Dalam mempelajari berbagai teknik - teknik Kraking yang ada, seorang Craker - baik newbie maupun master - tak akan terlepas dari Assembly. Bahasa permrograman ini merupakan dasar yang penting bagi seseorang untuk dapat mengCrak suatu program. Walaupun begitu, tidak semua hal yang ada di dalam bahasa Assembly ini yang harus diketahui, bagi seorang newbie cukup dengan dapat mengerti dasar - dasar Assembly serta logika yang baik sudah dapt mengKrak program - program dengan Sistem Proteksi yang sederhana.
perintah - perintah dasar ini akan sering ditemui ketika kamu mencoba mengKrak suatu program. Sebelum kita melangkah lebih jauh ke bahasa Assembly, mungkin ada baiknya kalo aku menjelaskan sedikit mengenai Register ( buat yang udah tau, bisa kamu lewati ).
Apa itu Register ? Register adalah sebagian tempat di memory mikroprosesor yang dapat diakses dengan cepat. Di dalam register ini disimpan nilai - nilai yang bagi kita para Kraker sangat penting untuk diperhatikan.
Bagaimana melihat isi Register ? Dengan memakai SoftICE, kamu dapat melihat berbagai perubahan yang terjadi dengan isi Register. Untuk itu kamu perlu meng-aktif-kan "Register Window" yang ada di SoftICE dengan mengetikkan perintah WR di dalam lingkungan SoftICE. Di "Register Window" akan terlihat berbagai register beserta isinya. Register yang penting untuk diperhatikan dalam Craking adalah Register EAX, EBX, ECX, EDX, ESI, EDI, EBP, ESP dam EIP.
EAX, EBX, ECX dan EDX disebut "General Purpose Register". Register ini merupakan Register 32-bit, jika kamu mengKrak program 16-bit maka Register yang terlibat adalah AX, BX, CX dan DX. Register ini dapat dipecah - pecah, seperti gambaran di bawah ini :
misalnya isi EAX adalah 00001234, maka
*
EAX = 00 00 12 34 ==> 32 bit
*
AX = 12 34 ==> 16 bit
*
AH = 12 ==> 8 bit
*
AL = 34 ==> 8 bit
Terlihat bahwa AX terdiri dari AH dan AL, H menunjukkan High ( di bagian Kiri ) dan L berarti Low ( di bagian Kanan ).
ESI dan EDI adalah "Index Register". Register ini digunakan sebagai penunjuk terhadap suatu lokasi di memory dan biasanya digunakan untuk operasi - operasi String.
EBP dan ESP adalah "Pointer Register". Kedua Register ini berpasangan dengan Register SS. Apabila ESP ( Stack Pointer ) berpasangan dengan Register SS ( ESP : SS ) maka digunakan untuk menunjuk alamat pada Stack sementara EBP ( Base Pointer ) akan berpasangan dengan Register SS ( EBP : SS ) untuk menunjuk pada alamat memory tempat data.
EIP adalah "Index Pointer Register" yang berpasangan dengan CS ( CS : EIP ) untuk menunjuk pada alamat memory tempat perintah selanjutnya yang akan di eksekusi.
Oke setelah penjelasan singkat mengenai Register di atas, kita lanjutkan dengan penjelasan mengenai perintah - perintah dasar Assembly. Perintah - perintah di bawah ini, disusun secara Alphabetical Order......
1. ADD ( ADD Binary Number )
Format ADD Operand1, Operand2
Fungsi Menambahkan Operand1 dengan Operand2, hasilnya akan disimpan di dalam Operand1
Kalimat Matematika Operand1 = Operand1 + Operand2
Contoh MOV EAX, 00000001h ; Lihat perintah MOV
ADD EAX, 00000002h ; EAX = 00000001h + 00000002h = 00000003h
2. AND ( Logical AND )
Format AND Operand1, Operand2
Fungsi Melakukan Operasi Logika AND pada Operand1 dan Operand2, hasilnya akan disimpan di Operand1
Kalimat Matematika Operand1 = Operand1 AND Operand2
Contoh MOV EAX, 00001111b ; Lihat perintah MOV
AND EAX, 11110000b ; EAX = 00001111b AND 11110000b = 00000000b
3. CALL ( CALL A Procedure )
Format CALL LokasiProcedure
Fungsi Memanggil sebuah Procedure.
