL instruction, 94–95 Blue Screen of Death (BSOD), 256 call stack bots. See also autonomous bots; overflow, 255–256 extrasensory perception viewing, 30 (ESP) hacks x86 assembly language, 86–88 anti-crowd-control hacks, 218 Call stack window, OllyDbg, 26 anti-debugging techniques, 251, capacity of std::vector, 109 255–256 casting spells. See spells automatic healer, 218, 225–228, cavebots, 241–243 230–232 __cdecl convention, 95, 155 detecting debuggers, 251–254 Changed Value scan type, Cheat detecting visual cues, 205–206 Engine, 7 disabling ASLR for characters. See also enemies development, 128 health bars, monitoring with emulating keyboard, 211–215 bots, 204–205 footprints, managing, 250–256 pausing execution when health game updates, dealing with, drops, 39–42 101–104 player health, finding with OllyDbg, 99–101 266 Index char data type, 67 Comment column, OllyDbg Cheat Engine, 3, 5–6 disassembler pane, 28 automatically locating string complex hypothetical state machine, addresses with, 102 228–230 cheat tables, 7–8 conditional breakpoints, 34, 38 correct address, determining, 7 conditional statements, 93 first scan, running, 6 constant ratio of health, adjusting installing, 4 for, 230–231 Lua scripting environment, control-critical routines, timing, 254 18–22 control flow hacks, 31 memory modification, 8–11 control flow manipulation, 149–150. next scan, running, 7 See also Adobe AIR pointer scanning with, 14–18 hooking; Direct3D scan types, 6 hooking std::list, determining whether call hooking, 153–156 data is stored in, 112–113 IAT hooking, 160–165 std::m a p, determining whether jump hooking, 165–169 data is stored in, 117 NOPing, 150–152 trainer generator, 9–11 VF table hooking, 156–160 VF tables, 78 control theory, 222 zoom factor, finding, 197 combining with state cheat tables, Cheat Engine, 7–8 machines, 225 Cheat Utility plug-in, 42–43 complex hypothetical state CheckRemoteDebuggerPresent() machine, 228–230 function, 251 error correction, 230–232 classes, 74–78 healer state machine, 225–228 class instances, 76 control windows, OllyDbg, 25–26 CloseHandle() function, 122, 138 cooldowns, displaying enemy, closing mutexes, 59–60 200–201 CMP instruction, 92 copying assembly code, 42 code caves, 134 copy-on-write protection, 126 loading DLLs, 143 –146 corpses, bot behavior toward, thread hijacking, 138–142 229, 240 thread injection, 134–138 correct address, determining in code injection, 133–134 Cheat Engine, 7 bypassing ASLR in production, CPU window, OllyDbg, 26–30, 40 128–130 crashing debuggers, 255 DLLs, 142–146 CreateRemoteThread() function, 129, with thread hijacking, 138–142 130, 134, 138 with thread injection, 134–138 CreateToolhelp32Snapshot() function, code patches, creating, 31–32 120, 141 column configurations, Process creature data, knowing structure Monitor, 51 behind, 106–107 combat, automating, 243–244 critical game information, displaying, command line plug-in, OllyDbg, 198–201 43–44 crowd-control attacks, 218 command syntax, x86 assembly cryptographic functions, language, 79–81 hooking, 170 Index 267 CS register, 85 finding devices, 177–181 C-style operators, OllyDbg, 34–35 optional fixes for stability, 184 custom behaviors for cavebots, writing hook for EndScene(), scripting, 243 182–183 writing hook for Reset(), 183–184 D directional lighthacks, 190–191 disabling ASLR, 128 dark environments, lighting up, disassembler pane, OllyDbg, 190–192 27–29, 42 data modification instructions, 89 Disassembly column, OllyDbg data structures, 71–73 disassembler pane, 28 data types, 66 dispatchPacket() function, 210 classes and VF tables, 74–78 display base, 27 numeric data, 67–69 DLL (dynamic link library), OllyDbg, 36 injecting, 142–146 string data, 69–71 DllMain() entry point, 144 –145 unions, 73–74 DLLs option, Process Explorer DBG_RIPEXCEPTION handlers, pane, 57 checking for, 253 Domain Name System (DNS) cache debugging. See also OllyDbg scans, 248 anti-debugging techniques, DOS header, 160–161 255–256 DrawIndexedPrimitive() function, 194, debug drivers, checking for, 254 195, 196, 200 debug strings, printing, 253 drawing loop, Direct3D, 176–177 detecting debuggers, 251–254 DS register, 85 Process Monitor, 52–53 dump pane, OllyDbg, 29–30 __declspec(naked) convention, 168 DWORD data type, 67, 145–146 decode() function, hooking, 172–173, dynamically allocated memory, 6, 174 –175 11, 12 Decreased Value By scan type, Cheat dynamic link library (DLL), Engine, 7 injecting, 142–146 Decreased Value scan type, Cheat dynamic lure, 242–243 Engine, 7 dynamic structures, 105 dependencies, DLL, 145 std::list class, 110–113 dependency loading, 160 std::m a p class, 114–118 depositor, 242 std::string class, 105–108 destination operand, 80 std::vector class, 108–110 detection, avoiding. See anti-cheat software device->SetRenderState() function, 192 E Dijkstra’s algorithm, 233–234 EAX register, 81 Direct3D 9, 176 EBP register, 83 Direct3D hooking, 175–176. See also EBX register, 82 extrasensory perception ECX register, 82, 157 (ESP) hacks EDI register, 83 detecting visual cues in games, EDX register, 82 205–206 EFLAGS register, 84, 92 drawing loop, 176 –177 EIP register, 83, 139 268 Index emulating keyboard, 211–215 pausing execution when health enableLightHackDirectional() function, of character drops, 190–191 39–42 encode() function, hooking, 171–172, pausing execution when name of 174 –175 player is printed, 37–38 EndScene() function supported data types, 36 jump hooking, 178–181 extrasensory perception (ESP) hacks, stability of, 184 189–190 writing hook for, 182–183 background knowledge, 190 endSceneTrampoline() function, 181 floor spy hacks, 201–202 enemies. See also extrasensory HUDs, 198–201 perception (ESP) hacks lighthacks, 190–192 cooldowns, displaying, 200–201 loading-screen HUDs, 201 critical game information, pick-phase HUDs, 201 displaying, 198–201 range hacks, 201 predicting movements of, 241 wallhacks, 192–197 texture, changing, 195–196 zoomhacks, 197–198 entropy, 5, 7 Environment tab, Process Explorer F Properties dialog, 58 error correction, 230–232 false positives, VAC toolkit, 248 ESEA (E-Sports Entertainment __fastcall convention, 95 Association), 247 feedback loop, 222 ESEA Anti-Cheat toolkit, 247 file accesses, inspecting in Process ESI register, 83 Explorer, 60 ESP hacks. See extrasensory Filesystem event class filter, 52 perception (ESP) hacks FILO (first-in-last-out), 86 ESP register, 83 filters, event class, 51–52 ES register, 85 findItem() function, 116–117 Euclidean distance heuristic, 236 findSequence() function, 175 event class filters, Process Monitor, first-in-last-out (FILO), 86 51–52 first-person shooter (FPS), xxii, 246 event log, Process Monitor, 52–53 first scan, running in Cheat Event Properties dialog,