Foreword |
|
xv | |
|
Acknowledgments |
|
xvii | |
Introduction |
|
xix | |
|
Prerequisites for the Reader |
|
|
xx | |
|
A Brief Game Hacking History |
|
|
xx | |
|
|
xxi | |
|
How This Book Is Organized |
|
|
xxii | |
|
About the Online Resources |
|
|
xxiv | |
|
|
xxiv | |
Part 1 Tools Of The Trade |
|
|
1 Scanning Memory Using Cheat Engine |
|
|
3 | (20) |
|
Why Memory Scanners Are Important |
|
|
4 | (1) |
|
|
4 | (1) |
|
Cheat Engine's Memory Scanner |
|
|
5 | (3) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
When You Can't Get a Single Result |
|
|
7 | (1) |
|
|
7 | (1) |
|
Memory Modification in Games |
|
|
8 | (3) |
|
Manual Modification with Cheat Engine |
|
|
8 | (1) |
|
|
9 | (2) |
|
|
11 | (7) |
|
|
11 | (1) |
|
|
12 | (2) |
|
Pointer Scanning with Cheat Engine |
|
|
14 | (3) |
|
|
17 | (1) |
|
Lua Scripting Environment |
|
|
18 | (4) |
|
Searching for Assembly Patterns |
|
|
19 | (2) |
|
|
21 | (1) |
|
|
22 | (1) |
|
2 Debugging Games With Ollydbg |
|
|
23 | (26) |
|
A Brief Look at OllyDbg's User Interface |
|
|
24 | (2) |
|
|
26 | (5) |
|
Viewing and Navigating a Game's Assembly Code |
|
|
27 | (2) |
|
Viewing and Editing Register Contents |
|
|
29 | (1) |
|
Viewing and Searching a Game's Memory |
|
|
29 | (1) |
|
Viewing a Game's Call Stack |
|
|
30 | (1) |
|
|
31 | (1) |
|
Tracing Through Assembly Code |
|
|
32 | (1) |
|
OllyDbg's Expression Engine |
|
|
33 | (3) |
|
Using Expressions in Breakpoints |
|
|
34 | (1) |
|
Using Operators in the Expression Engine |
|
|
34 | (1) |
|
Working with Basic Expression Elements |
|
|
35 | (1) |
|
Accessing Memory Contents with Expressions |
|
|
36 | (1) |
|
OllyDbg Expressions in Action |
|
|
36 | (6) |
|
Pausing Execution When a Specific Player's Name Is Printed |
|
|
37 | (2) |
|
Pausing Execution When Your Character's Health Drops |
|
|
39 | (3) |
|
OllyDbg Plug-ins for Game Hackers |
|
|
42 | (5) |
|
Copying Assembly Code with Asm2Clipboard |
|
|
42 | (1) |
|
Adding Cheat Engine to OllyDbg with Cheat Utility |
|
|
42 | (1) |
|
Controlling OllyDbg Through the Command Line |
|
|
43 | (2) |
|
Visualizing Control Flow with OllyFlow |
|
|
45 | (2) |
|
|
47 | (2) |
|
3 Reconnaissance With Process Monitor And Process Explorer |
|
|
49 | (16) |
|
|
50 | (5) |
|
|
50 | (2) |
|
Inspecting Events in the Process Monitor Log |
|
|
52 | (1) |
|
Debugging a Game to Collect More Data |
|
|
53 | (2) |
|
|
55 | (6) |
|
Process Explorer's User Interface and Controls |
|
|
56 | (1) |
|
Examining Process Properties |
|
|
57 | (2) |
|
Handle Manipulation Options |
|
|
59 | (2) |
|
|
61 | (4) |
Part 2 Game Dissection |
|
|
4 From Code To Memory: A General Primer |
|
|
65 | (32) |
|
How Variables and Other Data Manifest in Memory |
|
|
66 | (12) |
|
|
67 | (2) |
|
|
69 | (2) |
|
|
71 | (2) |
|
|
73 | (1) |
|
|
74 | (4) |
|
x86 Assembly Crash Course |
