Albatross18 Season 2

[Locu]

Hi all,
I'm trying to hack this golf game, the main exe is packed with ASPro 1.23 RC4 but this isn't a problem... there is a fucked protection called GameGuard this shitware crypt and did a lot of check on the main exe. I was becoming crazy but fortunately I found your fantastic appz!!! That isn't detected from gameguard! (cheatengine was detected) thx a lot guyz! I love and appreciate your hard works.
I'm a noob on game hacking I made just a bounch of trainers always offline game, I never tried to hack a game based on client/server system and above all i dunno anything about GameGuard.
In the game there is a power bar and I'd like to find a way to hit always pangya (perfect shot). But I dunno how to do it, could someone help me?

h00p://www.albatross18.com/season2/down ... nloads.asp

Thanks in advanced

[L. Spiro]

A bot needs only to scan the bar position and press the button at the correct time.
It can all be done in L. Spiro Script and examples are in the help file showing how to use extern variables to read from the process and to send mouse/keyboard events to the game (see Minesweeper).


L. Spiro

[Locu]

Thanks spiro for your faster reply. but my problem is how to find the bar. I did a lot of scan but i never reach the target. damn! maybe there r some strange check on it. ty

[L. Spiro]

The bar could be stored as a float or an unsigned long.
Set hotkeys to scan for increased and decreased and when the bar moves up, scan for increased. When the bar moves down, scan for decreased.
I don’t think I need to mention that you have to do an Unknown scan first.


L. Spiro

[WhiteHat]

Locu, you're in luck !

I've made a tutorial about this always pangya shot, only it's in Bahasa Indonesia. The tut itself can be found at nyit-nyit forum, the 1st Indo Cheater forum...

I try to explain about pangya slider bar...

that's the picture you should know as pangya slider bar...

In fact, there are 5 important values within albatross18:
- Power
- Impact
- Slider #1
- Slider #2
- Pangya
you'll see those 5 values in next picture...

Here's the picture...

(as you can see... i'm using MHS !)
The slider values in idle state is 105.00 float... Pangya Impact Line, which is behaves as a parameter to conclude wether your shot is pangya or not, in a flat surface is normaly 140.00 float...

However, pangya impact line values would change along with different surface tilts...



Pay attention to the Pangya Impact Line Values, which is increasing/decreasing along the slope surface...

As for the maximum value for the slider bar...

(I had to used power caliper to show this...)
As you can see, the maximum (the rightmost position of sliderbar) value is 500.00 float no matter how much your maximum power is...

The brief conclusion would be:

(please examine the values closely..)

Now for the pangya shot part...
You'll have to hit the impact 'not far from / just around of' Pangya Impact Line to score a Pangya Shot...

Using what we've talked above:

(again... please examine the changed values...)

To score a pangya shot, you have to make the distance value between 'Impact Entry Position' (which is your second mouse klik or second space-bar tap) and 'Pangya Impact Line' less than 3...

In above screen-shot example, my Impact Entry is at 138, whilst Pangya Impact Line is at 140... And so, since the distance between them is only 2, than my shot is a Pangya Shot...

The Impact Entry is a copy value from Slider #2, which is in the picture is 138...

Now, using MHS injection manager, you can make the code for always pangya that sounds like this:
"whenever i hit for a shot, instead of using Slider value as my Impact Entry, do use the value of Pangya Impact Line itself and copy it as my Impact Entry..."

There you'll get the Always Pangya shot...

[Locu]

Thanks! I'm a lil busy lately btw i'll try to follow your tut asap. ty again

ps
nyit-nyit forum has an english section? I glade to register there if possible. bye

[WhiteHat]

Thanks! I'm a lil busy lately btw i'll try to follow your tut asap. ty again

ps
nyit-nyit forum has an english section? I glade to register there if possible. bye

My pleasure...
But, unfortunately, for now nyit-nyit forum doesn't have foreign language section. But, if it's about pangya hacks, you can always reach me here, and i'll try to help as much as i can...

Albatross18 or Pangya has very-very much client-side data, for we can made as many hacks as there are available !... Check this out for example:



That was a Force-Hole-In !.. This hack will drag the ball directly into the hole, everytime the ball is rolling !.. And this can be used inside a tournament ! (this hack was invented around september 2006, but it's still working after above 10 version of patch... And of course, i used MHS mainly for this hack purpose... I used injection manager plus complex address... But the debugging process was done with other app... But, fear not the debugging should be available very soon - according to what L.Spiro had said...)

In above picture, i scored a Hole-in-One only with Putt Stick, and ignoring the fact that there is a river and a mountain between the tee spot and hole... However, i myself against this kind of hack, for it would totally ruin the game... I just want to show that it can be done with very clean result and it was done 90% using MHS... Very-very powerfull App !

[NYIT2keitaro]

i just follow whitehat-sensei

[ridha]

awesome!!!! minta dunk program na..

LOL

[WhiteHat]

How ... ?

It is a surprise to see you guys here...
Please be good when you're here, ok ?..

[Locu]

Hi WitheHat,
You rox!
I tried to find the slider bar values but i've not found it... I make a scan for unknow float values than i press spacebar on albatross18 to select the power and than i make a scan for increased value, i found just 3 address but i cant debug it and the values are strange (no similar to yours values). have u an msn account? I'd like if u can help me I wont stress you but i'm really interested to know how to do it. ty

ps
I found an hack that works as well but i'd like to make it myself.

h00p://www.sendspace.com/file/b9sh50

peace

[L. Spiro]

There is in fact already a debugger in MHS.
It is no longer its own stand-alone dialog as before, so many who used my previous software do not see it in the new software.

