Little Fighter Empire - Forums - Tutorials

I feel like writing a tutorial - Taking requests

Wed, 01 Oct 2014 22:18:32 +0200

As the title says I feel like writing a tutorial about programming, but I don't have an exact idea of what I want to write about, so I'll be taking requests.
Basically write a post in this thread and I'll pick some and try to write a tutorial on it, so if there is something in programming you find hard to grasp or want to learn about, then now is the time ask.

Todo-list:

The stack
Threading

[TUT] Object-Oriented Programming: A Small Opening

Fri, 29 Jul 2011 17:02:05 +0200

Hello there members of LFE! It's been quite some time since I posted a thread and I believe a decent tutorial, as such I've decided to make a small tutorial on understanding Object-Oriented Programming and some of it's concepts to allow any of you budding programmers to get a little bit of an easier start, especially during Bamboori's current game making competition.

So, what do you expect to learn from a tutorial such as this?

You will learn from this tutorial (provided you actually go through it):
- What is Object-Oriented Programming
- Why would Object-Oriented Programming be used
- What popular examples of programming languages use it
- What an Object is
- What a Class is

Now, in this tutorial you will in time see sections of code. This code is Java because I feel that it is a fairly easy language to understand and won't make you brick it before you've even begun. Later on I will add a post telling you that I have editted the main document of this tutorial to also include C++ or C. This may take a little while longer, but it will be placed there for those of you learning or remembering the C or C++ languages. I have not put any code in straight away so that you may understand the principles without delving too far into programming too quickly.

So, lets make a start on this tutorial...

What is Object-Oriented Programming?

Programming can be split into two general groups: Procedural and Object-Oriented. Throughout this tutorial I will use "OOP" for Object-Oriented Programming and "PP" for Procedural Programming. The difference between the two is that one focuses on the "objects" that are to be dealt with and the other focuses on the "actions" or "logic".

As the names suggest, Object-Oriented programming focuses around the "objects" and Procedural focuses on the "actions". In Object-Oriented programming, what you really want to know about is the "object", rather than what is needed to manipulate it.

Why would Object-Oriented Programming be used?

OOP is generally used because it makes the programming that much more manageable. In teams of programmers, each team can work on a specific "object". In PP, it'd be a lot harder to divide the work up into teams and is probably better for a solo effort or person to manage.

OOP can also be a lot faster to produce programs, this because of the less instances where "inaccuracies" or "errors" may be found in the coding or file, whereas with PP the files are generally a lot longer and therefore have a higher chance of holding these "inaccuracies" or "errors". With OOP you can search for the relevant file and filter through it far more easily than you can PP to find these, because they are that much smaller.

You will find such things as "Classes" in OOP which you would not in most cases of PP. Classes will only contain data that is relevant to it, and so programs will not have to sift through files that are not responsible for the data or are not meant to be used. This will limit data corruption and can heighten the security of the system. The data is described as "hidden". These "Classes" are also not just reusable by the program that you have created, but by other programs that involve them. This means that you can create something that can be used by multiple different programs, thus saving a large bundle of time.

What popular examples of Programming Languages use Object-Oriented Programming?

Now we're making good progress, and you're about to find some information that will encourage you to learn more OOP. These popular examples use OOP:
- Java
- C++
- Python
- VisualBasic.NET
- Ruby

What do you know about these programming languages? For starters you should probably know that some of these are what most programmers use today to create brilliant games for your computer. Yes, the games you know and love.

How many of you have played Minecraft? Did you know that it is entirely coded in Java? And how many of you possess a copy of 3D games such as Mass Effect and Mass Effect 2, particularly on the computer? These games would have been coded in C or C++, much like LITTLE FIGHTER 2!

What is an Object?

Time for us to get into the nitty gritty of the tutorial, the actual important part. If you look around you right now, you will find plenty of objects around you. Tables, chairs, the TV, your computer, all of these are objects.

Pretty simple right? Now lets dig a little deeper and progress into an object...

Objects in the real world have something known as a "state" and a "behaviour". I'm now going to use your computer as an example. The "states" your computer might have are; Make, colour, model, style (laptop or desktop), on, off, current brightness, current volume. Now, what "behaviours" does it have? Here are a few examples of behaviours; Turn on, turn off, increase brightness, decrease brightness, increase volume, decrease volume.