Kalimat Matematika -
Contoh CALL 12345678 ; Memanggil Procedure yang berada pada Offset 12345678
4. CDQ ( Convert Doubleword To Quadword )
Format CDQ
Fungsi Merubah nilai 32-bit dalam EAX menjadi 64-bit dalam EDX : EAX dengan cara mengosongkan isi EDX
Kalimat Matematika -
Contoh MOV EAX, 12345678h ; EAX = 12345678h
CDQ ; EDX : EAX = 00000000 : 12345678h
5. CMP ( Compare )
Format CMP Operand1, Operand2
Fungsi Membandingkan Operand1 dengan Operand2, setelah perintah ini, biasanya akan diikuti dengan sebuah Condtional Jump yang akan menentukan jalur program berikutnya.
Kalimat Matematika -
Contoh MOV ECX, 0Ah ; EAX = 0Ah
MOV EAX, 0Bh ; EBX = 0Bh
CMP EAX, ECX ; Pembandingan EAX dengan ECX.
JE 12345678 ; Jika sama, lompat ke Offset 12345678. Jika tidak, lanjutkan ke bawah
6. DEC ( Decrement )
Format DEC Operand
Fungsi Mengurangi nilai Operand dengan 1
Kalimat Matematika Operand1 = Operand1 - 1
Contoh MOV EAX, 0Ah ; EAX = 0000000Ah
DEC EAX ; EAX = 0000000Ah - 00000001h = 00000009h
7. DIV ( Unsigned Division )
Format DIV Operand
Fungsi Membagi nilai yang ada di Register EAX dengan Operand2
Kalimat Matematika EAX = EAX DIV Operand
Contoh MOV EAX, 0Ah ; EAX = 0000000Ah
MOV EBX, 05h ; EBX = 00000005h
DIV EBX ; EAX = 0000000Ah DIV 00000005h = 00000002h
8. IDIV ( Signed - Integer - Division )
Format IDIV Operand
Fungsi Membagi nilai yang ada di Register EDX : EAX dengan Operand2, hasilnya akan disimpan di EAX sedang sisanya disimpan di EDX
Kalimat Matematika EDX : EAX = EDX : EAX IDIV Operand
Contoh MOV EDX, 00h ; EDX = 00000000h
MOV EAX, 0Fh ; EAX = 0000000Fh
MOV EBX, 05h ; EBX = 00000005h
IDIV EBX ; EDX : EAX = 00000000 : 0000000Fh IDIV 00000005h
; EAX = 00000003h ( hasil ) EDX = 00000000h ( sisa )
9. IMUL ( Signed - Integer - Multiplication )
Format IMUL Operand
Fungsi Pada program 32 bit, IMUL ini digunakan untuk mengalikan antara nilai yang tersimpan di dalam Register EDX : EAX dengan Operand. Hasilnya akan disimpan di dalam EAX
Kalimat Matematika EAX = EDX : EAX IMUL Operand
Contoh MOV EDX, 00h ; EDX = 00000000h
MOV EAX, 05h ; EAX = 00000005h
MOV EBX, 0Ah ; EBX = 0000000Ah
IMUL EBX ; EAX = 00000000 : 00000005 IMUL 0000000A = 00000032h
10. Conditional Jump
Conditional Jump adalah perintah dalam Assembler yang digunakan untuk menentukan alur program berikutnya. Conditional Jump ini sebelumnya didahului oleh perintah CMP ( perhatikan contoh di penjelasan no. 5).
Ada berbagai macam Conditional Jump, di sini aku hanya membahas beberapa Conditional Jump yang sering aku temui ketika mengKrak, untuk perintah - perintah Conditional Jump lainnya, bisa kamu perdalam lagi di buku - buku yang membahas Assembly. Untuk semua penjelasan Conditional Jump di bawah ini, aku akan pake beberapa perintah yang ada sebelum perintah Conditional Jump tersebut dieksekusi.
