Post Reply 
 
Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Decompiling CheatEngineFiles & GamesTrainers
11-07-2012, 08:18 PM
Post: #6
RE: Decompiling CheatEngineFiles & GamesTrainers
Trainer are often written in asm or C.
These are zero terminate strings so it's not delphi...

maybe follow the references around ' drunk drive' like unk_100034d8.

However the API to write changes to another process is Kernel32.WriteProcessMemory find it in the Trainer and explorer what's happening around.

Or load it in Ollydebug set a breakpoint there (Ctrl+N -> WriteProcessMemory,...)
Maybe work with log-breakpoints however takes some time and is annoy to set them and write in cryptic Expression like [[esp+8]] to just get on fancy argument - and do it again to log an other.

Dumpers - well I use pretty old LordPE and somethings the little hidden dumper inside Import REConstructor(RC/advCmd/Select Code Section->Fulldump) or when in Olly the plugin Ollydump
Find all posts by this user
Quote this message in a reply
Post Reply 


Messages In This Thread
RE: Decompiling CheatEngineFiles & GamesTrainers - cw2k - 11-07-2012 08:18 PM

Forum Jump:


User(s) browsing this thread: 1 Guest(s)

Contact Us | Homepage | Return to Top | Return to Content | Lite (Archive) Mode | RSS Syndication