Page 1 of 5 12345 LastLast
Results 1 to 15 of 66
  1. #1
    Sergeant nopz's Avatar
    Reputation
    54
    Join Date
    Aug 2009
    Posts
    52
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)

    [Tutorial] How to find simple stuff



    Donate to Remove Ads, Get ShoutBawx - Elite Forum Access
    Hello,

    I'm here for some time now and I have decided to start learning things instead of asking for offsets or stuff.
    I have found a very good topic on GD forums "How to find stuff" How to find stuff - Game Deception - Forums by bobbysing.

    Today I have decided to take the time to make a short tutorial with my level of knowledge speaking about how to find something with IDA.
    For those who knows IDA this thread will talk about the String window and how to read subs.

    Most of you already know the things I'm going to explain but this thread is mostly for all of the users that are/was like me, searching for things here and not doing by there own.

    It is my contribution to 'wraithZX' alert about peoples here.

    Quote from wraithZX (http://www.mmowned.com/forums/wow-me...ml#post1687462)
    what I'd like to see in the forum is more questions about how to find them yourself, not just what the actual values are. Those sorts of questions do a lot more for the community as a whole, in the sense that they end up spreading knowledge, compared to threads continually asking for stuff that changes patch after patch.


    So here we go, what you need is :

    - Ida Pro (IDA Pro Disassembler - multi-processor, windows hosted disassembler and debugger)
    - Hex-Rays (Hex-Rays Decompiler) <- facultative
    - wow.exe .. 3.2.2 here


    Step 1 - Opening "wow.exe" with IDA.
    First thing is to open 'ida pro', do not forget to run as administrator if you're using windows vista or seven.
    We'll have to open wow with IDA to tell ida that we want to disassemble the file to start searching for stuff.
    Here you just have to click "File..Open.." select the binary 'wow.exe' and Open.

    If you've got a popup after clicking Open, select Portable Executable File (PE).
    It takes a certain time for ida to disassemble the binary, so go take a cup of coffee and wait.




    Step 2 - The strings window.
    So at this point you should have an IDA pro opened with an analyzed wow.exe. What we want is search for something, at this point the easiest way to find something with our poor knowledge is looking at the 'Strings Window'.

    - Hit "Shift + F12", wait a moment. This will generate what we call strings.
    We will use that window to search for something.

    So what you'll do is locate the string "GetMinimapZoneText"

    - Hit "Alt + T" type "GetMinimapZoneText".
    - Ctrl + T if you want to move to the next occurrence.

    You should obtain something like this.




    Step 3 - Where is dA c0d3 ?.
    Well double click the "GetMinimapZoneText" line, this will bring you to the ida "View-A" of the code.
    To access the sub view of the code you will have to click on the .data address.




    Step 4 - Show me dA c0d3 !!.
    So know you have your IDA pointing on "GetMinimapZoneText" the .data:address.
    To view the asm code and start working by your own you will have to click on the "sub_ADDRESS".




    Step 5 - What now ?!?.
    Well in the View-A of IDA you have the ASM code representing our function.
    You have to start reversing by your own now. In this example with have our "GetMinimapZoneText" function located at 0x113D778. I have the "Hex-Rays" plug-in so hitting "F5" show me the pseudocode C.



    And finally in C# :

    Code:
    string minimapZoneText = SMemory.ReadASCIIString(mp.WindowHandle, SMemory.ReadUInt(mp.WindowHandle,0x113D778), 30);
    Console.WriteLine("GetMinimapZoneText : " + minimapZoneText);
    Credits goes to all of you who want to learn things like me the other are not smart enough to understand things...
    I'm pretty sure this thread is not perfect, feel free to edit / discuss / comment.

    Special thanks :
    Apoc (because it's an awesome guy)
    kynox (his blog / work is also awesome)
    Cypher (love the blog)
    wraithZX
    unkn0wn0x (because i'm sure the Aion bot is going to be good)
    Last edited by nopz; 09-27-2009 at 02:33 PM.

  2. #2
    Banned P1raten's Avatar
    Reputation
    500
    Join Date
    Mar 2008
    Location
    #define me 1337
    Posts
    1,326
    Blog Entries
    1
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    Looking good. +rep x3

  3. #3
    Sergeant Major Viano's Avatar
    Reputation
    24
    Join Date
    May 2008
    Location
    Switzerland
    Posts
    167
    CoreCoins
    23

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    Quote Originally Posted by Cypher View Post
    Please don't encourage people to pirate IDA and Hex-rays.
    Please use your powers to produce tutorials like that. Thank you.

