Static Pointers/Addresses for games In Emulators

[tacobella]

Hi im a beginner to c++ and im trying to create a bot for a MMORPG game that runs on mobile/emulator.

i used GameGuardian (pretty much used it like cheatengine) to find Dynamic addresses of things like health/stats. but i couldn't continue to find a valid static address/pointer that doesnt change on game restart.

i used cheat engine but couldn't trace a valid static address/pointer.

lastly im a web developer. as far as i understand game sends its requests (packets) C->S and S->C . how can i intercept or capture game actions (such as moving x,y) for such game? how can i find the ip:proxy i need to connect to send/receive packets pretty much like burpsuite

im thankful for hints and im willing to pay for guided consultance for how to build bot emulator games (that doesnt rely on gui)

 

[N0deNull]

To find the IP address and port, it's easy—use Wireshark on your computer or a similar tool like PCAPDroid on android. This method will allow you to capture all packets, although most of them will likely be encrypted. After successfully analyzing the packets, if you can replicate and embed these packets into your bot, you can use PcapPlusPlus (c++) to send and receive packets.

 

[tacobella]

To find the IP address and port, it's easy—use Wireshark on your computer or a similar tool like PCAPDroid on android. This method will allow you to capture all packets, although most of them will likely be encrypted. After successfully analyzing the packets, if you can replicate and embed these packets into your bot, you can use PcapPlusPlus (c++) to send and receive packets.

can u quickly hint what are the process of decrypting or analyzing packets

 

[butterflydoors]

can u quickly hint what are the process of decrypting or analyzing packets

if it is a secure tls connection, then session keys should be somewhere in game's RAM which you can extract and use in wireshark

 

[tacobella]

if it is a secure tls connection, then session keys should be somewhere in game's RAM which you can extract and use in wireshark

thanks for your comment, so basically all the (decrypting packets) requires is to find the session keys and supply it with each packet so it can be sent and accepted from the game?

 

[butterflydoors]

thanks for your comment, so basically all the (decrypting packets) requires is to find the session keys and supply it with each packet so it can be sent and accepted from the game?

its a yes and no answer, this method only works if you actually see TLSv1.x packets in wireshark, otherwise if you see normal TCP connection to the game server and you can't see any readable information in the packet - that is a sign that game uses its own encryption OR compression. Games mainly use data compression rather than encryption, so first try decompressing packets with zlib or any other library