Now look about your environment and list 3 objects, with some of their states and with some of their behaviours. This should help you get to terms with objects.

In terms of software, these ideas in OOP are exactly the same as in the Real World. They have a state and they also have behaviours. An objects state is stored in "fields" or "variables" (depending on what programming language you use) and it's behaviour in "methods" or "functions" (also depending on what programming language you use). These "methods" or "functions" perform or "operate" on a programs state to change or modify it.

What is a Class?

To sum up classes in a fairly simple and easy to understand word, a class is a "Blueprint" from which objects are created. There are many different variations of the same object in the world, for example bikes. Every bike is made out of the same base components; gears, pedals, wheels, seat and frame.

Because of the variance of these components between different bikes, your bike (as an object) is an "instance" of the class of bikes. It is just one in a wide variety of bikes.

Now I'm going to show you a basic example of a Class, without going indepth into the coding of it for now:

JAVA-Code:

class Bike {
 
       int gear = 1;
       int speed = 0;
 
       void changeGear(int newValue) {
            gear = newValue;
       }
 
       void speedUp(int increment) {
            speed = speed + increment;   
       }
 
       void applyBrakes(int decrement) {
            speed = speed - decrement;
       }
 
       void printStates() {
            System.out.println(" speed:"+speed+" gear:"+gear);
       }
}

This is a Class. As you can imagine and see, the "speed" and "gear" are the bike's state or variables and the "changeGear", "speedUp" and "applyBrakes" are the behaviours or methods after interaction with the outside world.

For those of you that understand principles of coding, you will notice there is no 'main' included. You will also understand the reason why, considering it is a Class. However for those of you that don't normally delve into programming, or this is more a first time for you, the 'main' method seen in most programs is of severe importance. It is where the program begins reading the code and also where other methods are stored. As the Class is a "Blueprint" for the bike, it can be used in an application, but isn't needed. The actual "Use" of a bike belongs in a "Class".

Well, I told you that this would be a rather small tutorial for me. You won't have to scroll down the page so much and you should have found this tutorial fairly easy to understand.

You should probably look out for the next tutorial on Object-Oriented Programming that is coming soon. It will cover "inheritance" and then will move you into some basic exercises for OOP in which you can actually write some code yourself. It will then go a fair bit more in-depth into the programming side so you can find what you're looking for within program examples or for personal use in developing programs.

I hope this tutorial has been a fair bit insightful for you all and managed to break programming down into a lot easier bitesize pieces. Unfortunately this is all for me today, I will post up questions for you to answer and more exercises early on next week (Monday more than likely) and will try to finish up the next tutorial for you all.

Have fun everyone,

Eddie

[TUT] Introduction To OllyDbg And How To Find Your Way Around It

Sun, 01 Aug 2010 23:08:54 +0200

Introduction To OllyDbg And How To Find Your Way Around It

Hello!
Once again guys I am back with another tutorial. This time I'm going to be discussing the program OllyDbg and giving you a brief introduction on how to use it/find your way around it. I will be asking you to install it at some point during this tutorial because it is REQUIRED for you to totally understand the tutorial and it also the program you will use when we start modifying the Little Fighter 2 program. So to start...

OllyDbg is a 32-bit assembly level analysing debugger. Thats all well and done but what does it mean? Lets start by taking a look at the word debugger. OllyDbg is a debugger that is used for debugging or locating and correcting errors in an executable file, like that of the Little Fighter Program.

Okay now for the slightly more tricky understanding in my opinion; assembly. Assembly level is the level of coding or programming just before machine code. It is the closest thing to machine code that a human can understand fully and write programs in, otherwise known as a low level language. Does that mean that there is a high level language? Yes, not just one, but lots of them. Examples of high level languages include C, C++ and C# (just to note down all the C's). 32-bit assembly level is Assembly written for programs or computers that can utilise or move memory in 32-bit groups.

That is all simple yes? So now lets put it all together. OllyDbg is used to analyse and locate or correct errors in 32-bit executable files. Now thats in a whole lot more easy context, we can begin looking at the program.

So why is OllyDbg important? You're going to be using it (in the majority of cases) more than any other Hex or .exe editing tool when you are looking at the Little Fighter program. So now lets get on to the actual inspection of this program.

