I am messing around with a game made with CryEngine. It's a MMORPG, but I found out that I can manipulate the X/Y/Z coordinates of my character through cheat engine. And I also found out that I can switch the targeted enemy by changing a value in my memory.This game is made up by a launcher.exe and many dlls. One of them is called CryGame.dll in which is most of the game code I guess.I made a pointer scan on the memory which saves the targeted enemy, but most pointer chains which store my desired memoryregion are saved in the CryGame.dll.Now to my question: Is it possible to inject code into the CryGame.dll or something similar in order to get this memory region and manipulate it (I am trying to make a simple bot for myself).Or does anybody have another idea how to get this value? Normally I would simply make a dll injection into the games process and manipulate it, but since this game is made up of dlls, I can't really hook functions, since dlls change address after every reboot of the game, right?Hope you understand what I meant, sorry for my enlgish.
How to manipulate game which loads many dll's
dll injection;injection
You can certainly hook dlls similarly to how you'd hook any other function. To get the address of a dll function, you'd need to call two windows APIs.First, you'll need to get the address/handle (these are the same when discussing loaded modules) of the module you're trying to hook. A simple method to get that is to call either LoadLibrary or GetModuleHandle. The biggest difference is that GetModuleHandle will not load the dll in case it's not already loaded and will return null instead. You can probably load the dll yourself using LoadLibrary, so both APIs are valid.Second, you'll need to get the address of the function you're interested in. You could use the return value of either GetModuleHandle or LoadLibrary as the current position of the dll and calculate the specific offset of certain functions using it. Alternatively, you can call GetProcAddress to get the address of any function that's exported by the DLL.Keep in mind there are other ways to modify a behavior of a dll:You could patch the dll on disk (assuming there's no integrity checks employed).You can create a DLL proxy using DLL redirection.