SunBeam wrote: ↑Mon Jan 27, 2020 11:42 am
caliber1942 wrote: ↑Mon Jan 27, 2020 10:56 am
Not sure what versions people are using or what this talk of randomness is, but the game is definitely encoding values.
Some people don't have sufficient knowledge or some sort of stable logic when they SCAN for shit in a game. They do things randomly and random is the effect. The person I mentioned scanned for unknown/increased by/decreased by. Which clearly has no logic, when game is encoding values. Increased by what? What you see on screen? Doesn't work like that, as we both mentioned. So that's what the "randomness" was about.
caliber1942 wrote: ↑Mon Jan 27, 2020 10:56 am
I will be curious to see if you work out unlocker for cheats or whatever it is you seemed to be working on. I did not see anything like that in the Steam version of this game.
There aren't any cheats in this version of the game.
Reloaded (the game, not the 0-day people) version has a bunch in plain-text scripts that are loaded and ran. The Legend uses pre-compiled scripts, thus no more sneaking around with raw text
While you were writing your message, I've posted the 5.000.000 Money script. Even with the encode/decode functions available, you still have to filter out an entire script handler to make sure you're tampering only the right variable (clearly illustrated in my script: "temp.cache.player.money"). The write function is the same I got, then I back-traced out of as close as possible to the start of the script processing.
BR,
Sun
yes, so for write, here is the encryption being put into place:
AlienShooter.exe+5D95E - 89 04 BD F06E1801 - mov [edi*4+AlienShooter.exe+4B6EF0],eax
AlienShooter.exe+5D965 - 33 45 08 - xor eax,[ebp+08]
AlienShooter.exe+5D968 - 89 46 04 - mov [esi+04],eax
breakpoint at:
AlienShooter.exe+5D920 - 55 - push ebp
ECX-14 is BASE
BASE+8 is pointer to string descriptor (i.e. temp.cache.player.money)
BASE+14 is counter to help point to STATIC XOR values.
BASE+18 is current value (encrypted)
each time the value is written to (BASE+18)
which happens here:
AlienShooter.exe+5D968 - 89 46 04 - mov [esi+04],eax (ESI-0x14 is BASE of the struct)
it's XOR here,
AlienShooter.exe+5D965 - 33 45 08 - xor eax,[ebp+08]
and EDI is is set here from static values:
AlienShooter.exe+5D93A - 0FB7 F9 - movzx edi,cx
and used here:
AlienShooter.exe+5D95E - 89 04 BD F06E1801 - mov [edi*4+AlienShooter.exe+4B6EF0],eax
Whereas EDI is the value stored here:
BASE+14
and every time a new value is written, BASE+14 is incremented to point to a new XOR encryption here:
AlienShooter.exe+5D927 - 66 FF 06 - inc word ptr [esi]
so this is why it seems'random', but its' not actually random at all, just that the game is changing the encrypted value itself, but is changing which XOR from static location (offset of AlienShooter.exe+4B6EF0) is being used as the encryption.
Also note that the static XOR address (offset of AlienShooter.exe+4B6EF0) is ALSO changed at each write.
AlienShooter.exe+5D95E - 89 04 BD F06E1801 - mov [edi*4+AlienShooter.exe+4B6EF0],eax
Also breakpoint at:
AlienShooter.exe+5D920 - 55 - push ebp
[esp+4] holds the value that will ultimately be written to the address in this function.
so it's a complex encryption for sure, but it's actually pretty easy to defeat once you figure out the process. This is also why it seems 'random'.
There are several more of these for other types of values (other than int, etc.)
struct looks like this:
BASE
BASE+4
BASE+8 (pointer to string description)
BASE+C
BASE+10
BASE+14 (value used to read XOR from static offsets)
BASE+18 current value of address (i.e. money) in encrypted form
AlienShooter.exe+5D920 - 55 - push ebp
AlienShooter.exe+5D921 - 8B EC - mov ebp,esp
AlienShooter.exe+5D923 - 56 - push esi
AlienShooter.exe+5D924 - 8B F1 - mov esi,ecx
AlienShooter.exe+5D926 - 57 - push edi
AlienShooter.exe+5D927 - 66 FF 06 - inc word ptr [esi]
AlienShooter.exe+5D92A - 66 83 3E 64 - cmp word ptr [esi],64 { 100 }
AlienShooter.exe+5D92E - 0FB7 0E - movzx ecx,word ptr [esi]
AlienShooter.exe+5D931 - 72 07 - jb AlienShooter.exe+5D93A
AlienShooter.exe+5D933 - 33 C0 - xor eax,eax
AlienShooter.exe+5D935 - 33 C9 - xor ecx,ecx
AlienShooter.exe+5D937 - 66 89 06 - mov [esi],ax
AlienShooter.exe+5D93A - 0FB7 F9 - movzx edi,cx
AlienShooter.exe+5D93D - 8B 04 BD F06E1801 - mov eax,[edi*4+AlienShooter.exe+4B6EF0]
AlienShooter.exe+5D944 - 85 C0 - test eax,eax
AlienShooter.exe+5D946 - 75 1D - jne AlienShooter.exe+5D965
AlienShooter.exe+5D948 - FF 15 24270701 - call dword ptr [AlienShooter.exe+3A2724] { ->ucrtbase.dll+3F3D0 }
AlienShooter.exe+5D94E - 25 FFFF0080 - and eax,8000FFFF { -2147418113 }
AlienShooter.exe+5D953 - 79 07 - jns AlienShooter.exe+5D95C
AlienShooter.exe+5D955 - 48 - dec eax
AlienShooter.exe+5D956 - 0D 0000FFFF - or eax,FFFF0000 { -65536 }
AlienShooter.exe+5D95B - 40 - inc eax
AlienShooter.exe+5D95C - F7 D0 - not eax
AlienShooter.exe+5D95E - 89 04 BD F06E1801 - mov [edi*4+AlienShooter.exe+4B6EF0],eax
AlienShooter.exe+5D965 - 33 45 08 - xor eax,[ebp+08]
AlienShooter.exe+5D968 - 89 46 04 - mov [esi+04],eax
AlienShooter.exe+5D96B - 8B C6 - mov eax,esi
AlienShooter.exe+5D96D - 5F - pop edi
AlienShooter.exe+5D96E - 5E - pop esi
AlienShooter.exe+5D96F - 5D - pop ebp
AlienShooter.exe+5D970 - C2 0400 - ret 0004 { 4 }
for reads, the process is reversed:
AlienShooter.exe+C8F85 - 0FB7 48 14 - movzx ecx,word ptr [eax+14]
AlienShooter.exe+C8F89 - 8B 3C 8D F06EAE00 - mov edi,[ecx*4+AlienShooter.exe+4B6EF0]
AlienShooter.exe+C8F90 - 33 78 18 - xor edi,[eax+18]
Whereas EAX is the base here, then the process completes here
AlienShooter.exe+C8F90 - 33 78 18 - xor edi,[eax+18]
Where we end up with edi being the value shown/used.
best,
Cal
The fact that it's "hard" makes it even more enjoyable. But each to their own.
I fucking hate the way people like to portray themselves as something they aren't. Just cuz anonymity...