|
|
78 | (18) |
|
|
79 | (2) |
|
|
81 | (5) |
|
|
86 | (3) |
|
Important x86 Instructions for Game Hacking |
|
|
89 | (7) |
|
|
96 | (1) |
|
5 Advanced Memory Forensics |
|
|
97 | (22) |
|
|
98 | (7) |
|
|
98 | (1) |
|
Finding the Player's Health with OllyDbg |
|
|
99 | (2) |
|
Determining New Addresses After Game Updates |
|
|
101 | (4) |
|
Identifying Complex Structures in Game Data |
|
|
105 | (13) |
|
|
105 | (3) |
|
|
108 | (2) |
|
|
110 | (4) |
|
|
114 | (4) |
|
|
118 | (1) |
|
6 Reading From And Writing To Game Memory |
|
|
119 | (14) |
|
Obtaining the Game's Process Identifier |
|
|
120 | (2) |
|
Obtaining Process Handles |
|
|
121 | (1) |
|
Working with OpenProcess() |
|
|
121 | (1) |
|
|
122 | (2) |
|
Working with ReadProcessMemory() and WriteProcessMemory() |
|
|
122 | (1) |
|
Accessing a Value in Memory with ReadProcessMemory() and WriteProcessMemory() |
|
|
123 | (1) |
|
Writing Templated Memory Access Functions |
|
|
123 | (1) |
|
|
124 | (4) |
|
Differentiating x86 Windows Memory Protection Attributes |
|
|
125 | (1) |
|
Changing Memory Protection |
|
|
126 | (2) |
|
Address Space Layout Randomization |
|
|
128 | (2) |
|
Disabling ASLR to Simplify Bot Development |
|
|
128 | (1) |
|
Bypassing ASLR in Production |
|
|
128 | (2) |
|
|
130 | (3) |
Part 3 Process Puppeteering |
|
|
|
133 | (16) |
|
Injecting Code Caves with Thread Injection |
|
|
134 | (4) |
|
Creating an Assembly Code Cave |
|
|
134 | (1) |
|
Translating the Assembly to Shellcode |
|
|
135 | (1) |
|
Writing the Code Cave to Memory |
|
|
136 | (1) |
|
Using Thread Injection to Execute the Code Cave |
|
|
137 | (1) |
|
Hijacking a Game's Main Thread to Execute Code Caves |
|
|
138 | (4) |
|
Building the Assembly Code Cave |
|
|
138 | (2) |
|
Generating Skeleton Shellcode and Allocating Memory |
|
|
140 | (1) |
|
Finding and Freezing the Main Thread |
|
|
141 | (1) |
|
Injecting DLLs for Full Control |
|
|
142 | (5) |
|
Tricking a Process into Loading Your DLL |
|
|
143 | (2) |
|
Accessing Memory in an Injected DLL |
|
|
145 | (1) |
|
Bypassing ASLR in an Injected DLL |
|
|
146 | (1) |
|
|
147 | (2) |
|
8 Manipulating Control Flow In A Game |
|
|
149 | (40) |
|
NOPing to Remove Unwanted Code |
|
|
150 | (3) |
|
|
150 | (1) |
|
|
151 | (2) |
|
Hooking to Redirect Game Execution |
|
|
153 | (16) |
|
|
153 | (3) |
|
|
156 | (4) |
|
|
160 | (5) |
|
|
165 | (4) |
|
Applying Call Hooks to Adobe AIR |
|
|
169 | (6) |
|
Accessing the RTMP Goldmine |
|
|
169 | (2) |
|
Hooking the RTMPS encode() Function |
|
|
171 | (1) |
|
Hooking the RTMPS decode() Function |
|
|
172 | (1) |
|
|
173 | (2) |
|
Applying Jump Hooks and VF Hooks to Direct3D |
|
|
175 | (10) |
|
|
176 | (1) |
|
Finding the Direct3D Device |
|
|
177 | (5) |
|
Writing a Hook for EndScene() |
|
|
182 | (1) |
|
