Signature Scanning

I have been getting a lot of questions about Signature Scanning such as

• What is a signature?
• How do I find or make one?
• Where would signature scanning be usefull?

People seem to think this is a hard thing to do so I want to try simplify it.
Basicaly code such as C++ is compiled it is turned into byte code that the computer can run.

When memory hacking we find bytes we want to modify but if the application is recompiled or uses dynamic memory
The address is not garruented to be the same each time the app runs.

A signature is a sequence of bytes and wild cards to find in memory.

I have a game here, and it has a version string rendered in the bottom left.
You may be able to see VER9.02

I wanted to get that version as well as modify it to include my own text.

So I used cheat engine and searched for a string of VER9.02
I had to have Writable and Executable checkboxs set half way so that Cheat engine would scan
readable and executable memory too.

After I found the version string address.
I found what accessed the code.

Which can be done two ways, scan for the address in hex and goto the address -1 in the Memory View dissasembler
Or right click the entry and find what accesses.

I can just scroll up a little bit and look at the bytes on the left. Any references to other memory addresses
will change on recompile, such as ones seen in the PUSH or MOV or CALL op codes
Generally if the value is in the code sections of the executable it will be suspect to change.
Simply make those bytes wild card with the ?? when writing them down. You can search the signature in cheat engine
As an array of bytes with hex turned on.


Signature Scanner: https://code.google.com/p/signiturescanner/


Video can be found here: https://www.youtube.com/watch?v=WmHDQzfELxk

Extracting ZLIB compressed data from any file

This is very usefull for analysing file formats that contain compressed data.

You can use a handy tool by Luigi Auriemma found here http://aluigi.altervista.org/mytoolz.htm#offzip

Extract it and put it in a directory somewhere, for example

Make sure you choose a drive with lots of space.
C:\offzip\

In the directory, make a bat file called extract.bat
With these contents


mkdir %1.out\
offzip -a %1 %1.out\ 0

this will make a directory for your extracted data to go into so things don't get messy it will be the file name with .out at the end of it.
Then it will instruct offzip to find all compressed data it can in your file and extract the parts out into the directory made. It will start from offset 0

You can see the address the compressed data was found at in its filename.

Quite handy.

I also came across a great blog here, http://www.se7ensins.com/forums/threads/tut-how-to-mod-darksiders-using-offzip-and-packzip.153898/
Which shows how you can, extract->Edit->pack back in to edit game save files.

Packet Analysis

You will want a way to sniff packets perhaps WPE Pro or wireshark, could use ollyDBG or code your own sniffer/logger.

And also a way to check out whats in the packets hex and do simple operations like XOR. I suggest 010 Hex Editor its amazing.

Packets are the things that hold data to be communicated between the server and client, or client too client(s).