Ctrl-D to open the Disassembler.
Ctrl-D to start debugging (or File/Debug).
It is fairly functional but it is not documented because it is not done.
My documentation always includes many screenshots and I do not want to have to change them all when I modify the layout a bit.

You can not yet right-click an address from your list and “See what reads from this address” but that feature is just a shortcut for something you can do on your own manually. You can manually set breakpoints on addresses and find what writes to them.
As with any user-mode debugger, use hardware read/access breakpoints instead of software. As for execute breakpoints, software is preferred unless the game detects modifications to its memory.


L. Spiro

[WhiteHat]

First off, sorry that i don't have msn account... ^^;

It's strange that you say the values are different, cause i've done this before in Albatross18 US...

However, with an assumption that the value is the same, let me explain a bit about this slider system (sorry for bad english tho...):

For the slider itself, there will be two values which i named then : Slider#1 and Slider #2... We can say that Slider#1 is the car's engine, while Slider#2 is the car itself... Slider#1 is responsible to move the slider, while Slider#2 value is the one that would be copied to Power Value and Impact Value...

In IndoPangya, when your character is ready to make a shot (idle state), the value for the Slider#1 and Slider#2 is always 105.00 float... So, you can start your search from here : Initial search value = 105.00 float !

Then as the slider moving right, the value would increase and reach it's maximum values (in the rightmost position of the sliderbar) at 500.00 float.. And then decreasing as the slider move to the left and reach the
leftmost position at value 105.00....

To make things easier when you search this value, you can perform the search while using a low-speed sticks (such as pw or sw). This will make the slider move slower that will give you enought time to filter the initial search value, the 105.00 float...

The easiest method is, ofcourse, MHS's GROUP SEARCH ( which i really love )

Look at the table entries of my screenshot's, you'll see:
- Power Entry posision ~ 06d03874 ~ 140
- bla bla bla bla
- Cliper Position ~ 06d03894 ~ 140

The structure is static (as i believe), using the table entries we know that the address range is from 06d03874 to 06d03894, which will give us 32 bytes long...

Now if we know that, in idle state, there are these values : 140, 140, 105, 105, 140, 140 in 32 bytes long, then we can start to perform GROUP SEARCH with this settings:
- Total Group Elements = 10 (...10 would secure our search result instead of 8... Correct me on this L.Spiro... ^^ )
- Evaluation Type = Ordered (we would insert all those values in table by their ordered address)
- Values to find = 140 140 105 105 140 140
- Treat Elements in List as = Float
- Search Every 4 Bytes = ON
- Search Range = From 00400000 to 7FFFE000

If you do it right (and you have to...), you'll find most likely ONLY ONE result !.. View this result in hex-editor, change the view to float, and using mouse right-click, add them to the table...

Now you have the value inside the table, you're ready to debug...


PS: L.Spiro, please correct me if i'm wrong, or there's other easy way to do this.... Thanks in advance...

[WhiteHat]

Argghhh ... Sorry for double post...

I've just send my last reply when yours comes up... >.<

There is in fact already a debugger in MHS.
It is no longer its own stand-alone dialog as before, so many who used my previous software do not see it in the new software.

Ctrl-D to open the Disassembler.
Ctrl-D to start debugging (or File/Debug).
It is fairly functional but it is not documented because it is not done.
My documentation always includes many screenshots and I do not want to have to change them all when I modify the layout a bit.

You can not yet right-click an address from your list and “See what reads from this address” but that feature is just a shortcut for something you can do on your own manually. You can manually set breakpoints on addresses and find what writes to them.
As with any user-mode debugger, use hardware read/access breakpoints instead of software. As for execute breakpoints, software is preferred unless the game detects modifications to its memory.


L. Spiro

Yes, in fact, the Force-Hole-In hack was made with MHS injection Manager, and i studied the ASM code within it...
But i dunno how to do "See what reads from this address" manually like you've said...

So... err... how do i do it manually anyway ? (believe me i've tried doing this in any ways i can... But i think i miss up something...)

Thank you very much in advance... And CMIIW always ...

[L. Spiro]

But i dunno how to do "See what reads from this address" manually like you've said...

Ctrl-D to open the Disassembler.
Ctrl-D to start debugging (there is no notification that debugging began but I will add this in the next release, as well as options to start debugging when the Disassembler is opened, and when breakpoints are added).

Right-click anywhere in the Disassembler and select Breaks->Add Breakpoint Here.

Change the address to match the address of the value to which you want to see what reads/writes/accesses.
Ensure Active is checked (inactive breakpoints don't do anything).
Supply a name.

Select Hardware.
Select Read or Access depending on what you want.

Set the Callback function to Single Step.

Hit OK.

The debugger will break when the value is read/accessed and you can use F9 to skip to the next read/access.
F7 and F8 single step, as listed in the right-click pop-up menu.



The shortcut is meant to do all this for you, including skipping with F9 to find all the code that reads/accesses the value, and it will store them in a table that will be easy to navigate (which I assume is the same thing Auto-Hack does in TSearch, though I have never used/seen it).

PS: L.Spiro, please correct me if i'm wrong, or there's other easy way to do this.... Thanks in advance...

Nothing seems to be wrong.


L. Spiro