MOV EAX, 01h ; EAX = 00000001h
MOV EBX, 02h ; EBX = 00000002h
CMP EAX, EBX ; Membandingkan antara EAX dengan EBX
Format Conditional Jump
Fungsi
JA LokasiTujuan ( Jump If Above ) Lompat ke LokasiTujuan jika EAX lebih besar dari EBX
JAE LokasiTujuan ( Jump If Above or Equal ) Lompat ke LokasiTujuan jika EAX lebih besar atau sama dengan EBX
JNA LokasiTujuan ( Jump If Not Above ) Lompat ke LokasiTujuan jika EAX tidak lebih besar dari EBX
JNAE LokasiTujuan ( Jump If Not Above or Equal ) Lompat ke LokasiTujuan jika EAX tidak lebih besar atau sama dengan EBX
JB LokasiTujuan ( Jump If Below ) Lompat ke LokasiTujuan jika EAX lebih kecil dari EBX
JBE LokasiTujuan ( Jump If Below or Equal ) Fungsinya sama dengan perintah JNA
JNB LokasiTujuan ( Jump If Not Below ) Fungsinya sama dengan perintah JAE
JNBE LokasiTujuan ( Jump If Not Below or Equal ) Fungsinya sama dengan perintah JA
JE LokasiTujuan ( Jump If Equal ) Lompat ke LokasiTujuan jika EAX sama dengan EBX
JNE LokasiTujuan ( Jump If Not Equal ) Lompat ke LokasiTujuan jika EAX tidak sama dengan EBX
JG LokasiTujuan ( Jump If Greater ) Lompat ke LokasiTujuan jika EAX lebih besar dari EBX
JGE LokasiTujuan ( Jump If Greater or Equal ) Lompat ke LokasiTujuan jika EAX lebih besar atau sama dengan EBX
JNG LokasiTujuan ( Jump If Not Greater ) Lompat ke LokasiTujuan jika EAX tidak lebih besar dari EBX
JNGE LokasiTujuan ( Jump If Not Greater or Equal ) Lompat ke LokasiTujuan jika EAX tidak lebih besar atau sama dengan EBX
JL LokasiTujuan ( Jump If Less Than ) Fungsinya sama dengan perintah JNGE
JLE LokasiTujuan ( Jump If Less or Equal ) Fungsinya sama dengan perintah JNG
JNL LokasiTujuan ( Jump If Not Less Than ) Fungsinya sama dengan perintah JGE
JNLE LokasiTujuan ( Jump If Not Less or Equal ) Fungsinya sama dengan perintah JG
JZ LokasiTujuan ( Jump If Zero ) Fungsinya sama dengan JE
JNZ LokasiTujuan ( Jump If Not Zero ) Fungsinya sama dengan JNE
11. JMP LokasiTujuan ( Unconditional Jump )
Format JMP LokasiTujuan
Fungsi Perintah JMP ini berbeda dengan perintah - perintah Conditional Jump karena ia tidak memerlukan hasil perbandingan sebelum perintah ini dieksekusi.
Kalimat Matematika -
Contoh JMP 12345678 ; Lompat ke Offset 12345678
12. LEA ( Load Effective Address )
Format LEA Operand1, LokasiMemory
Fungsi Untuk mengambil Offset dari LokasiMemory dan menyimpannya di dalam Operand1
Kalimat Matematika -
Contoh LEA EAX,
13. MOV ( Move Data )
Format MOV Operand1, Operand2
Fungsi Menyalin isi dari Operand2 kedalam Operand1
Kalimat Matematika Operand1 = Operand2
Contoh MOV EAX, 0Ah ; EAX = 0000000Ah
14. MUL ( Multiplication )
Format MUL Operand
Fungsi Mengalikan isi EAX dengan Operand, hasilnya akan disimapn di dalam EDX : EAX
Kalimat Matematika EDX : EAX = EAX * Operand
Contoh MOV EAX, 0Ah ; EAX = 0000000Ah
MUL EAX, 05h ; EDX : EAX = 0000000Ah * 00000005h = 00000000 : 00000032h
15. NOP ( No Operation )
Format NOP
Fungsi Seperti namanya, NOP tidak melakukan Operasi apa - apa, walaupun begitu perintah ini memiliki peran yang cukup penting dalam Kraking. Seperti yang diketahui, salah satu teknik mengKrak sebuah Sistem Proteksi adalah Patching, dalam Patching ini, Kraker harus merubah perintah yang ada di dalam Sistem Proteksi tersebut agar dapat mengKraknya.
Contoh sederhananya yaitu ketika ada sebuah Conditional Jump yang akan menentukan apakah S/N yang kita masukan valid atau tidak, salah satu cara yang mungkin untuk mengKraknya adalah dengan me-NOP-kan perintah Conditional Jump tersebut. Untuk lebih jealasnya, liat contoh di bawah.
Kalimat Matematika -
Contoh MOV EAX, 12345678 ; Offset 12345678 berisi S/N palsu
MOV EBX, 87654321 ; Offset 87654321 berisi S/N yang asli.
CMP EAX, EBX ; Bandingkan EAX dengan EBX
JNE 12344321 ; Jika tidak sama, lompat ke Offset 12344321
Offset berikutnya menyatakan bahwa S/N yang dimasukan adalah S/N yang valid.
Offset 12344321 menyatakan bahwa S/N yang kita masukan adalah S/N yang salah..
