A Simple Game Hacking Tutorial

Creativity · 06-18-2005

This tutorial is for Newbies, those who dont know anything about game hacking, so pros in Game hacking don't pay attention to this one.

This is my first tutorial for the public and please bring to my notice if any correction is needed and I'll correct it... any useful suggestions and advices are welcome

Target program: Windows Minesweeper
Type: Freezing the time

Tools Required:
=======================
Here I'm giving you the link to download a great tool called GTS(1.6.2)by Epsilon..It is good to have this tool because it helps to hack DMA which TMK 1.51 doesnot allow directly
Download it here:
http://dlhftp.cs1.dlh.net:8080/ba745...ers/GTS162.zip

Link to a great memory address finder and it is Artmoney (fast searching is possible with this tool).
http://dlhftp.cs1.dlh.net:8080/ba745...oney708eng.exe
Using artmoney the search is quicker and it is good in reaping the mem values.

Artmoney 7.08 tutorial:
Step 01:Start minesweeper.
Step 02:Start Artmoney and then select minesweeper as the process.
Step 03:Click any block in minesweeper then the clock will start to tick.
Step 04:We are going to hack the time in minesweeper.
Step 05:Switch to Artmoney and then choose Process > Stop the process
now that minesweeper is stopped and now it is easy to hack it,because the value doesnot change making it readable.(use this method only to hack values which change constantly even when you switch to other application (Example values like time).
Step 06:Now find out the value in Minesweeper and then click on Search button in Artmoney and a small dialog pops up and enter the time value in it and hit OK.
Step 07:Ok we have found some values now its the time to resume the process Choose Process > Resume the process and then allow the value to change.
Step 08:Once again Choose Process > Stop the process in Artmoney.
Step 09: Read the value and then click Filter and enter the value and the click ok
Step 10:it lists some values,repeat steps 7-9 untill you get a minimum listing of the addresses ie. Untill the found value remains the same.
Step 11:In the end you will be left with only two addresses which contain the value of time.(In my system I got these two values 0006FC90 and 010056F0 fine...it may vary in yours,but it is rare..), to freeze the found values click in the F column against the value it the right side table.

Game Trainer Studio Tutorial:
Do you know how to use this tool same like TMK 1.5 or like MS-VB 6...
Step 01: place a button on the form then right click on it then choose Properties, Select function tab then Ckeck the Poke option on the right.
Step 02: Click on Code Generator and then choose Poke(Decimal) since the poke value is going to be decimal...
Step 03: Switch to Artmoney then click on an Address entry then right click choose edit, a dialog pops and choose the address value and then select copy and then paste the same address in address box in GTS.
Step 04: then enter the value to be poked in Decimal, Since we chose Poke(Decimal)..,then choose value size as DWORD and then click on "Add poke Code" button in the generator window.
Step 05: We need the value to be unchanged throughout therefore select Freeze tab and then check Enable freeze and then input your own caption for the frozen state...
Step 06: Time to choose the process... right click any where on the form and the choose Trainer settings and the change the options there...click on List all windows button and the choose minesweeper window (Minesweeper must be running to select it).
Step 07: Save the project and compile it and then run...
Step 08: By default the compiled EXEs are stored in Output directory...you can use these outputs for yourself or upload it to shadowrunner@megagames.com

Info: Use bitmaps as your trainer window using RGN tool supplied with GTS to create a trainer window with custom shape...
If you have any problem feel free to ask me...
If you need more tools or tutorials visit www.Gamehacking.com.

Contact us:
Ramz_creativity@yahoo.co.uk
nick_rance89@hotmail.com

Greets:
Cheater / LiT
eRUPTION / LiT

Bye
Ramz_creativity@yahoo.co.uk

amb3r_017 · 06-19-2005

its very nice tutorial , keep 'em coming mate

Creativity · 06-26-2005

My next tutorial will cover how to hack games that contain DMA(Dynamic memory allocation),games like commandos,Need for Speed UG contain DMA protection.

What is DMA ?
DMA is a technique which prevents game from beign hacked.This technique is something different.When the game loads it allocates memory for the variables and these memory locations will be static for most of the games but in the case of games with DMA,the game will give away the memory to which ever variable that asks for space first,it's same like "first come,first served",the variable which comes first is allocated the first place,following by other variable in order in which they asked for, this leads to change in the locations of these variables every time you load the game,so you need to search for memory locations every time the game is started or loaded.

My next tutorial will be on how to defeat this memory protection,so that the memory locations will be static every time we load the game...

Wait...

Bye,
Ramz_creativity@yahoo.co.uk

NemanjaTurbo · 06-27-2005

Nice tut

UPucker · 07-12-2005

dma was not designed to prevent game hacking.

Creativity · 07-30-2005

Exactly as you say it was not created to prevent game hacking intensionally but it prevents you from hacking by changing address every time you start the game...
This technique acts as protection from hacking... it only acts as protection it really isn't...

UPucker · 07-31-2005

It isnt all that hard to defeat dma. All you have to do is find the instruction that is accessing the data. If the game subtracts from your memory address every time you get hit, then edit the instruction that subtracts rather than the data.

Creativity · 08-03-2005

It becomes a little tough when hacking games like commandos... where a value in game uses three addresses and the three addresses change dynamically every time so inorder to hack it... I used to hack one address per time then followed by the next two for a particular value after restarting (Eg. Sniper's ammo)...
Thanks for ALL THE INFO WHICH YOU SHARED HERE... UPucker

...
I use Artmoney to Hack all games and the games with DMA especially... Because it is lot easier to search with artmoney, It has many advanced features (Eg File search, Formula search...) which Tsearch doesn't has but Tsearch inturn has some features that Artmoney doesn't have (Eg. Disassembler)... Both the tools are great !
So a game hacker need to have both these tools to hack games...