Download:
http://OllyDbg.de

Download the program from the link given above. You're looking to download OllyDbg110 (not 2.0) which should be in a link on the left hand side of the web page.

Now once you've downloaded it, extract it to your desktop. Note that you do not need to install the program, you just need to run it. For Vista and Windows 7 users, I suggest right clicking and run as administrator - it gives you a pop up otherwise which you and I would much rather avoid than have to close down every time we open up the program.

Now once its open you should see either a white screen with four main panels, one of them with Registers written at the top of it or you will see a grey screen. If it's the grey screen then click on "View" and click on "CPU" from the drop down list. Now you should definately see four white panels on the screen stuck together, similar in appearance to this:

Numbered Screen (Slightly Large Image Warning) (Click to View)

I have numbered each of the panels that we see infront of us. So I'm going to give a brief look at each of the panels quickly so you can understand what they are:

1) CPU/Coding Panel -
The largest panel on the screen is the most important panel on the screen. The CPU or Coding Panel is where all of the Assembly code is produced or viewed when you are looking at an executable (.exe) file. In almost all of the Hex/.exe Editing tutorials or works produced by Silva and other Hexidecimal/Debugging experts you will have had to use this section of OllyDbg. This will be true to all the tutorials here to come, you will use this panel most of the time.

2) Registers Panel -
The Registers Panel is to the right hand side of the CPU/Coding Panel. This panel holds the information on standard registers, flags, section registers and extra information on FPU, MMX, Debugging, etc. As you go through the code it will be obvious to notice that the contents, register values and flags may change. They will not be the same everywhere that you look.

3) Stack Panel - This panel holds addresses for the program which you can then find in the disassembler/cpu section or in the memory dump section. These addresses can either be given as virtual addresses which identify virtual (non-physical) entities (used in virtual memory and virtual network addresses) or an offset (an integer that indicates the distance of the beginning of an object up to a specific element or point) from a specified or 'direct' address. Each four byte section is displayed as a hexadecimal value, which can then be shown as ASCII or UNICODE or not at all. Some extra comments like those in the CPU/Disassembly panel are also shown.

4) Memory Dump - This panel is a dump for any memory addresses in the program. Raw data is given alongside these addresses and the data can be displayed in ASCII, UNICODE, etc. The data can then be edited in a similar fashion to the disassembler itself. Each line represents one 32-bit section. Alongside the Disassembler/CPU panel, you will use this panel most.

Okay we've now become familiar with the panels we'll start looking at the program a bit more in action. To do this, you're going to need an UNMODIFIED LF2 v2.0a. If you use a different version chances are you may not be able to keep up with what I'm going to do in this tutorial.

If you haven't already got an unmodified LF2 v2.0a, here is the link to download it:
http://www.lf2.net/dn_fx.html

Just click the 'download now' button under the picture and it then you'll be directed to a new page where you get a pop up screen for the program download. Once you've downloaded it, install the Little Fighter program.

Okay, now in OllyDbg we are going to go to either:
1) Click File ---> Open
2) Press F3
3) Click the Folder Icon

This will bring you to a small window where at the top it reads:
"Open 32-Bit executable"

You will now go through to the folder where you installed LF2 v2.0a to, for most of you this will be:
Drive C: ---> Program Files ---> LF2_v2.0a
Then click the Lf2.exe icon and click open.

Your screen should now look like this:

Loaded Up Screen (Click to View)

As you more than likely cannot see the writing, this is the first four lines you should see in the disassembler/CPU:

ASM-Code:

00445560 > $ E8 F8040000    CALL lf2.00445A5D   ; This line is highlighted in grey/black
00445565   .^E9 35FDFFFF    JMP lf2.0044529F
0044556A  /> 55             PUSH EBP
0044556B  |. 8BEC           MOV EBP,ESP

Now you can probably understand why I showed you the blank OllyDbg window first in this tutorial... it doesn't scare you off. Right now several of you (this happened to me as well) looked at the massive amount of EAX's, MOV's, DWORD's, numbers, etc and this thought ran through your mind or out of your mouth:
"OH MY BLOODY GOD, WHO ON THIS BLOODY PLANET CAN UNDERSTAND THIS!?"

