The inside story of the hacker's hacker attack

Practical practices of the hacker Attacking Technology

We talked about the failure of modifying the EXE, and the game was not garbled.

What's going on?

Master continues

Debug the game (one by one)

Similar 00436767. F3: A5 rep movs dword ptr es: [EDI], dword ptr [esi] Found

However, before it, there are:

Ntdll. kifastsystemcallret

0012fe68 | 76f6bb4d kernel32.getmodulehandlea

Lobal/yukasystemrunning

0012eba0 00489974 ASCII "Default. ini"

0012eb94 00260f48 H

&. ASCII "Default. ini"

0012 EBAC 00260fe8? &. ASCII "system/cgmode2_1.ykg"

0012eb94 00260fe8? &. ASCII "system/backtoselect. yks"

0012eb94 00260fe8? &. ASCII "system/Black. PNG"

0012 EBAC 00260fe8? &. ASCII "system/cgmode. yks"

...........

0043363f |. ff15 94604800 | call dword ptr [<& kernel32.readfile>;/readfile

............

00436767. F3: A5 rep movs dword ptr es: [EDI], dword ptr [esi]

What does this mean?

The master guessed that the configuration file could be read in red, causing the modification to fail.

Next we need to find out the configuration file and find out the culprit.

The storage configuration is nothing more than a registry or a file.

Searching for the Registry is fruitless for half a day.

The files in the game directory are not modified (check the modification date)

Just when the masters are unable to do anything

Sister Kong Shen sent intelligence:

Font in data01.ykc

Yuka.exe and restart start. yks processing, and yukawindowclass

Dynamic Process->
Imports text2yks. DLL-> program into yukawindowclass-> program into system. ykg-> mounts to system. dat-> Search for restart start. yks-> If the parameter is missing, the operation is automatically performed. INI settings

Add a single dish .. Inbound

We found a mysterious system. dat file .....

Weapon: Process Monitor

Introduction:

Monitor file system, registry, process, thread and DLL activity in real-time.

Note: In Vista, only File Monitor is run.

I don't know if this software has a Chinese version.

The key is to set the filter, that is, the filter option, to find out the relevant red

Start capture even to capture events

The mysterious system. dat is in the SAVE directory of the game.

Isn't it a full CG archive?

It's easy to rename or remove system. dat and start the cracked exe

Garbled

Successful!

Import Chinese text and display it normally