    @nopz:

    Awesome. Thank you very much +Rep.
    Viano

  4. #4
    Marshal
    Reputation
    49
    Join Date
    Mar 2007
    Posts
    1,035
    CoreCoins
    4

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    A quick way to find lua_DoString:

    Go to the lua function "RunScript". The last call made by this function is DoString(basically...).

  5. #5
    New User
    Reputation
    1
    Join Date
    Feb 2008
    Posts
    6
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    Easy to understand language;
    Listed commands with step by step instructions;
    Descriptive pictures regarding topic.

    Two words Nopz, "High Five".
    Last edited by Ohsnap; 09-27-2009 at 04:01 PM.

  6. #6
    New User

    Reputation
    1
    Join Date
    Mar 2008
    Posts
    26
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    Thanks man, +Rep

  7. #7
    Sergeant Major GordonGekko's Avatar
    Reputation
    14
    Join Date
    Oct 2008
    Posts
    178
    CoreCoins
    9

    Trade Feedbacks

    Status
    Superior trader
    Positive
    1 (100%)
    Negative
    0 (0%)
    Hi,
    first of all thx a lot. This is a very helpful for me as a beginner. I hope it is fine if i ask for one more example in addition.

    Well what I try to do is to find the memory location where the string of the "ingame group chsat" is stores. So finally my target is to read the last line of the group chat and write it into a .txt file. Unfortunately I am not really sure where i have to start. So yould somebody be so kind and explain to me how i can achieve that with IDA?

    Sorry for those basic question but I am just starting with IDA.

    Thanks a lot
    Gordon

  8. #8
    New User
    Reputation
    1
    Join Date
    May 2009
    Posts
    1
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    Great work nopz, people might actually learn something.

  9. #9
    New User
    Reputation
    1
    Join Date
    May 2008
    Location
    Australia
    Posts
    7
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    This is one of the best posts I've come across for IDA so far. Much appreciated. Simple, clear, concise. +Rep

  10. #10
    Contributor
    Reputation
    141
    Join Date
    Oct 2008
    Posts
    647
    CoreCoins
    107

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    @nopz great post - any idea why on the mac binary I get nothing in the strings list? http://dump.ifeedr.com/WoWBinaries/W...t%203.2.2a.zip

    Edit: Where can I purchase the Hex-rays IDA plugin that shows pseudocode?

    Edit 2: Found it, yea can't afford that lol, but looks nice
    Last edited by Tanaris4; 10-30-2009 at 10:20 AM.

  11. #11
    Private
    Reputation
    5
    Join Date
    Oct 2009
    Posts
    8
    CoreCoins
    1

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    great post, easy to follow and explains everything well. thanks!

  12. #12
    Banned
    Reputation
    1
    Join Date
    Oct 2007
    Posts
    16
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    Thank you! Helped me tons ^^

  13. #13
    Knight zutto's Avatar
    Reputation
    39
    Join Date
    Aug 2007
    Posts
    210
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    not bad at all
    Last edited by zutto; 11-03-2009 at 04:32 AM.
    drugs are baad kids.. m'kay.

  14. #14
    Master Sergeant
    Reputation
    67
    Join Date
    Oct 2009
    Posts
    134
    CoreCoins
    8

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    This tutorial helped me alot to figure out stuff on my own (i guess). Now I'm trying to dig a little deeper and looked for GetPlayerMapPosition. I tried to find the function that actually returns the position values. The following pictures show about everything i've "discovered" during my investigation:



    So my question now is: Am I going in the right direction or is that complete bs. If I'm totally wrong please tell me. Best regards.

    edit: Further testing
    Last edited by Flowerew; 11-04-2009 at 07:14 AM.

  15. #15
    New User
    Reputation
    3
    Join Date
    Jan 2009
    Posts
    7
    CoreCoins
    0

    Trade Feedbacks

    Status
    n/a
    Positive
    0 (0%)
    Negative
    0 (0%)
    You've let me get my foot in the door so-to-speak, with out asking those "broad" questions that are annoying for mods and such. This made lots of general concepts make sense to me. Thanks.

 

 
Page 1 of 5 12345 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
All times are GMT -4. The time now is 08:28 PM. Powered by vBulletin® Version 4.2.0
Copyright © 2014 vBulletin Solutions, Inc. All rights reserved. Resources saved on this page: MySQL 5.88%
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2014 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search