Listing di atas menunjukkan dengan jelas bagaimana S/N kita dibandingkan, jika kau ingin dengan sembarang S/N dapat dianggap sukses maka kita bisa me-NOP-kan Conditional Jump di atas sehingga listing perintah di atas menjadi :
MOV EAX, 12345678 ; Offset 12345678 berisi S/N palsu
MOV EBX, 87654321 ; Offset 87654321 berisi S/N yang asli.
CMP EAX, EBX ; Bandingkan EAX dengan EBX
NOP ; Tidak melakukan pencabangan sehingga S/N apa saja yang dimasukan akan dianggap valid.
16. OR ( Logical OR )
Format OR Operand1, Operand2
Fungsi Melakukan Operasi Logika OR terhadap Operand1 dan Operand2, hasilanya akan disimpan di dalam Operand1
Kalimat Matematika Operand1 = Operand1 OR Operand2
Contoh OR EAX, EBX
17. POP ( POP from Stack )
Format POP Operand
Fungsi Mengambil isi dari Stack dan menyimpannya di dalam Operand
Kalimat Matematika -
Contoh POP EAX
18. PUSH ( PUSH onto Stack )
Format PUSH Operand
Fungsi Memasukan nilai dari Operand ke dalam Stack
Kalimat Matematika -
Contoh PUSH EAX
19. RET ( Return from Procedure )
Format RET
Fungsi Kembali ke Rutin pemanggil Procedure yang sedang berlangsung.
Kalimat Matematika -
Contoh 1234 : 00000001 CALL 00001000 ;Memanggil Procedure yang ada di Offset 00001000
1234 : 00000002 ;Perintah Selanjutnya
1234 : 00001000 RET ;Alur program akan kembali ke Offset 00000002
20. SUB ( Subtract Binary Values )
Format SUB Operand1, Operand2
Fungsi Mengurangkan nilai dari Operand1 dengan Operand2. Hasilnya kemudian disimpan di dalam Operand1
Kalimat Matematika Operand1 = Operand1 - Operand2
Contoh MOV EAX, 0Ah ;EAX = 0Ah ( = 10 decimal )
MOV EBX, 01h ;EBX = 01h ( = 01 decimal )
SUB EAX, EBX ;EAX = EAX - EBX = 0Ah - 01h = 09h
21. TEST ( Test Bits )
Format TEST Operand1, Operand2
Fungsi Memeriksa apakah Operand1 sama dengan Operand2 ???
Kalimat Matematika -
Contoh MOV EAX, 0Ah ;EAX = 0Ah ( = 10 decimal )
MOV EBX, 01h ;EBX = 01h ( = 01 decimal )
TEST EAX, EBX ;Apakah EAX = EBX ???
JE 12344321 ;Jika sama, lompat.
22. XOR ( Exclusive OR )
Format XOR Operand1, Operand2
Fungsi Melakukan operasi logika Exlusive OR antara Operand1 dengan Operand2. Perintah XOR ini juga sering dipakai untuk me-nol-kan suatu register dengan cara XOR Operand1, Operand1
Kalimat Matematika -
Contoh XOR EAX, EAX ;Berfungsi untuk me-nol-kan nilai EAX ( EAX = 0 )
Sabtu, 12 Juni 2010
all about functions on CE
1. main panel
1.1 scanner
icons upside: choose process, open trainer, save as.
middle: shows process name and process PID.
down here: First scan, next scan, Undo scan(works for 1 time only).
scan type: exact value, value between/lower/higher, unknown initial value
scan type(middle of scan): decreased/increased value [by:],changed/unchanged value(unchanged only check on value, not really changed or not), same as first scan(a shortcut, and it's not recent scan)
value type: 1/2/4/8 byte, float, double, binary(slow...), text(doesn't work on changing because it's read-only), array of bytes(use address value), all(hybrid-scan, new thing on 5.4), custom(also new, and I've no idea how to modify it)
right: settings(useful things)
middle: memory scan options, speedhack, etc.
down: address list, advanced options(useful also), comments(the ?, like notes or something)
2. prospecting the functions:
process list:
attach to process(to add it onto "created process", which you can swap processes easily, but make sure you remember the process's PID!)
create process(open a process, and attach it immediately)
open file(search/edit a file, I think this is a function that we don't know...)
process/window list: process list is default, but when some program are kernel(you can't find process name here) or invisible window, you choose window list and attach to that window.
process list(long): list all process a process have(what process viewer does, and it doesn't work a lot to find the real one)
scan type:
exact value: a=a. b=b. it must be the same.