Fortunately for you, this tutorial will not require us to go in depth into the language or for me to explain it to you. This is going to be a simple moving your way around the program kind of tutorial. So let us continue.

Running and Restarting
For a debugger to find any flaws in the code you need to be able to run the program. Well, this is possibly the easiest task I will ever set you in OllyDbg, so there is no need to worry about your skills, just familiarise yourself with the controls. Test out each of the following methods to run the program to make sure you understand:

1) Click Debug ---> Run
2) Press F9
3) Click Play Button

The Little Fighter program should now have started loading. It should then pop up on your screen or on your task bar. Feel free to click on it and play it, but make sure you can see the Disassembly panel in full when you do. When you're playing it for however long, keep looking at the panel.

Keep the Little Fighter window up after you've done playing, what special feature did you notice on the OllyDbg? Were you paying enough attention? If you can honestly say you saw absolutely nothing change then you were paying enough attention. Now close down the Little Fighter window. DAMN! The code jumped to some number beginning with 7?

Well, now we have a choice on how we're going to get back to the start of the code, which is vital if we really want to look throughout the program. So here's what we can do:

1) Close down the window in OllyDbg by clicking the exit button and reload everything (most time consuming).
2) Click Debug ---> Restart
3) Press Ctrl + F2

Now if you've done that correctly we're back at our first step, yay us!

Stepping Over, Stepping Into and Goto Expression
Alright, so we've learnt how to run our program and restart it just in case we lose our place. Unfortunately as you might have realised, we're running way too quickly through this code for us to really analyse it and do any work on it. What we really want is a way to go step by step through the code so that we can see what bits we like or don't like, and what bits we want or do not want to modify.

OllyDbg as a debugger requires the ability to do this for it to be an effective debugger. So that is absolutely perfect, we don't need to keep clicking through the code, we have something that does it for us. However, before we're going to do this, I want you to quickly look at the Registers panel (panel 2 in first image). It should look something like this:

Registers Panel (Click to View)

Note how it says this:

ASM-Code:

EDX  00445560  lf2.

That shows you that the command or code:

ASM-Code:

00445560 > $ E8 F8040000    CALL lf2.00445A5D

Is the 'Entry Point' of the program. This is where the code is read first when the program is loading up. So that's good news, we never have to hunt down the entry point for the Little Fighter 2 program. Note, that is entry point is not the same for all programs, it is only the entry point for LF2. So before we continue, lets note down the address:

00445560

We're going to need to remember that for whe we wish to get back to the Entry Point without restarting. So now lets get back on to the task at hand.

'Stepping over' is the process of going through code line by line in OllyDbg. It can be done by one of two methods:

1) Click Debug ---> Step Over (Slower)
2) Press F8 (Faster)

So lets quickly 'Step Over' onto the next line of code. We should now be on this:

[Code=ASM]00445565 .^E9 35FDFFFF JMP lf2.0044529F[/code]

Take a look at the Registers Panel again and you'll find that it has changed.

Registers Panel (Click to View)

Note how we can no longer see the and instead see something along the lines of this:

ASM-Code:

EDX  770964F4  ntdll.KiFastSystemCallRet

As you step through code the Registers Panel will constantly change its information. But this is just going to be an observation for now, most of the time this will not be relevant to you in your work on modifying the Little Fighter program, so let us continue once more.

Press F8 again to step over the code to the next point. Damn, we're at a completely different location and none of the code looks the same! This is now the perfect point for me to explain to you a tiny amount about the JMP and CALL commands. Both of them are used to get the computer or machine to read instructions or code elsewhere in the program. So why didn't it change what we saw on the screen when we stepped over the CALL command? Good question. The JMP command is otherwise known as the "Jump" command. What it does is it sends the machine to an address where the machine then continues from there. With the CALL command, the machine is told where it needs to read some code from but it continues to read code after the CALL command. Thus you do not see the jump, it's still reading on from the last point.

So let's go back to the CALL command at the Entry Point of the program. How are we going to do this? We can do this in two ways, using the address we had before. So I'll show them here:

1) Right Click ---> Go to ---> Expression ---> 00445560 ---> OK
2) Press Ctrl + G ---> 00445560 ---> OK

Of course there are other ways to get back to it, but if you're really interested in a certain code the best option is to note down the address. You can then goto the address as it's shorter to type in and therefore easier to remember.

