How can I read a register without a Debuger and Codeinj.?

Discussions Related to Game Hacking and Memory Hacking Software

Moderators: g3nuin3, SpeedWing, WhiteHat, mezzo

How can I read a register without a Debuger and Codeinj.?

Postby run32dll » Wed Aug 27, 2008 10:19 pm

What I want to do:
I would like to create my own World of Warcraft Radar in C++ to read out other players posiotions, mobs, etc... To do this I need to find the Pointer that points to the List of Objects.

On WoW.dev http://www.madx.dk/wowdev/forum/viewtopic.php?f=1&t=348&st=0&sk=t&sd=a are some code snippets in delphi and C# that show how to get that Pointer via TLS. Too bad I can not rly code delphi or C#. I tried to port it into C++ but now I stoped this because:
a) many people said it will not work on my x64 System only on x86
b) I could not get the NtQueryInformationThread() function to work in my code

Now I took a closer look into the WoW asm. I fount a Register where my Pointer is stored.
Code: Select all
0046E060 | A1 3C56E200      | MOV  EAX, DWORD PTR [E2563C]    |
0046E065 | 64:8B0D 2C000000 | MOV  ECX, DWORD PTR FS:[2C]     |
0046E06C | 56               | PUSH ESI                        |
0046E06D | 8B3481           | MOV  ESI, DWORD PTR [ECX+EAX*4] |
0046E070 | 8B96 08000000    | MOV  EDX, DWORD PTR [ESI+8]     |<EDX has the Pointer I need
0046E076 | 8B8A D0000000    | MOV  ECX, DWORD PTR [EDX+D0]    |

(This is from WoW 2.4.3 btw.)

I can not use a Debuger like MHS, CE, Olly for this to find out because my Rader should find that Pointer without these Tools.
I can not use a codeinjection because this would be detected by WoW Anti-Cheat Tools Warden.
I'am not sure about dll-injection ... its better to avoid it, may be detected too.

So how can I read this register in my own appl.? coded in C++ ...
Last edited by run32dll on Wed Aug 27, 2008 11:40 pm, edited 1 time in total.
Asus A8N-SLI Deluxe
AMD Athlon 64 X2 Dual Core 4200+ 2.2Ghz (upgrade)
2GB RAM OCZ
AC97 onboard Sound
Winfast NVidia GeForce 8800 GTA 320MB (upgrade)
SyncMaster 244T 24"-Monitor
Windows XP 64 Pro SP 1
# running stable 24/7 since 26.09.2005 #
User avatar
run32dll
I Have A Few Questions
 
Posts: 5
Joined: Mon Aug 18, 2008 3:58 pm
Location: Germany

Postby L. Spiro » Wed Aug 27, 2008 11:27 pm

Without debugging or modifying the code you can not.


L. Spiro
Our songs remind you of songs you’ve never heard.
User avatar
L. Spiro
L. Spiro
 
Posts: 3129
Joined: Mon Jul 17, 2006 10:14 pm
Location: Tokyo, Japan


Return to General Related Discussions

Who is online

Users browsing this forum: No registered users and 0 guests