bigger/smaller than: a>b, b
unknown initial value: no idea? use it!
scan type(middle of the scan):
increased/decreased value: check added/subtracted
increased/decreased value by: check added/subtracted by a value, at least xx% means >10% value changing.
changed/unchanged value: check value changed or not, but if it was changed and back to same value, it is identified as unchanged
same as first scan: do what you do at first, not recent.
value type:
binary: bits or decimal(matters on what kind of value you put in)
1/2/4/8 bytes: normal searching(1 byte can't do fast scan, and usually 32-bit system used up to 4byte, not 8byte)biggest value for 1/2/4/8 byte: 255/65535/4294967295/4294967295^2(too big...)
float/double: used when a dot is in here.(3 functions: rounded(default),rounded(extreme) and truncated(default is what it always do, extreme is to take lowest, and truncated is a cut value))
text: search text(you do it only in a file, not game, as in game they are read-only)(unicode: search unicode instead of letter(useful on searching symbols) and case sensitive(C and c are not same))
array of bytes: hex(using 0123456789ABCDEF, also with 1/2/4/8 bytes and all)
all: hex
memory scan options:
16/32-bit/all: choose memory region. 16-bit is for DOS, 32-bit is for windows, and all is for everything
also scan read-only memory: scan read-only memory also.(you don’t need it, as if you find it, you can’t change it unless with codes)
fast scan/hyper scan: speed up your scan(usually disabled)
pause the game while scanning: stop the game while scanning(useful when values may change and you can’t pause the game)
unrandomizer: freeze random value(useful when you play dice games, you can make all 6!)
enable speedhack: speedhack(CE doesn’t have a good one, though)
speed: the speed(notice: don’t set too fast, don’t set fast and slow, don’t set fast then untick, and it will be all ok)
sleeptime: how accurate it is(3 is really ok, just don’t change it)
arrow: add all selected addresses to select list
result window:
browse memory region: go to that place using memory viewer
disassemble memory region: just the same as above
delete current address: modify results
select all items: alt+a.
memory view: use memory viewer and go to last place you exited.
red circle with a line: delete all addresses
add address manually: add it manually(no result, pointer, offset, etc.)
address window:
frozen: freeze the address.(this can’t do +/- freeze)
description: let you know what is it
addresses: output address
type: how it shows
right-click commands:
change record: change things
smart edit address: use find and replace option on description, and adjust address by using positive/negative value.
browse this memory region: use memory editor with jumpinig to this address.
show as hex value: base10 to base16/base16 to base10
set a hotkey: change addresses without typing value(choosing decreased/increased will result as +/- freeze which is going 1 side only)
freeze address in this list: freeze them.
pointer scan: scan for pointers(injected can be launched once only, but normal can be launched unlimited times, and sometimes need relaunch to make it start working, and it doesn’t work always.)
find out what accesses/writes to/read from this address: find codes with relevance(access means breakpoint without stopping, writes to is for finding codes editing the address. and read from means find addresses execute based on this address, which causes a lot of lag)
recalculate address: just calculate it again.
force recheck symbols: I wonder what it does.
group: see your address easier if there are too much.
advanced options: below settings
settings: below
comments: nothing to tell
3.settings:
general:
show undo button: you can undo results.
show advanced options: see if you want to get even more useful skills.
update the list of found addresses even after scanning: you can see changes on result window.
center CE when bringing to front: each time you open, it's in center, isn't it?
hide some/all windows instead of trying to bring CE to front: if you disable it, you succeed to bring it to front! yay!
address list specific:
show values as if they are signed: negative/positive value. useful for reverse-engineering(values go reversed).
show and work with binaries as if they are decimals: change base2 if base10. recommended with no tick.
simple paste: let you paste the value.
configure hotkeys: easier scanning(not sure it works in game or not)
configure unrandomizer: you’d better don’t touch it, as it doesn’t do much if you edited it…
automatically attach to processes named [ ](used on trainer, and it can attach in critical time.)
even autoattach when another process has already been selected: e.g you choose auto-attach a, you are attaching b, and you run a, so it attaches of you tick it)
update/found addresses list update/freeze interval: update address value/update result value/freeze checker time.
scan settings:
size of scanbuffer: just like video buffer. smaller makes scan slower, but higher may make your result comes slower even all scanned.
fast scan by default: apply it all the time
enable hyperscan when possible: tick it, if it can be ticked.
Don’t scan memory that is protect with the No Cache option: don’t scan memory that has no cache.
keep low memory usage when doing an “unkown initial value†scan with hyper scan(wow the author spell unknown wrong!): let you scan all addresses without being too laggy.