Most of you will wonder why we didn't press Ctrl + F like we do in all sorts of programs. Well it is used for finding stuff yes, it's used for searching for commands. Why didn't we use that? Commands are longer to type, and I doubt you would rather keep writing down commands you need to find when you realise that some lines have the same command.. oops. It's much easier to note down the address and goto the expression instead, also a lot less time consuming in most cases.

We should be back at the Entry Point now. We shall now see what code is being read through the CALL command. To do that we can go about in either of these two methods:

1) Click Debug ---> Step Into
2) Press F7

After we've done that, you should arrive at a screen like this:

Stepped Into (Click to View)

What you've just done is gone into the CALL command and address it tells the computer to read, which low and behold has a whole lot of new commands - YAY! However I am not going to explain what they mean for now, I am going to leave you to play around for a bit. Practise going through the 'Stepping Over', 'Stepping Into' and 'Go to' commands. Once you have done playing around with those commands, move on to the next section of the tutorial.

Breakpoints
Alright, press Ctrl + F2 if you haven't already to get back to the Entry Point of the program. We're now going to delve into the world of Breakpoints. Breakpoints are pauses within a program at certain points mainly for the purposes of debugging. This allows the person inspecting the code or program through the means of debugging to look at and test different bits of the code. It also allows them to inspect register values and other sorts of bits and pieces.

So what we're going to do in this part of the tutorial is set breakpoints, and give you a general idea of CALL and JMP commands first hand. So lets begin with how to insert breakpoints. There are many different ways to insert them and many different ways in which they function, for this tutorial though I am only going to explain your basic breakpoint. So there are two ways of inserting breakpoints:

1) Right Click ---> Breakpoints ---> Toggle
2) Press F2

So lets start off by 'Stepping into' the CALL command at the Entry Point. Press F7 to go into the CALL command. Now press F2 then F8 two times, followed by F2, and then F8 four more times before F2 again. Your screen should look something like this:

Breakpoints In CALL (Click to View)

As you can see, these little red markings on the address signal for breakpoints. So to prove that the CALL command gets the machine/computer to read these instructions we're going to restart the program using Ctrl + F2. Then we're going to run the program using F9. BAM! The program stopped at the first breakpoint, but didn't we restart the program?

OllyDbg remembers the breakpoints you put in a program, no matter how many times it has been restarted. So, lets just see what happens when we press F9 again. Once again the program is stopped from being read at the breakpoint. By pressing F9 and running the program again it will stop at our last breakpoint. So... what happens when we press F9 one last time? You guessed it, the program just continues being read as there are no more breakpoints. WOOHOO! As the program is still running, let us remove the breakpoints by clicking on their lines and removing them the same way we added them (press F2).

Now to show you the difference between CALL and JMP before your very eyes. So let us click on the JMP command line and press F2. This will set the breakpoint on that line. And then we'll click on the line below it and also press F2 to give it a breakpoint.

Breakpoints Set (Click to View)

We'll quickly press F8 to get OllyDbg reading the JMP command instead of the CALL command and we'll press F7 to 'Step Into' the JMP command. We'll press F2 to set another breakpoint and then press F8 twice and F2 once more to set the last breakpoint.

Last Breakpoints (Click to View)

Now we're going to press Ctrl + F2 to restart the program. Then we will press F9, as expected the program has stopped being read at the JMP command. So what we'll do is press F9 again. The program then stops at PUSH command and then if we press F9 again it stops at the next CALL command. Lets press F9 one more time after this. The program fully loads up... hmm, interesting. Lets click on the two lines after we went into the JMP command and remove the breakpoints. We'll then close down the Little Fighter window that popped up and press Ctrl + F2 to restart the program in OllyDbg.

Now lets go through it again, press F9. It's stopped at the JMP code as it had done last time. Now lets press F9 again. The Little Fighter window loaded up perfectly! How can this be? As I said before, JMP makes the machine change location of what its reading entirely, it doesn't 'Step Over' the JMP command and so that line isn't accessed. So you're bound to ask: Why on earth have that line there then? If it's not useful what is the point in it?
Answer: Who said there wasn't a point in it? It just isn't involved in the start up of the Little Fighter program window. It may well be useful later on in one of the game modes or during one of the fights where suddenly everything just stops working. Now wouldn't that be a lol?

