Tools required

*W32Dasm -for the deadlisting.
*Restorator -for resource editing.
*Hiew         -for patching the executable.

Target's URL

www.immortaldescendants.org

 

Essay

 
So lets get it on:
firstly, fire up the reme to see whats our task:
1) remove the memo dialog
2) code a random nr generator
3) make the buttons accessible through "m" and "z" on the keyboard

i will start with the 3rd task as it is the easiest in my approach..
so, how can we make a button accessible through the keyboard? easy:
just fire up your beloved resource editor, load the reme and look at the game dialog.
change the buttons captions to "Player 1 '&z'" and "Player 2 '&m'". this way, we created
shortcuts to access the buttons immediately by pressing the according letters whilst in
the prog. one task solved.

lets proceed to task 1, which is the next challeging.. we need to remove a memo.
fire up wdasm and look at the s.d.r for the MEMO.
 

//******************** Program Entry Point ********
:00401000 6A00                    push 00000000

* Reference To: KERNEL32.GetModuleHandleA, Ord:0111h
                                  |
:00401002 E859010000              Call 00401160
:00401007 A39C304000              mov dword ptr [0040309C], eax
:0040100C 6A00                    push 00000000
:0040100E 6842104000              push 00401042
:00401013 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"MEMO"
                                  |
:00401015 6800304000              push 00403000
:0040101A FF359C304000            push dword ptr [0040309C]

* Reference To: USER32.DialogBoxParamA, Ord:0092h
                                  |
:00401020 E81D010000              Call 00401142
 

you see, after starting the program and getting the module handle, the memo dialog is prepared
and called. so we can start patching at 40100C to immediately call the game dialog.
search for it, youll find:
 

:00401086 6A00                    push 00000000

* Reference To: KERNEL32.GetModuleHandleA, Ord:0111h
                                  |
:00401088 E8D3000000              Call 00401160
:0040108D A3A0304000              mov dword ptr [004030A0], eax
:00401092 6A00                    push 00000000
:00401094 68BF104000              push 004010BF
:00401099 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"GAME"
                                  |
:0040109B 6805304000              push 00403005
:004010A0 FF35A0304000            push dword ptr [004030A0]

* Reference To: USER32.DialogBoxParamA, Ord:0092h
                                  |
:004010A6 E897000000              Call 00401142

so lets redirect the prog to immediately jump to create the game dialog.
fire up hiew, press f5, enter 40c
press f3, f2 and enter the following jump instruction:
jmp 486
esc, f9 and the instruction is ready assembled.. you could nop out the following statements
up to 413h just to keep order in bytes.
now, the prog immediately jumps to create the game dialog and the annoying memo is gone forever.
run it to see i am right. B-)

now on to the second part, the random number generator.
as i have ABSOLUTELY now idea how to code a random number generator in asm (i AM a newbie indeed) i decided
to do it in c++ and store all the code in a dll. so we just need to code a dll which seeds the random number generator, generates
a new random number and places it in the according window.
this is done by a simple c++ function which the reverseme calls, exported as ordinal @3 (because i experimented a bit and was too lazy to change it back to @1):

#include <windows.h>
#include <stdlib.h>
#include <time.h>

void Zufallszahl()
{

 int nr = 0; // ID of the edit box to put rand in
 int i;
 _asm{ // check which player's turn
  cmp ebx, 1
   je player1
  cmp ebx, 2
   je player2
 }
player1:
 nr = 1008;
 _asm jmp readytogo
player2:
 nr = 1007;
 readytogo:
 
 srand( (unsigned)time( NULL )); // seed rand.generator with local time
 for(int k=0; k < rand() % 100; k++)
  i = rand() % 100;
 char buffer[5];
 _itoa(i, buffer, 10);
 HWND hwnd = FindWindow(NULL, "Two-Player Number Battler!");
 SetDlgItemText(hwnd, nr, buffer);
}

in the reverseme i added code so that it puts a 1 into ebx if player 1 presses his button, and a 2 for player 2.
the dll checks whose turn it is and places the randomly generated number in the according edit box.
to call the function i used the method dracon describes in his tutorial on adding functions using a dll:
first , use loadlibrary to load the dll, then getproaddress to get the function, call it and clean up via freelibrary:

 :00401180 6816304000              push 00403016  <- "patch.dll"

* Reference To: KERNEL32.LoadLibraryA, Ord:01A9h
                                  |
:00401185 FF1504204000            Call dword ptr [00402004]
:0040118B 8BF0                    mov esi, eax
:0040118D 6A03                    push 00000003 <- ordinal @3 exported function in dll
:0040118F 50                      push eax

* Reference To: KERNEL32.GetProcAddress, Ord:0129h
                                  |
:00401190 FF1508204000            Call dword ptr [00402008]
:00401196 FFD0                    call eax <- call it!

:004011B1 56                      push esi

* Reference To: KERNEL32.FreeLibrary, Ord:00A2h
                                  |
:004011B2 FF1500204000            Call dword ptr [00402000]
:004011B8 83FB02                  cmp ebx, 00000002
:004011BB 0F8477FFFFFF            je 00401138
:004011C1 90                      nop
:004011C2 E945FFFFFF              jmp 0040110C

return control according to which button was pressed:
player1 : jmp 40110c
player2 : jmp 401138

these codes i entered in hiew, after i found some free space at the end of the .code section using procdump and ultraedit

thats it for now,

greetz fly out to all the reverse enginners and especially SantMat, whose reversmes are always fun.

cya, Phueghy
 
 

note: if you have any suggestions/questions or something feel free to mail me at Phueghy@gmx.de
 

 

Final Notes

 
 

So please note!
I take no responebility for how you use the information in this essay, i take NO responebility for what might happen to you or your computer!
You use this information on your own risk!!

What i mean is: Please buy the software!