How can I get the memory offsets that functions in a dll access?
Posted by lJesterl, 02-11-2011, 11:57 PM I am developing an anti cheat patch for a friend for an old game for him and his small community of players for free. I am doing a dll in visual basic becasue the community is so small I know that VB will be just fine. I do know that fighting cheaters is a losing battle but it is such a small community that it won't be as bad but I need to get the cheats patched that are out now. I have all the file modificaiton cheats detected and blocked and its working fine as well as some registry checks and some checks for known open programs that are cheats. I am struggling on blocking the memory hacks that a specific dll uses. Someone made a dsound dll that has about 10 different cheats in it. I have tried to load the dll and search for what changes in memory programs like tsearch but i cant seem to find the addresses. How would I be able to debug or dissasemble the dll and get the memory addresses that the cheats edit so I can check those addresses
Posted by Driver01, 02-12-2011, 06:37 AM Try OllyDbg
Posted by cselzer, 02-12-2011, 11:01 AM idapro advance 6. yea, it prices $1,059, but it is worth it. I use it regularly, love the ability for version diffing, and writing scripts to automate a lot of the tasks for me. And btw, detecting memory hacks is a game not worth playing, blizzard entertainment (developers of world of warcraft) have been battling MDY (which i am for MDY, hope they win!) its in the millions, if someone wants to bypass and cheat on a game, its going to happen. And stopping cheats with visual basic isn't even ideal, use c or c++. Also, if your friend is making any money, i'd suggest using http://global.nprotect.com/product/gg.php if he can afford it, not really sure on the pricing. But it will stop autoit color scanners, many script kiddie mem hacks and such.