Writing a Hook for Reset() |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
185 | (4) |
Part 4 Creating Bots |
|
|
9 Using Extrasensory Perception To Ward Off Fog Of War |
|
|
189 | (14) |
|
|
190 | (1) |
|
Revealing Hidden Details with Lighthacks |
|
|
190 | (2) |
|
Adding a Central Ambient Light Source |
|
|
190 | (1) |
|
Increasing the Absolute Ambient Light |
|
|
191 | (1) |
|
Creating Other Types of Lighthacks |
|
|
192 | (1) |
|
Revealing Sneaky Enemies with Wallhacks |
|
|
192 | (5) |
|
Rendering with Z-Buffering |
|
|
193 | (1) |
|
Creating a Direct3D Wallhack |
|
|
194 | (2) |
|
Fingerprinting the Model You Want to Reveal |
|
|
196 | (1) |
|
Getting a Wider Field of Vision with Zoomhacks |
|
|
197 | (1) |
|
|
197 | (1) |
|
Scratching the Surface of Hooking Zoomhacks |
|
|
198 | (1) |
|
Displaying Hidden Data with HUDs |
|
|
198 | (3) |
|
Creating an Experience HUD |
|
|
199 | (1) |
|
Using Hooks to Locate Data |
|
|
200 | (1) |
|
An Overview of Other ESP Hacks |
|
|
201 | (1) |
|
|
202 | (1) |
|
|
203 | (18) |
|
|
204 | (7) |
|
|
204 | (1) |
|
|
205 | (1) |
|
Intercepting Network Traffic |
|
|
206 | (5) |
|
Performing In-Game Actions |
|
|
211 | (7) |
|
|
211 | (4) |
|
|
215 | (3) |
|
Tying the Pieces Together |
|
|
218 | (1) |
|
Making the Perfect Healer |
|
|
218 | (1) |
|
Resisting Enemy Crowd-Control Attacks |
|
|
218 | (1) |
|
|
219 | (1) |
|
|
219 | (2) |
|
11 Putting It All Together: Writing Autonomous Bots |
|
|
221 | (24) |
|
Control Theory and Game Hacking |
|
|
222 | (1) |
|
|
223 | (2) |
|
Combining Control Theory and State Machines |
|
|
225 | (7) |
|
A Basic Healer State Machine |
|
|
225 | (3) |
|
A Complex Hypothetical State Machine |
|
|
228 | (2) |
|
|
230 | (2) |
|
Pathfinding with Search Algorithms |
|
|
232 | (9) |
|
Two Common Search Techniques |
|
|
233 | (1) |
|
How Obstacles Disrupt Searches |
|
|
233 | (1) |
|
|
234 | (6) |
|
When A* Searches Are Particularly Useful |
|
|
240 | (1) |
|
Common and Cool Automated Hacks |
|
|
241 | (3) |
|
|
241 | (2) |
|
Automating Combat with Warbots |
|
|
243 | (1) |
|
|
244 | (1) |
|
|
245 | (20) |
|
Prominent Anti-Cheat Software |
|
|
246 | (1) |
|
|
246 | (1) |
|
Signature-Based Detection |
|
|
246 | (1) |
|
|
247 | (1) |
|
|
247 | (1) |
|
The ESEA Anti-Cheat Toolkit |
|
|
247 | (1) |
|
|
247 | (1) |
|
|
248 | (1) |
|
|
248 | (1) |
|
|
248 | (1) |
|
|
248 | (1) |
|
|
248 | (1) |
|
|
249 | (1) |
|
|
249 | (1) |
|
Carefully Managing a Bot's Footprint |
|
|
250 | (6) |
|
Minimizing a Bot's Footprint |
|
|
250 | (1) |
|
|
251 | (1) |
|
Teaching a Bot to Detect Debuggers |
|
|
251 | (4) |
|
Anti-Debugging Techniques |
|
|
255 | (1) |
|
Defeating Signature-Based Detection |
|
|
256 | (2) |
|
|
258 | (1) |
|
Defeating Binary Validation |
|
|
259 | (2) |
|
Defeating an Anti-Cheat Rootkit |
|
|
261 | (1) |
|
|
262 | (1) |
|
|
263 | (2) |
Index |
|
265 | |