MEM_PRIVATE/IMAGE/MAPPED: other memorys(you don’t need to change it)
run scan in separate thread: prevent errors like 5.3(cancel button is disable after 5 seconds)
file associations: make CE accept the file type.
plugins: let you use CE with more fun or easier.
code finder: address to code.
debug register/memory access exceptions: choose how do you find a code.
try to prevent detection of the debugger: for those CE-prevented games.
handle beakpoints not caused by CE:(OMG breakpoints spelled wrong) only if you use breakpoint, you need to know about it.
assembler: just disassembler.
show disassembler: show it or not.
use hardware/int3 instruction breakpoints: how to break.
replace incomplete opcodes with nops/ask for replace with nop: if opcode is smaller than the area, fill extra with nops. and it asks if you want to do so.
try to prevent detection of the debugger: same as the one in code finder, and even with same tick/untick condition.
extra:
use the following CE Kernel routines instead of the original windows version: use it if you think windows sucks.
undo changes to CE: if something changed, it will get back to unchanged.
enable use of the Process Watcher: watch processes/
use kernelmode debugger options when possible: use it if you want.
stealth mode(usermode/kernelmode): try to hide it from other processes.
4. advanced options
it is a reeeaaaaaally useful tool, with almost 20% of the functions here.
full list:
replace code that does nothing(instantly! and it is just nop)
replace with original code(good when you find errors after changed)
finding out what addresses this code read from(good for finding useful stuffs by the one you have, like hp/ap/money/etc.)
find code inside a file(patch a file with the modified code)
replace all(with nop, but the creator missed it obviously...)
these are those things which appears in disassembler, but we seldom use it.
pause process(the pause button above, and almost none of us know that)
directx-mass(used on directx games, which you can zoom, create lag, etc.)
these are those "forbidden" commands or just..."unknown" commands
5. disassembler
these are where the place having much more "forbidden" commands.
5.1 right-click commands
go to address: it's confusing that it is on the right-click list, but not on toolbar.
assemble: change opcodes instantly(like opening it and add nop). don't touch it if you don't know, as it would crash if you execute.
change register at this location: e.g a code writes mov [edx],[eax] and you can't change the code, so you use it to change(to stop it, choose toggle breakpoint on top of it, and it requires code finder, so you should stop finding out those codes.)
toggle breakpoint: a breakpoint is when a process runs this code, it stops here. breakpoint shows green, and it can't be used with other code-finder options.
break and trace instructions: when it get executed, it trace back automaticly, then let it go.
create jump and initialize code-wave: like making this address changed to another and make it all with something useless.
5.2 toolbar
file:
open window: open a new memory viewer.
save disassembled output: like what program does. save code, opcode, value.
set new symbol searchpath: no idea what it does.
save/load memory region: to save a region of memory(must be readable, and once there is a mistake, you need to repen it)
search:
find memory: a simpler version from main searcher.
find assembly code: find codes.
view:
stacktrace: no idea what it is
breakpoint list: show all breakpoints.
thread list: show all threads.
debug strings: no idea what it is.
memory regions: reference of unknown initial value.
heaplist: no idea what it is.
enumerate DLL’s: check what dll used.
bottom 5: about symbols and addresses. no need to change it.
debug:
run/step/step over/run till: about breakpoints.
toggle breakpoint: also on right-click options.
break: break threads.
allocate memory: make fresh memory.
scan for code-waves: find code-waves.
fill memory: fill a region with something.
create thread: make a thread.
dissect code/data/window/PE headers: prospect them and see what are they made of.
pointer scan: we have it on right-click options on address window already.
find static addresses: find green addresses, which won’t move.
inject DLL: make a dll to inject, to have a same result as using mem-editor.
auto assemble: do assemble with automatic helps.
script: for script users.
kernel tools: you can use it only if kernel mode is operated.
1.1 scanner
icons upside: choose process, open trainer, save as.
middle: shows process name and process PID.
down here: First scan, next scan, Undo scan(works for 1 time only).
scan type: exact value, value between/lower/higher, unknown initial value
scan type(middle of scan): decreased/increased value [by:],changed/unchanged value(unchanged only check on value, not really changed or not), same as first scan(a shortcut, and it's not recent scan)
value type: 1/2/4/8 byte, float, double, binary(slow...), text(doesn't work on changing because it's read-only), array of bytes(use address value), all(hybrid-scan, new thing on 5.4), custom(also new, and I've no idea how to modify it)
right: settings(useful things)
middle: memory scan options, speedhack, etc.
down: address list, advanced options(useful also), comments(the ?, like notes or something)
2. prospecting the functions:
process list:
attach to process(to add it onto "created process", which you can swap processes easily, but make sure you remember the process's PID!)
create process(open a process, and attach it immediately)
open file(search/edit a file, I think this is a function that we don't know...)
process/window list: process list is default, but when some program are kernel(you can't find process name here) or invisible window, you choose window list and attach to that window.
process list(long): list all process a process have(what process viewer does, and it doesn't work a lot to find the real one)
scan type:
exact value: a=a. b=b. it must be the same.
bigger/smaller than: a>b, b
unknown initial value: no idea? use it!
scan type(middle of the scan):
increased/decreased value: check added/subtracted
increased/decreased value by: check added/subtracted by a value, at least xx% means >10% value changing.
changed/unchanged value: check value changed or not, but if it was changed and back to same value, it is identified as unchanged
same as first scan: do what you do at first, not recent.
value type:
binary: bits or decimal(matters on what kind of value you put in)
1/2/4/8 bytes: normal searching(1 byte can't do fast scan, and usually 32-bit system used up to 4byte, not 8byte)biggest value for 1/2/4/8 byte: 255/65535/4294967295/4294967295^2(too big...)
float/double: used when a dot is in here.(3 functions: rounded(default),rounded(extreme) and truncated(default is what it always do, extreme is to take lowest, and truncated is a cut value))
text: search text(you do it only in a file, not game, as in game they are read-only)(unicode: search unicode instead of letter(useful on searching symbols) and case sensitive(C and c are not same))
array of bytes: hex(using 0123456789ABCDEF, also with 1/2/4/8 bytes and all)
all: hex
memory scan options:
16/32-bit/all: choose memory region. 16-bit is for DOS, 32-bit is for windows, and all is for everything
also scan read-only memory: scan read-only memory also.(you don’t need it, as if you find it, you can’t change it unless with codes)
fast scan/hyper scan: speed up your scan(usually disabled)
pause the game while scanning: stop the game while scanning(useful when values may change and you can’t pause the game)
unrandomizer: freeze random value(useful when you play dice games, you can make all 6!)
enable speedhack: speedhack(CE doesn’t have a good one, though)
speed: the speed(notice: don’t set too fast, don’t set fast and slow, don’t set fast then untick, and it will be all ok)
sleeptime: how accurate it is(3 is really ok, just don’t change it)
arrow: add all selected addresses to select list
result window:
browse memory region: go to that place using memory viewer
disassemble memory region: just the same as above
delete current address: modify results
select all items: alt+a.
memory view: use memory viewer and go to last place you exited.
red circle with a line: delete all addresses
add address manually: add it manually(no result, pointer, offset, etc.)
address window:
frozen: freeze the address.(this can’t do +/- freeze)
description: let you know what is it
addresses: output address
type: how it shows
right-click commands:
change record: change things
smart edit address: use find and replace option on description, and adjust address by using positive/negative value.
browse this memory region: use memory editor with jumpinig to this address.
show as hex value: base10 to base16/base16 to base10
set a hotkey: change addresses without typing value(choosing decreased/increased will result as +/- freeze which is going 1 side only)
freeze address in this list: freeze them.
pointer scan: scan for pointers(injected can be launched once only, but normal can be launched unlimited times, and sometimes need relaunch to make it start working, and it doesn’t work always.)
find out what accesses/writes to/read from this address: find codes with relevance(access means breakpoint without stopping, writes to is for finding codes editing the address. and read from means find addresses execute based on this address, which causes a lot of lag)
recalculate address: just calculate it again.
force recheck symbols: I wonder what it does.
group: see your address easier if there are too much.
advanced options: below settings
settings: below
comments: nothing to tell
3.settings:
general:
show undo button: you can undo results.
show advanced options: see if you want to get even more useful skills.
update the list of found addresses even after scanning: you can see changes on result window.
center CE when bringing to front: each time you open, it's in center, isn't it?
hide some/all windows instead of trying to bring CE to front: if you disable it, you succeed to bring it to front! yay!
address list specific:
show values as if they are signed: negative/positive value. useful for reverse-engineering(values go reversed).
show and work with binaries as if they are decimals: change base2 if base10. recommended with no tick.
simple paste: let you paste the value.
configure hotkeys: easier scanning(not sure it works in game or not)
configure unrandomizer: you’d better don’t touch it, as it doesn’t do much if you edited it…
automatically attach to processes named [ ](used on trainer, and it can attach in critical time.)
even autoattach when another process has already been selected: e.g you choose auto-attach a, you are attaching b, and you run a, so it attaches of you tick it)
update/found addresses list update/freeze interval: update address value/update result value/freeze checker time.
scan settings:
size of scanbuffer: just like video buffer. smaller makes scan slower, but higher may make your result comes slower even all scanned.
fast scan by default: apply it all the time
enable hyperscan when possible: tick it, if it can be ticked.
Don’t scan memory that is protect with the No Cache option: don’t scan memory that has no cache.
keep low memory usage when doing an “unkown initial value†scan with hyper scan(wow the author spell unknown wrong!): let you scan all addresses without being too laggy.
MEM_PRIVATE/IMAGE/MAPPED: other memorys(you don’t need to change it)
run scan in separate thread: prevent errors like 5.3(cancel button is disable after 5 seconds)
file associations: make CE accept the file type.
plugins: let you use CE with more fun or easier.
code finder: address to code.
debug register/memory access exceptions: choose how do you find a code.
try to prevent detection of the debugger: for those CE-prevented games.
handle beakpoints not caused by CE:(OMG breakpoints spelled wrong) only if you use breakpoint, you need to know about it.
assembler: just disassembler.
show disassembler: show it or not.
use hardware/int3 instruction breakpoints: how to break.
replace incomplete opcodes with nops/ask for replace with nop: if opcode is smaller than the area, fill extra with nops. and it asks if you want to do so.
try to prevent detection of the debugger: same as the one in code finder, and even with same tick/untick condition.
extra:
use the following CE Kernel routines instead of the original windows version: use it if you think windows sucks.
undo changes to CE: if something changed, it will get back to unchanged.
enable use of the Process Watcher: watch processes/
use kernelmode debugger options when possible: use it if you want.
stealth mode(usermode/kernelmode): try to hide it from other processes.
4. advanced options
it is a reeeaaaaaally useful tool, with almost 20% of the functions here.
full list:
replace code that does nothing(instantly! and it is just nop)
replace with original code(good when you find errors after changed)
finding out what addresses this code read from(good for finding useful stuffs by the one you have, like hp/ap/money/etc.)
find code inside a file(patch a file with the modified code)
replace all(with nop, but the creator missed it obviously...)
these are those things which appears in disassembler, but we seldom use it.
pause process(the pause button above, and almost none of us know that)
directx-mass(used on directx games, which you can zoom, create lag, etc.)
these are those "forbidden" commands or just..."unknown" commands
5. disassembler
these are where the place having much more "forbidden" commands.
5.1 right-click commands
go to address: it's confusing that it is on the right-click list, but not on toolbar.
assemble: change opcodes instantly(like opening it and add nop). don't touch it if you don't know, as it would crash if you execute.
change register at this location: e.g a code writes mov [edx],[eax] and you can't change the code, so you use it to change(to stop it, choose toggle breakpoint on top of it, and it requires code finder, so you should stop finding out those codes.)
toggle breakpoint: a breakpoint is when a process runs this code, it stops here. breakpoint shows green, and it can't be used with other code-finder options.
break and trace instructions: when it get executed, it trace back automaticly, then let it go.
create jump and initialize code-wave: like making this address changed to another and make it all with something useless.
5.2 toolbar
file:
open window: open a new memory viewer.
save disassembled output: like what program does. save code, opcode, value.
set new symbol searchpath: no idea what it does.
save/load memory region: to save a region of memory(must be readable, and once there is a mistake, you need to repen it)
search:
find memory: a simpler version from main searcher.
find assembly code: find codes.
view:
stacktrace: no idea what it is
breakpoint list: show all breakpoints.
thread list: show all threads.
debug strings: no idea what it is.
memory regions: reference of unknown initial value.
heaplist: no idea what it is.
enumerate DLL’s: check what dll used.
bottom 5: about symbols and addresses. no need to change it.
debug:
run/step/step over/run till: about breakpoints.
toggle breakpoint: also on right-click options.
break: break threads.
allocate memory: make fresh memory.
scan for code-waves: find code-waves.
fill memory: fill a region with something.
create thread: make a thread.
dissect code/data/window/PE headers: prospect them and see what are they made of.
pointer scan: we have it on right-click options on address window already.
find static addresses: find green addresses, which won’t move.
inject DLL: make a dll to inject, to have a same result as using mem-editor.
auto assemble: do assemble with automatic helps.
script: for script users.
kernel tools: you can use it only if kernel mode is operated.
Langganan:
Postingan (Atom)