Now would be a good time for you to restart the program using Ctrl + F2. After you've done that, click on the lines with breakpoints and remove them by pressing F2. You've now completed the breakpoints section of the tutorial. So let us move on to the next part.

Comments
To make code easier to understand, most people add comments to it. These are generally sections that the machine or computer does not read or take into account when running the program. They're visible only to the reader so that they may understand the code that is going on better.

I'm going to teach you how to add comments. It's a simple process and will only take up a short section of this tutorial. So please read it. Here is how we'll add a comment:

1) Right Click ---> Comment ---> Type In "This Is A Comment Example" ---> OK

2) Press ; ---> Type In "This Is A Comment Example" ---> OK

Oh look, our comment appears next to the code, like so:

ASM-Code:

00445560 >   E8 F8040000    CALL lf2.00445A5D                        ;  This Is A Comment Example

Now you can add comments to your work. This should make your work slightly easier to read and to understand when you come back to it later.

Searches
You must be really dedicated to making your way towards becoming a Hex Editor/Exe modifier. This hasn't exactly been a short tutorial and you seem to have stuck through all the different sections and more than likely went through all the activities. If you have done so, well done. If you haven't, go back and do it or if you're too lazy - I suggest you stop reading this tutorial. There is no point in doing this if you do not wish to progress any further.

In this next section, I'm going to keep you up to scratch with using searches in OllyDbg. Yes we have already covered the use of 'Go to' feature, but what if we don't know the address of what we want? Well if we know different details then we can go about it different ways. So I'm going to show you a few of the ways.

1) Ctrl + F (Search For Command) -
If you know the command you are looking for then this is definately an option for you to search. What you simply have to do is press Ctrl + F or:

Right Click ---> Search For ---> Command ---> Type It In ---> Find

You can then type in the command that you are looking for, for example we're going to type in:

PUSH EBP

When you click on the Find button, the next four lines of code at the top of the Disassembly panel should look like this:

ASM-Code:

004013FB  |. 55             PUSH EBP
004013FC  |. 57             PUSH EDI
004013FD  |. 56             PUSH ESI
004013FE  |. FFD1           CALL ECX

Well done, you've executed your first Command search. Unfortunately what you probably didn't think about before you did this (unless you're TheNave, Silva or other experienced .exe modifiers, or someone with an ounce of common sense) is that there is more than one line that has this command. Great, so lets try doing the command search again.

By repeating the steps above you find that you are... at exactly the same place? How can this be if there's more than one line with that code? Okay lets move on to finding the rest of them. This is what you're going to do:

Right Click ---> Search For ---> All Commands ---> Push EBP

Your OllyDbg screen should now look like this:

All Command Full (Click to View)

or like this:

All Command Mini (Click to View)

Either way, you've just taken a quick glimpse into raw hell. You now know why I told you NOT to use the 'Search For -> Command' earlier, it's just far too much hassle for you. You only need to use it when you can use a useful command line, but we'll go into that in other tutorials. For now, just use Ctrl + G (Go to) and type in 00445560 to get back to the entry point.

2) Search For: All Intermolecular Calls
Suppose you want to see all the different CALL commands in the program. This is probably a better way of looking at the CALL commands then doing the 'Search For: Command' to look for a CALL. What you do is this:

Right Click ---> Search For ---> All Intermolecular Calls

Similar to with the 'Search For: Command' window that pops up, you should get OllyDbg to look like this:

Intermolecular Calls Mini (Click to View)

Or this:

Intermolecular Calls Maxi (Click to View)

Feel free to run yourself up and down the list. There are some problems with this method still as some CALL commands may lead you to the same place. This is a lot less frequent than finding the same command over and over again in the 'Search For: Command'. Well I guess it's time to close that window and then once again Ctrl + G to the address 00445560.

3) Search For: All Referenced Text Strings
Right, searching for Strings will take you to sections where a certain word or phrase is produced, even an error message. So what we're going to do is find out about this String search.

