With your newfound ability to think like a computer

With your newfound ability to think like a computer, you should be ade-
quately armed to start tackling more advanced memory forensics tasks. If
you’re itching for a peek at how you’ll apply all of this to something real, flip
to “Applying Call Hooks to Adobe AIR” on page 169 or “Applying Jump
Hooks and VF Hooks to Direct3D” on page 175.
If you want some hands-on time with memory, compile this chapter’s
example code and use Cheat Engine or OllyDbg to inspect, tweak, and poke
at the memory until you’ve got the hang of it. This is important, as the next
chapter will build on these skills by teaching you advanced memory forensic
techniques.

5
A D V A N C E D M E M O R Y F O R E N S I C S
Whether you hack games as a hobby or
a business, you’ll eventually find yourself
between a rock and . . . an unintelligible
memory dump. Be it a race with a rival bot
developer to release a highly requested feature, a
battle against a game company’s constant barrage of
updates, or a struggle to locate some complex data
structure in memory, you’ll need top-notch memory
forensics skills to prevail.
Successful bot development is precariously balanced atop speed and
skill, and tenacious hackers must rise to the challenge by swiftly releasing
ingenious features, promptly responding to game updates, and readily
searching for even the most elusive pieces of data. Doing this, however,
requires a comprehensive understanding of common memory patterns,
advanced data structures, and the purpose of different pieces of data.

98
Chapter 5
Those three aspects of memory forensics are perhaps the most effective
weapons in your arsenal, and this chapter will teach you how to use them.
First, I’ll discuss advanced memory-scanning techniques that focus on
searching for data by understanding its purpose and usage. Next, I’ll teach
you how to use memory patterns to tackle game updates and tweak your
bots without having to relocate all of your addresses from scratch. To wrap
up, I’ll dissect the four most common complex data structures in the C++
standard library (
std::string
,
std::vector
,
std::list
, and
std::map
) so you can
recognize them in memory and enumerate their contents. By the end of the
chapter, my hope is that you’ll have a deep understanding of memory foren-
sics and be able to take on any challenge related to memory scanning.
Advanced Memory Scanning
Within a game’s source code, each piece of data has a cold, calculated defi-
nition. When the game is being played, however, all of that data comes
together to create something new. Players only experience the beautiful
scenery, visceral sounds, and intense adventures; the data that drives these
experiences is irrelevant.
With that in mind, imagine Hacker A has just started tearing into his
favorite game, wanting to automate some of the boring bits with a bot. He
doesn’t have a complete understanding of memory yet, and to him, the
data is nothing but assumptions. He thinks, “I have 500 health, so I can
find the health address by telling Cheat Engine to look for a 4-byte integer