Cheating in games. Lesson #2

1. It outputs "Enter your name ".
   
   
2. Then it checks the keyboard to see if any key has been pressed. If so, the letter is stored in a predefined place in memory (A$). It will keep checking the keyboard until return has been pressed, that indicates the end of the string. When return has been pressed it puts a "0" at the end of the string (A$) in memory.
   
   
3. Then it outputs "Hello " and reads the letters (A$) stored in memory. It will read the memory until it reaches a zero, which indicates the end of the string. Then it will output the letters to the screen after "Hello ".

BIT, BYTE AND WORD

HEXADECIMAL SYSTEM

CONVERTING DECIMAL TO HEXADECIMAL NUMBERS

THE INTEL PROCESSOR

MSB                     LSB
 15                      0
 _________________________
|           A X           | AX is a 16 bit register, AL and AH
|     AH     |     AL     | are 8 bit registers. The same
|_________________________| applies for BX, BL, BH, CX, CL,
|           B X           | CH, DX, DL and DH.
|     BH     |     BL     |
|_________________________| These registers are called
|           C X           | common registers.
|     CH     |     CL     |
|_________________________|
|           D X           |
|     DH     |     DL     |
|_________________________|
|           SI            | SI and DI are string registers used
|_________________________| for copying and comparing strings,
|           DI            | i.e., password protections.
|_________________________|
|           SP            | SP and BP are stack registers.
|_________________________| I'll get to the stack later.
|           BP            |
|_________________________|
|           CS            | CS, DS, ES and SS are SEGMENT
|_________________________| registers.
|           DS            |
|_________________________|
|           ES            |
|_________________________|
|           SS            |
|_________________________|

 _________________________
|           IP            | Instruction Pointer
|_________________________|
|    O D I T S Z A P C    | Flags
|_________________________|

• AX, BX, CX, DX are 16 bit registers used for common operations. If they are used as 8 bit registers they are called, i.e., AH and AL. They can also be used as 32 bit registers and then they are called EAX, ECX, etc.
  
  
• SI and DI are string registers and are mainly used for string operation like copying strings, comparing strings and moving strings. Do you remember what is a string, don't you?
  
  
• SP and BP are stack pointers. The stack is like a big pile of data. You can put data on it and you can get data from it. The SP (Stack Pointer) points to the current stack. You can imagine the stack as follows. If you are stacking magazines on the floor, the first magazine you put there will be at the bottom of the pile and the last magazine will be on top of it. This one is the first you'll get when picking a magazine from the stack. Now you have put 100 magazines on the floor and created a stack. The stack pointer will point to the last magazine (top). If you wanna get a magazine that is in the middle, you just change the stack pointer (SP) so that it points to that magazine. Get it. You use the SP to get the data you want from the stack. I'll not cover BP's function cause that's a little out of this tutorial's range.

• Segment registers (this will be a little hard at first to understand, be patient). The 8086 memory configuration is divided in 64Kb blocks. The segment keeps the address to each 64Kb block. To move around in a block the instruction pointer (IP) is used. The address that IP points to is called "offset".

                 segment           offset (IP)
                        \         /
                         013F:0012
  

  So the segment keeps track of which 64Kb block you are in and the IP keeps track of where in that block you are (offset). The segment address depends on the amount of memory that is free. This means that your program will be given different segment addresses if you change your memory (like loading another program). The offset address is always the same.
  
  The segment registers are CS, DS, ES and SS. Here's an short explanation of them:
  • CS: Code Segment, keeps the segment where the actual code is.
  • DS: Data Segment, keeps the segment where variables, strings, etc. are stored.
  • ES: is the same as DS and is used when, i.e., comparing strings.
  • SS: Stack Segment, keeps, obviously, the segment where the stack is.
  
  
• IP is the instruction pointer and it points to the next instruction to be executed by the 8086.
  
  
• The Flags are indicators which can be either one or zero (on or off). They are:
  • C: Carry flag, is 1 when the result of an calculation is greater than a 16 bit number.
  • P: Parity flag.
  • A: Auxiliary carry flag.
  • Z: Zero flag, this one becomes zero or one depending on different instructions, e.g., when comparing two string using cmpsb the zero flag is 0 if the strings are equal or is 1 if they are not equal.
  • S: Sign flag (+ or -).
  • O: Overflow flag.
  • I: Interrupt enable.
  • D: Direction flag.
  • T: Trap.
  
  You don't have to remember all these flags. The most important flag is the zero flag. For example when comparing the number of lives (in a game) with 0. You might change it so that it never jumps to the "game over" code.

