My IDA Pro tools for reversing games
In case you have been living under a rock, my IDA Pro plug-ins: [Only registered and activated users can see links. Click Here To Register...]
And I'm so humble, but honestly everyone I know that uses IDA Pro for game hacking uses my plug-ins :-P
If nothing else "Class Informer" when their target is typically binary MS/Intel C++ made (like 90% at least) and has RTTI in it.
I have sort of a tool chain I run on game clients in a specific order once I have unpacked or dumped if they encrypted:
1) ExtraPass - [Only registered and activated users can see links. Click Here To Register...]
My plug-in to clean and fix Win32 binary clients.
Mainly it finds incorrect data in code sections that IDA gets confused about and turns it back into code and functions.
If the IDB is pretty clean it does nothing, in some cases even making things worse.
But for rough clients, like ones that have 1000's of little disconnected script bind stubs, etc., it can do miracles. It can find tens of thousands of missing/lost functions making an IDB more whole and complete.
Depending on the client I usually run it several times.
If I see it recovered many functions then I'll keep running it until I get down to a handful or so.
Note for rough unpacked clients (by "client" I refer to the typical game executable) or dumps you have to be careful. In particular if you couldn't straighten out the segments where there is data mixed in with the ".text" segments, etc.
You might have to experiment and turn some options off like "fix code". Always save and back up your IDB first before using.
2) Class informer - [Only registered and activated users can see links. Click Here To Register...]
Finds, parses, places comments and lists RTTI class/struct info.
Knowing all or at least some of a targets key objects, etc., explanation enough.
3) Function String Associate - [Only registered and activated users can see links. Click Here To Register...]
Shows at a glance the strings (at least partially if there is a lot) contained within a function body.
4) Mark reference counts- [Only registered and activated users can see links. Click Here To Register...]
Adds function and data reference counts as comments.
So at a glance you can infer some things such as parent/child function relationships, some use significance for data and functions, etc.
In short form:
1) One or more passes of "ExtraPass"
2) Class informer
3) Function String Associate
4) Mark reference counts
Plus a few others, probably not that significant, that I haven't released yet.
Then run some like my "IDA Signsrch" plug-in to glean some idea of possible cyphers used.
Use these to make your IDA game (and other similar targets) reversing life easier and more productive.
Then another I use a lot for once I've done a lot of reversing is my "IDA2PAT Reloaded" version of the "unique functions to pattern" file
tool plug-in. For all your hard work with the functions you laboriously RE'ed called "DoLootItem", "TargetEntity", and what not you can make a custom sig file to possibly carry on some of this to updated target(s).
If you reverse game or similar binary Win32 clients, check my all free plug-ins out (and feel free to exchange by donating to help pay for my add free web hosting too).
