Cheat Engine

Uzeil · Moderator Reputation: 6 Joined: 21 Oct 2006 Posts: 2411

I wrote this a few days ago...

Nothing too interesting really, just your average opcodes/WinAPIs and our dear mmx registers.

However: Mess with it all you like to add other files, or simply switch it to encrypt by a certain key (take out the key variable and don't call FindKey, then continue from there directly loading the register with a specific key of your choosing...)

INCOMING

UnLmtD · Posted: Sun Apr 29, 2007 6:39 am Post subject:

Interesting, Thank you.

astrogod · How do I cheat? Reputation: 0 Joined: 08 Jun 2007 Posts: 2

Hi, i'm trying to reverse the muonline npgl.erl encryption routine, but it appears the key used to encrypt each byte is random. It changes each time i start the game.

Look the mu encryption algo:

Uzeil · Moderator Reputation: 6 Joined: 21 Oct 2006 Posts: 2411

Small change, same basis of the algorithm.

Two things you need to do:

(1) Change the "add al,76h" in my script to "add al,65h" and anywhere else you see the different addition (in FindKey and in the main area).

(2) After the CreateFile of the .erl, it should immediately write 4 bytes to the file, and then load a starting key which will be placed in that [esi+102c]. Well, that Key will be loaded from the stack according to another value in the stack (the other value says which of the keys in the stack to use, which is what is making you see a different key every open, but really it's just changing through a few hardcoded keys). At the point of it getting that key, you'll see in the stack a set of Keys on top of eachother for you to steal and apply to my script.

In other words: All the possible Keys are in the stack when it first gets the Key. Note all those down and replace the ones in my script with those or add those to mine in the same format and change the 10 in "mov ecx,10" in FindKey to the number of Keys in yours.

And if you can't find these keys, you can always just make it bruteforce the key, but that'll take barely more and if you can't pull off analyzing the assembly for getting the Keys, I'm doubting you'll be able to bruteforce a 4-byte value that only has 1 byte applied to each key, and will, therefore, always tick off at least once in every 255 tries.

Smile

astrogod · How do I cheat? Reputation: 0 Joined: 08 Jun 2007 Posts: 2

Thanks for ur reply and sorry for my big delay on reply it.

One thing i need to say is that the main.exe (MUonline) doesn't use these keys to encrypt the NPGL.ERL file. Because of this i never found them! ^^
I'm able to decrypt the NPGL.ERL file just using the hardcoded key inside the file. MappleStore.exe is equal like this?

I have another question about ur algo in the FindKey() proc.
I don't understand the instruction "mov eax,[esi+ecx*4]", that i'm supposing that esi is pointing to an array of DWORD keys and ecx contains the number of keys inside the array and it starts with 10? How the hell is it possible to it access an index 10 * 4 in that array? Sorry for my noobish, i'm not really good with asm algorithms.