Go Back   BWHacks > Development > Reverse Engineering

Reverse Engineering Game hacking discussion and open source development.

Reply
 
LinkBack Thread Tools

Old 04-13-2007, 04:53 PM   #1 (permalink)
Perma
rol 3905h, 8
Senior Member
Administrator

Inquisitor
 
Perma's Avatar
 
Join Date: Jul 2004
Location: Canada
Posts: 5,182
Perma has disabled reputation
Default [WarCraft III] TextOut Function (v1.21)

Thanks to Palomino's notes for clarifying what some parts of this are actually meant for.

Code:
.data

        WC3FXN_Text             dd 6F663740h
        WC3FXN_GlobalClass      dd 6F84CC20h

.code

Warcraft_TextOut proc           textloc:DWORD

        push eax
        push edx
        push ecx
        push 0FFFFFFFFh

        ;Get the pointer to Warcraft's global class.
        mov eax, WC3FXN_GlobalClass
        mov eax, dword ptr ds:[eax]

        ;Get the pointer to the output class.
        mov eax, dword ptr ds:[eax+3E0h]
        mov edx, dword ptr ds:[eax]
        push 0
        push 41200000h
        lea ecx, dword ptr ss:[esp+08h]
        push ecx

        ;Push the text address.
        mov ecx, textloc
        push ecx
        mov ecx, eax
        call dword ptr [WC3FXN_Text]
        pop ecx
        pop edx
        pop eax
        ret

Warcraft_TextOut endp
__________________
Fear, Zero, Exhale, GDI-Bot
Keep it open source. (See more...)
Perma is online now   Reply With Quote

Old 04-14-2007, 01:54 AM   #2 (permalink)
K? Pŕo?ćtiόnŹ
=)
Senior Member
Game Hacking Staff

Messiah
 
K? Pŕo?ćtiόnŹ's Avatar
 
Join Date: Oct 2004
Location: Okinawa
Posts: 8,726
K? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond reputeK? Pŕo?ćtiόnŹ has a reputation beyond repute
Send a message via AIM to K? Pŕo?ćtiόnŹ
Default

gj
__________________
K? Pŕo?ćtiόnŹ is offline   Reply With Quote

Old 04-16-2007, 12:49 AM   #3 (permalink)
bulk_4me
F7 F1EF
Senior Member
Moderator

Enlightened
 
bulk_4me's Avatar
 
Join Date: Jun 2004
Location: Torreón, Coah. México
Posts: 3,197
bulk_4me is a splendid one to beholdbulk_4me is a splendid one to beholdbulk_4me is a splendid one to beholdbulk_4me is a splendid one to beholdbulk_4me is a splendid one to beholdbulk_4me is a splendid one to behold
Default

nice.
bulk_4me is offline   Reply With Quote

Old 08-06-2007, 07:41 PM   #4 (permalink)
Perma
rol 3905h, 8
Senior Member
Administrator

Inquisitor
 
Perma's Avatar
 
Join Date: Jul 2004
Location: Canada
Posts: 5,182
Perma has disabled reputation
Default

Moved to the Warcraft hacking related section.
__________________
Fear, Zero, Exhale, GDI-Bot
Keep it open source. (See more...)
Perma is online now   Reply With Quote

Old 08-20-2007, 07:48 AM   #5 (permalink)
topaz

Heretic
 
Join Date: Mar 2007
Posts: 24
topaz is an unknown quantity at this point
Default

Is anyone willing to port this to C (or a language thats easily understandable)?
topaz is offline   Reply With Quote

Old 08-20-2007, 07:55 AM   #6 (permalink)
Perma
rol 3905h, 8
Senior Member
Administrator

Inquisitor
 
Perma's Avatar
 
Join Date: Jul 2004
Location: Canada
Posts: 5,182
Perma has disabled reputation
Default

Code:
void Warcraft_TextOut(DWORD sText)
{
    static int WC3FXN_GlobalClass = 0x6F84CC20;
    static int WC3FXN_Text = 0x6F663740;
    __asm
    {       
        push eax
        push edx
        push ecx
        push 0x0FFFFFFFF
        mov eax, WC3FXN_GlobalClass
        mov eax, dword ptr ds:[eax]
        mov eax, dword ptr ds:[eax+0x3E0]
        mov edx, dword ptr ds:[eax]
        push 0
        push 0x41200000
        lea ecx, dword ptr ss:[esp+0x08]
        push ecx        
        mov ecx, sText
        push ecx
        mov ecx, eax
        call dword ptr [WC3FXN_Text]
        pop ecx
        pop edx
        pop eax
    }
}
That should work.
Perma is online now   Reply With Quote

Old 08-20-2007, 07:57 AM   #7 (permalink)
topaz

Heretic
 
Join Date: Mar 2007
Posts: 24
topaz is an unknown quantity at this point
Default

Nice...
topaz is offline   Reply With Quote

Old 08-20-2007, 12:12 PM   #8 (permalink)
saren

Crusader
 
saren's Avatar
 
Join Date: Feb 2005
Location: Tucson, AZ
Posts: 3,327
saren has much to be proud ofsaren has much to be proud ofsaren has much to be proud ofsaren has much to be proud ofsaren has much to be proud ofsaren has much to be proud of
Default

Inline ASM is the devil.
__________________


Burn, baby, burn.
saren is offline   Reply With Quote

Old 10-13-2007, 09:42 AM   #9 (permalink)
Rufus
A God Among Men

Disciple
 
Rufus's Avatar
 
Join Date: May 2007
Posts: 423
Rufus is on a distinguished road
Default

could u do an example in asm of how a "pressing Q (or any key) to show a certain message" would work :P?
Rufus is offline   Reply With Quote