Creativity · 08-05-2005

Target: Unreal Tournament GOTY
Protection type: DMA

Know the terms:
Pointer: Pointer is the memory location that stores the address of a particular value in the game. Address of the Pointer will not change at any cause but the value(address of the value in game) that it holds will change upon restarting the game.

Aim: Our aim is to defeat the DMA so that the we need not repeat the search every time we restart the game.

Value: We are going to hack the Health value in the game, so that we need not search for the new value assigned by the pointer every time we restart the game.

Let's get started:
Artmoney 7.08 DMA Tutorial:
Step 01: Launch UT and use Artmoney to find the Address where health is stored. In my case it was at 0456CB1C. If you don't know how to do this then read the Tutorial above to find addresses where a paticular value is stored.
Step 02: Add the address to the right table by selecting it in the left table then click the red arrow and then set its description to Health.
Step 03: Right click on health and then select More > Save this address / pointer.
Step 04: Right click on the Health in the right table and the select More > Search > Search the pointer to begining of memory block and click Ok in the dialog that appears.
Step 05: Clear the right table then add all the addresses from the left table.
Step 06: Select all the addresses then Right click and Select More > The Commands with pointers > Set pointers to the saving address.
Step 07: Restart the game, don't restart ArtMoney.
Step 08: Read the health value from the game.
Step 09: Right click on the right table then select More > Set Filter, enter the health value that you read in the game and then click OK.
Step 10: Repeat steps 07 to 09 till the amount of pointers remains the same.
Step 11: To find the pointer address,Right click on the cell the select Edit then look for the value straight to pointer label. That's the address of the pointer similarily find all the pointers of the Health address.In my case I ended up with seven pointers.

Creativity · 08-21-2005

My next tutorial will be on how to use GTS to create a trainer with Pointer function...
Please wait till I finish it and post it here...

keykenny · 10-20-2005

How come when I do the search from beginning of block, I get all the adresses. But when I move them all to the right, ALL are the same address as the one I found. The "health" value? Pretty aggrivating.

Creativity · 10-21-2005

Quote:

Originally Posted by keykenny

How come when I do the search from beginning of block, I get all the adresses. But when I move them all to the right, ALL are the same address as the one I found. The "health" value? Pretty aggrivating.

Is that the address or the value that is same throughout ?
The value of the addresses will be the same... then you'll have to restart the game and then try again by applying filter for the value found in the game !

Go through the steps 3 to 9... you might have made some mistake there !

keykenny · 10-21-2005

It is both the values, and the addresses that are the same.

It seems that when I search from beginning of block, the value that is next to <= is the value that shows up only when I bring it to the right. The search is fine, shows all the different addresses. But for some odd reason when bringing it to the right it just gives the address for all of them that I put after <=.

Creativity · 10-22-2005

I'm using Artmoney 7.08... Which version of Artmoney do you use ?

keykenny · 10-24-2005

I am using 7.14

Creativity · 11-04-2005

Try using 7.08.... or just read the tutorial on hacking DMA that accompanies with Artmoney install package !!!

zaffo · 11-06-2005

do u guys make no cd exe game fixes?? If so why dont one of you try making one for Football Manager 2006.....Seam no one else looks like doing so!!

Creativity · 11-07-2005

I'm just a noob in cracking and hacking there are many ppl, who can help... the best one is to learn it by yourself and try cracking it !!!

RiDiCuLe · 11-08-2005

i this is my first post here

anyways i know how to hack normal non dma games but i dunno dma i have just made a working non dma hack last night for nfsu2 with t search

do you know how to do dma with t search ?

and do you know how to hack online games i know about it but i not quite knowing how to do i got the programs i know how do everything but to use it to hack lol
i am using wpepro my email is
halfcraft@gmail.com if you want to contact me

Creativity · 11-08-2005

Online hacking cannot be discussed here, any post on online-hacking will be removed by moderators or ignored by me !!!
Online gaming is only place where you can test your skill... why do you want to cheat other skilled ones. If you want to beat them, improve your skills !
So say no to online hacking !

talldude227 · 11-28-2005

The links you gave in the begining don't work any more. Can you give some new ones?

Creativity · 12-09-2005

Take a look at this site :
http://www.gamehacking.com/

Check the Tools section.
Artmoney is in Tools > Memory Finders
TMK and GTS are in Tools > Trainer Makers

I hope this will help !

ob.nikon · 06-06-2006

I followed by your tutorial and i have 2 questionss:

When im choosing compile->build trainer
its showing the "build trainer" window and :

Quote:

status: Building Trainer...

and the "Lunch" button cant be pressed.

1/Is it aspose to take a lot of time?
cuz im waited 10 minutes and its still in this status

I also notices that in this step:

Quote:

Step 04: then enter the value to be poked in Decimal, Since we chose Poke(Decimal)..,then choose value size as DWORD.

Its seems that the GTS dont save it automitcly,
after doing it i press close window and when im clicking "code genertor" again
the "address" field became empty and the "function" wasnt deciml.
2/Is it ok?

please help

thanks,
ofir.

Creativity · 06-12-2006

Quote:

Originally Posted by ob.nikon

I also notices that in this step:

Its seems that the GTS dont save it automitcly,
after doing it i press close window and when im clicking "code genertor" again
the "address" field became empty and the "function" wasnt deciml.
2/Is it ok?

Once you type the address and value.. Click on "Add Poke Code" and then close the code generator. I've made corrections in the tutorial also. Thank you for pointing out my mistake.

Smartiesmeist · 06-13-2006

I cant find a download link to Artmoney 7.08, can anyone give a download link?