THE INSTRUCTIONS SET

• MOV: move, i.e., MOV AX,0011 which loads AX with 0011.
• MOVSB: moves a byte of a string from DS:SI to ES:DI.
• MOVSW: same as above but moves a whole word instead of a byte.
• DEC: decreases a register by one, e.g., if AX is 0004, the DEC AX will decrease AX to 0003. Note: this instruction is extensively used in decreasing the life variable in games.
• INC: increases a register by one (opposed to above).
• CALL: call a subroutine (a small part of code in a program which performs a function).
• CLD: clears the D flag.
• CMP: compare, e.g., CMP AL,61 checks if AL is 61 (the letter "a" in ASCII).
• CMPSB: compare a byte of two strings, DS:SI with ES:DI.
• CMPSW: same as above but compares a word instead of a byte.
• DIV: divide, e.g., DIV AX,0012 divides AX by 0012.
• MUL: multiply (opposed to above).
• INT: interrupt, executes an interrupt, e.g., INT 21 executes interrupt 21.
• PUSH: pushes a value into the stack.
• POP: returns a value from the stack.
• NOP: no operation, doesn't do anything. Note: this instruction is very useful when you have to fill the empty space you left by removing some other instruction, like the DEC in the life decrementing of a game.
• REP: repeats instruction decrementing CX until CX = 0.
• REPE: repeats instruction while equal, e.g., REPE CMPSB keeps comparing byte of two strings as long as they are equal.
• REPZ: repeats instruction while zero flag is 0 (off).
• RET: return from subroutine to (in principle) the next instruction after the CALL to the subroutine.
• SCASB: scan a string for a specific byte that is taken from AL. The address of the string to be scanned is taken from ES:DI.
• STOSB: stores the byte in AL at ES:DI, DI is automatically increased.
• STOSW: same as above but it stores a word instead of a byte.
• TEST: logical comparison with flag settings. You can see it as a CMP by now.
• XOR: exclusive OR. It is like an OR but with the only difference that 1 XOR 1 = 0. It is used to reset registers by doing, e.g., XOR AX,AX. Example AX = 1001, XOR AX,AX =
  
  1001 XOR
  1001
  -----------
  0000 Result
  
  
• JZ: jumps if zero.
• JNZ: jumps if not zero.
• JE: jumps if equal.
• JMP: jumps anyway.

THE INTERRUPTS

         Function         AH      In data
     ----------------     --     ----------
     Output to screen     02     char in DL

MOV     AH,02     ; Put the service number in AH
MOV     DL,41     ; ASCII number for "A" in hex
INT     21        ; Execute interrupt

DOSSEG                         ; We are using DOS segment
.MODEL SMALL                   ; Defines how much memory our program needs
.STACK 100h                    ; Reserves 100h bytes for the stack
.DATA                          ; Under this we shall put our variables
MESSAGE DB 'Hello world',13,10 ; Our message
.CODE                          ; This is where our program starts
MOV AX,@DATA                   ; Put the address of the data in AX
MOV DS,AX                      ; And then move it to DS
MOV AH,9                       ; Select DOS int 21 output service
MOV DX,OFFSET MESSAGE          ; Put the offset of MESSAGE in DX
INT 21                         ; Print the message on the screen
MOV AH,4C                      ; Select service to quit and exit to DOS
INT 21                         ; And execute it
END                            ; End of the program

      Function           Num                    In/out data
--------------------     ---     -----------------------------------------
Input from keyboard      01      AL contains the typed char after
with echo to screen              the int has been executed.

Print char on screen     02      DL contains the char to be printed.

Print string             09      The segment:offset of the string
on screen                        is taken from DS:DX.

Create file              3C      CX attributes of the file, DS:DX
                                 pointer to the name of the file.
                                 Returns AX handle or error code.

Open file                3D      AL access and sharing modes, DS:DX file
                                 name. Returns AX handle or error code.

Read from file           3F      BX handle, DS:DX pointer to data
                                 buffer. Returns AX number of
                                 bytes read or error code.

Write to file            40      BX handle, CX number of bytes to write,
                                 DS:DX pointer to data buffer. Returns
                                 AX number of bytes written or error code.

dosseg
.model small
.stack 200h
.data
password db 'fender','$'        ; The strings and data we shall use
login    db 100 dup (0)
rig      db 'correct','$'
.code
mov     ax,@data
mov     ds,ax
mov     ah,3fh                  ; Read function from int 21
mov     bx,0                    ; Handle 0 (keyboard)
mov     cx,3                    ; Just check the 3 first letters
mov     dx,offset login         ; Offset in DX
int 21h
and     ax,ax                   ; See if something was typed in
jz      fin                     ; No? So end
mov     cx,ax                   ; Move the number of bytes read into CX

mov     ax,seg login            ; Put segment address in AX
mov     es,ax                   ; So we can put it in ES
mov     ax,seg password         ; Same here but with another string
mov     ds,ax                   ; And store it in DS
mov     di,offset login         ; Do the same with the offsets
mov     si,offset password      ; of both strings
repe cmpsb   password,login     ; Compare them
je      equals                  ; If equal then go to equals

fin:                            ; End program function
mov     ah,4ch
int 21h

equals:                         ; Subroutine for strings equal
mov     dx,offset rig
mov     ah,9
int 21h
ret
end

SOFTICE DOS VERSION 2.62

1. Load the program into Softice:
   
   LDR hello.exe
   
   
2. Have a look at the code, you should recognize it.
   
   
3. Put a breakpoint on int 21 (write to file or device):
   
   BPINT 21 AH=40
   
   
4. Let the program execute, it will stop when instruction int 21 AH=40 comes up.
   
   
5. Let's see what is in DS:DX:
   
   D DS:DX and look at the data window. There is our "Hello world" string.
   
   
6. Now let's change that:
   
   E
   
   Now you are in the data window and you are able to change the string to whatever you want. Try and see. When you're done changing the string just hit enter and you'll see that the program prints your changed string instead of "Hello world" that it was supposed to do. Great huh!

AQUANOID

CS:39A9 FF8C44AC        DEC WORD PTR [SI+AC44],+00

FF8C44AC        DEC WORD PTR [SI+AC44],+00

INTERESTING LINKS