Old 11-19-2007, 10:36 PM   #10 (permalink)
sharpz
Mortal
 
Join Date: Nov 2007
Posts: 6
sharpz is on a distinguished road
Default

I can't get this function to work. I've injected the hook successfully, and the function gets called, but there is simply no display. What exactly isthe global class and could the address have changed?
sharpz is offline   Reply With Quote

Old 01-16-2008, 04:38 PM   #11 (permalink)
BitSaber
Mortal
 
Join Date: Jan 2008
Posts: 4
BitSaber is on a distinguished road
Default

Quote:
Originally Posted by Perma View Post
That should work.
Code:
void Warcraft_TextOut(char *cText)
{
    static unsigned long WC3FXN_GlobalClass = 0x6F84CC20;
    static unsigned long WC3FXN_Text = 0x6F663740;

    __asm {       
        push 0FFFFFFFFh
        mov eax, WC3FXN_GlobalClass
        mov eax, dword ptr ds:[eax]
        mov eax, dword ptr ds:[eax+0x3E0]
        mov edx, dword ptr ds:[eax]
        push 0
        push 41200000h
        mov ecx, esp
        lea ecx, dword ptr ss:[ecx+0x08]
        push ecx        
        mov ecx, cText
        push ecx
        mov ecx, eax
        call dword ptr [WC3FXN_Text]
    }
}
BitSaber is offline   Reply With Quote

Old 01-21-2008, 09:09 PM   #12 (permalink)
BitSaber
Mortal
 
Join Date: Jan 2008
Posts: 4
BitSaber is on a distinguished road
Default

Code:
void Warcraft_TextOut(char *cText)
{
    static unsigned long WC3CLS_OutputClass = (*(int*)(*(int*)0x6F84CC20+0x3E0));
    static unsigned long WC3FXN_PrintText = 0x6F663740;

    __asm {       
        push -1
        push 0
        push 0x41200000
        lea ecx, dword ptr [esp+0x08]
        push ecx        
        push cText
        mov ecx, WC3CLS_OutputClass
        call dword ptr [WC3FXN_Text]
    }
}
For whatever reason, I wasn't able to just edit my above post.

I didn't do any work on Warcraft III yet, but this should work.
BitSaber is offline   Reply With Quote

Old 07-23-2008, 07:15 PM   #13 (permalink)
Phoenixs

Heretic
 
Phoenixs's Avatar
 
Join Date: Jul 2008
Posts: 28
Phoenixs is on a distinguished road
Default

Do I need some special compiler / library to compile ASM that is integrated to C++?

I wasn't able to compile this code with Dev-C++ 4.9.9.2 so..
Someone explain?
__________________
In a world without walls and fences, you don't need windows or gates.
Phoenixs is offline   Reply With Quote

Old 07-23-2008, 08:05 PM   #14 (permalink)
Shimano

Advocate
 
Shimano's Avatar
 
Join Date: Jan 2007
Location: Boise, ID
Posts: 207
Shimano is on a distinguished road
Send a message via MSN to Shimano
Default

Then use vc++
__________________

Shimano is offline   Reply With Quote

Old 07-24-2008, 03:44 AM   #15 (permalink)
Phoenixs

Heretic
 
Phoenixs's Avatar
 
Join Date: Jul 2008
Posts: 28
Phoenixs is on a distinguished road
Default

Quote:
Originally Posted by Shimano View Post
Then use vc++
Yea google up abit and many other recommend VC++ to compile inline asm too.

Somebody said that syntax of inline assembler in gcc is strange, too.

Well, gotta try with VC++ when I'm at home again.

Thanks
__________________
In a world without walls and fences, you don't need windows or gates.
Phoenixs is offline   Reply With Quote

Old 07-24-2008, 03:44 AM   #16 (permalink)
Phoenixs

Heretic
 
Phoenixs's Avatar
 
Join Date: Jul 2008
Posts: 28
Phoenixs is on a distinguished road
Default

Quote:
Originally Posted by Shimano View Post
Then use vc++
Yea googled up abit and many other recommend VC++ to compile inline asm too.

Somebody said that syntax of inline assembler in gcc is strange, too.

Well, gotta try with VC++ when I'm at home again.

Thanks

EDIT: Sorry for double post :S
__________________
In a world without walls and fences, you don't need windows or gates.
Phoenixs is offline   Reply With Quote

Old 07-24-2008, 04:01 AM   #17 (permalink)
Dyndrilliac

Blessed
 
Dyndrilliac's Avatar
 
Join Date: Jun 2005
Location: Jacksonville, FL, USA
Posts: 2,335
Dyndrilliac has a brilliant futureDyndrilliac has a brilliant futureDyndrilliac has a brilliant futureDyndrilliac has a brilliant futureDyndrilliac has a brilliant futureDyndrilliac has a brilliant futureDyndrilliac has a brilliant future
Send a message via MSN to Dyndrilliac
Default

How do you guys think Inline ASM is accomplished? Inline ASM is possible only when the IDE makes use of an ASM compiler/linker. Inline ASM that uses MASM syntax therefore needs MASM compiling tools, which of course are built-in to Microsoft's Visual C++. To check to see if your IDE has the tools required to compile MASM code, search for the utility ml.exe (or ml64.exe for 64-bit compiling).
__________________
Ultimate Guide/Resource/Tutorial/Book Thread
Technobabble! - My Blog About All Things Technological
Quote:
Originally Posted by Edsger W. Dijkstra
It is practically impossible to teach good programming to students that have had a prior exposure to BASIC; as potential programmers they are mentally mutilated beyond hope of regeneration.
Dyndrilliac is offline   Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads