1

Introduction – Context

Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life. These applications inject their own code into game (or application) to extend custom functionality (for example, opening up a cheating menu or overwrite a timer function).


Body – Main question

The question is not only restricted to games but programs and security in general, how do these people inject their own code...

  • ...to overwrite the functionality of a function in the code, like a timer (just name roughly what technique is used) ?

  • ...without breaking offsets of the inital program ?

I am not an expert in this field but for the purposes of building a better understanding, let's excludde the use of specilised big name IDE's like IDA Pro, Ghidra or Cheat Engine which can automatically inject assembler code.


Own approach – Thought

My inital guess was that piece of reverse engineering software would be used simply to look at the code and find the addresses that contain checks and values of interest. After writing down addresses, one would write C++ Programm that overwrite at those addresses the code to something else.

So to sum my thought up, the first step would be reconnaissance (gathering information/addresses and what those statements do), secondly one would write a C++ Program that makes use of the MemoryWrite Function to overwrite the executables code with ones own, lastly test it out / run the C++ program?

For the sake of simplicity let's say we are in a windows (10) environment and the architecture / CPU doesn't matter. Additionally the languages used to overwrite will be C++.

Disclaimer

I think I am legally forced to note that this question is for educational purposes and I do not advise/recommend/intend anyone incl myself to circument/overwrite software. I just don't want to get banned. This question is simply asking for the techniques and clever tricks used, not for code or attempt to breach application protections.

2
  • Usually you don't overwrite code, you create a section, put your code there, and put a jump on the original code. – ThoriumBR Oct 29 '20 at 23:00
  • "I think I am legally forced to" - no, you're not. It is quite obvious that it's for educational purposes. If we would think you would ask this question for malicious purposes, then a small disclaimer will not change anything. – MechMK1 Oct 30 '20 at 11:57
0

There are several methods to achieve this.

Code Caves

The oldest and simplest approach is called Code Caves. Simply put, the process memory has some allocated, but unused memory. By modifying the code - either by injecting it dynamically or overwriting the binary file - code can be inserted into the code cave and be jumped to and returned from.

The advantage of using code caves is that you need to modify very little of how the program works to get your custom code running. However, you depend on the availability of memory caves, and even if you find any, the size of them will pose an issue.

Allocation

"If you need more memory, just allocate more memory"

The other approach being used means you allocate more memory, jump from the existing code to the added section, do whatever custom stuff you'd like to do, and then jump back.

The advantage of this method is that you essentially have free reign over how much code you wish to inject, with the downside being that the underlying program is much more likely to "be aware" of your changes. That means if you plan on cheating in a multiplayer game - which I personally disapprove of - the underlying game has a very high chance of noticing that something is up.

Patching

Sometimes, just overwriting things is easier than any of the other methods. If your required changes are simple, then overwriting some addresses in memory might be enough. For example, if a program has a complicated function to check whether or not a valid license is present, one can simply overwrite this function with a bunch of NOPs (to keep the offsets correct) and returning true.

The advantage of this approach is that it is by far the easiest and can usually be done on-the-fly without ever modifying the binary file. The downside is that it is an even more limited approach than code caves, since you're only changing things, not adding new code.

1
  • Thank you very much. This is very much what I was looking for. – stringExchange Nov 6 '20 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.