Cheat Engine

Poent · Cheater Reputation: 0 Joined: 24 Apr 2007 Posts: 32

As you may or may not know, the vast majority of DirectX games out there utilize the PeekMessage function to handle almost all of their function calls once the game has loaded. If the Peek message loop doesn;t ring any bells then some of you, rather, may be familiar with the GetMessage() loop. This Message Handle is perfectly logical for Window programming, because generally speaking Windows applications, Word for example, tend to sit and do nothing until you make a move.

This doesn't work well however for game programming . While all this waiting is going on,the game needs to be creating thirty to sixty fully-rendered 3D images per second and putting them on the screen without any delay at all. And so we are presented with a rather interesting problem, because Windows, if it sends any messages, will most definitely not be sending thirty of them per second.

This is where PeekMessage comes in. It doesn't wait for anything. PeekMessage() just looks into the message queue and checks to see if any messages are waiting. If not, the program will continue on, allowing us to do what we need.

In light of that little bit of knowledge (which may or may not be exactly accurate) it should quickly became obvious that hooking and monitoring calls that pass threw the message queue would allow anyone to actively and accurately respond to events that happened in-game, whether that response is directed towards hacking or towards simply making a kind of AI.

More specifically (leaving it at a simplistic level for ease of understanding the concept...) lets say that in a game -- a player pings the mini map. The program (or hack, or bot.. etc), which would be monitoring all calls that are passed to the message handle, recognizes this function and then moves the users screen to that ping location based off the calls that pass threw this loop.

The concept is simple enough, especially if you know exactly when and where to look in a game for this loop. However, I would like to be able to actively monitor a real time game that I DO NOT have to source code to.

This is where I would like some help...

How can I go about locating where this PeekMessage function is loaded into the memory, and how can i actively return and monitor the data that is passed threw this function?

On a side note, getting ahead of myself here and looking a the nitty gritty, I can see where dll injection would be a solution to almost my entire conundrum. With that in mind... and also knowing that I have never attempted dll injection, AND knowing that in order to inject the dll i would still need to know the location of the PeekMessage Function one way or another... I do not necessarily want to modify any in game memory. I simply want to have a program respond to what it sees. outside of the program its monitoring. are there stills ways to indirectly monitor those calls?

Any and all help would be very much appreciated and I thank you all for the read. If needed, I will be more than happy to supply simple programs that demo the PeekMessage function and windows message calls in case any of you would like something simplistic and static to work with if you choose to help me out with this.

Once again, thanks ahead of time for the help. any and all comments are much appreciated.

Symbol · Posted: Mon Mar 24, 2008 3:22 am Post subject:

If you don't want to change the game's memory then you can probably debug the game, set a breakpoint at peekmessage address, get all the information you need and run the game.

Poent · Cheater Reputation: 0 Joined: 24 Apr 2007 Posts: 32

how do I go about finding the address in the first place? I've tried using Ollydbg to search for basic functions but I dont know quite enough to be able to find it exactly.

EDIT:
After looking a little more closely at the peekmessage function it seems that while all of the program must pass over this loop every cycle, it does not have to pass independent functions threw it. for example only windows specific messages are dispatched threw this loop. While the Game_run() and Render_frame() type functions are simply called and updated after it passes the windows call check.

This leaves me in a little bit more complicated situation than i had originally intended or thought it to be. Rather than monitoring the peek message loop a need to monitor independant calls. While in some games such as 2d RPGS and rts's lots of things would normally pass threw that function, in newer games.. they dont..

So, allow me to update my question.. How would I go about finding a specifically called function in a game that will occur intermittently and how would I go about forwarding that message to an application in order to form a response to it?

P.S.
For those of you trying to follow along, here is some demo code I wrote up using the peekmessage loop and how a game would generally look.

Symbol · Posted: Mon Mar 24, 2008 11:47 am Post subject:

You can create a little hook, for example:

Poent · Cheater Reputation: 0 Joined: 24 Apr 2007 Posts: 32

I dont want to comtrol anything really, not at this point at any rate. i simply want to respond to the game when a specific function is called.

EG:
lets say that i hold down alt and press "G". In warcraft 3, this triggers a function that, when the mouse is left click, it generates a 'ping' at a location.

I want to be able to either record this ping with an external program, or generate some kind of macro to respond to it with...

Or in another sudo example, i want to be able to see that a ping was made, then have an external program automatically move the screen to that pings location.
-----------

Granted, i want this to not be specific to just pings of course, in other games where there may be some kind of trigger event or message event I could use this to respond actively to what its doing.

Also as mentioned above, when i was researching a bit more about the PeekMessage function i found that it really isn;t the part of the program that i want to monitor, i want to monitor custom function calls.

Symbol · Posted: Mon Mar 24, 2008 2:03 pm Post subject:

Poent · Cheater Reputation: 0 Joined: 24 Apr 2007 Posts: 32

So i've pretty much hit the point when I agree.. i think i need to hook it with a Dll. but i'm still not exactly sure how this will all work out.

Symbol · Posted: Mon Mar 24, 2008 3:04 pm Post subject:

Poent · Cheater Reputation: 0 Joined: 24 Apr 2007 Posts: 32

Being mostly new to olly, how do I go about finding where the windows procedure is?

also, when dissassebling the test function program above... I found that my function was NEVER listed in the machine language as HERE_IT_IS as labeled. instead there were simply pointers. The function itself came out to be:

rapion124 · Posted: Wed Mar 26, 2008 4:08 pm Post subject:

WinProc will probably have the syntax of a while loop with Peek/GetMessage and a bunch of switches. It is quite easy to find. Use OllyDBG and when the game starts, trace from the entry point until the window gets created. Then, let the program run and click "pause." On Olly, change thread and try to step each thread until the window responds. There is your WinProc thread. Monitor it and you will step into the WinProc procedure.

Also, what you write into the compiler isn't what is actually going to be in your executable. The variables in your function are actually in the stack. That's what the [ebp] are for. The compiler uses the function names to keep track of each function during compile time only.