Right Click ---> Search For ---> All Referenced Text Strings

You should get OllyDbg to look either like this:

String Mini (Click to View)

Or this:

String Maxi (Click to View)

Either way, it doesn't matter. Unlike in the other two sections of searching I have shown you, this one we're actually going to do some more in depth searching. So here is what you're going to do:

Right Click (In The New Window) ---> Search For Text ---> Tick Checkbox "Entire Scope" ---> Type In "hit_Fa" ---> Click OK

You should get a screen that looks like this:

hit_Fa Search (Click to View)

Feeling happy now aren't you? You found something which most of you can understand from your DC work and with very little fuss at all. So lets go find out some more about the code around it! So here's what you're going to do:

Right Click On The Line ---> Follow In Disassembler

You'll then reach a page with coding like this:

ASM-Code:

0040D353   . 68 44804400    PUSH lf2.00448044                        ;  ASCII " hit_Fa: %d"
0040D358   . 56             PUSH ESI
0040D359   . FFD7           CALL EDI
0040D35B   . 83C4 0C        ADD ESP,0C
0040D35E   > 8B85 D8070000  MOV EAX,DWORD PTR SS:[EBP+7D8]

Wowza. We've learnt to find code related to specific strings. Now, lets see what the line is in the memory dump.

Right Click The Line ---> Follow In Dump

Your Memory Dump should now look like this:

Memory Dump (Click to View)

Not something you will find particularly easy to understand. In fact, by the looks of it, that is no use to you at all is it? But I'll give you a slight tip, looking at the first 5 double digit numbers in the Hex Dump (in your Memory Dump) and then look at the second column of the Disassembler from the left along the same line as "hit_Fa". They're exactly the same! Well spotted, that was just an observation though... nothing important to you... well for now most probably.

That is all I am going to teach you as of searches for now. It is my highest doubt that you will ever need most of the searches, if I am wrong I will simply cover them in a later tutorial. Now on to the final task at hand.

Modifying
Yes the one part of the tutorial that most of you have been waiting for; the chance to modify the Little Fighter program! This is possibly what you've all been thinking about the whole tutorial - why won't he get on with it. Well truth be told, you're not actually going to be modifying anything in this tutorial.
Reader/Pupil/: WHAT!? ARE YOU SERIOUS!?
Me: Yes, deadly.

If you've been reading through this tutorial as thoroughly as you should have been to get to this point, then it is next to impossible for your mind to really take in too much more information. So I'm only going to outline HOW you would go about modifying, not actually demonstrating any modification to you. If I explained the modification process, it'd mean I'd have to explain some of the code and what it's there for - not going to happen.

So let us begin the short lesson on modification of the program. Before you do anything towards changing or editing the code - YOU MUST MAKE A BACK UP OF THE .EXE FILE. If you make one mistake in the .exe you will find yourself in a bit of a pickle and your favourite game/program may have to be reinstalled again. If you downloaded it off the internet then deleted the downloadable files - serves you right if you don't make a back up. I suggest making a folder on your desktop named "back up exe's" or "original files".

Next is the very simple process of how to modify. Here is how you do it (please restart the program using Ctrl + F2 before you try this):

1) Press Spacebar
2) Right Click (in this case on CALL command) ---> Assemble

You should now have a little screen pop up. In this screen we would normally edit the code that goes into it by typing the instruction and then pressing Assemble. You are not going to do this right now so I suggest pressing Cancel.

We've finally reached the end of this tutorial. Hopefully you have gained a lot through reading this tutorial, it's taken me most of the week to write and then rewrite because I lost it, touch it up so the language was easy to understand, add screenshots and the like. I have to say its been one of my biggest tutorials so far in terms of size if not the biggest.

In summary, what you should have learned through this tutorial:
- What a Debugger is
- The layout of OllyDbg
- How to add comments
- How to modify (briefly)
- How to search through a program's code
- How to use Go to
- How to insert breakpoints
- How to Step Over and Step Into
- How to Run the program
- Brief introduction to JMP and CALL commands including similarities and differences
- Different types of searches
- How to restart the program within OllyDbg

I am sorry that I went so in depth with the tutorial, but it is better that way I suppose. If I didn't go in depth in the parts that might have needed it, then you wouldn't have understood it so well. For those of you 'Work Dodgers' you managed to escape narrowly without having to answer questions and for those of you 'Work Lovers' I am sorry I hadn't included any questions, I just didn't deem them necessary as part of the main tutorial.

Also quite a lot of you were expecting me to do a tutorial involving all the different programs that you may be using when trying to modify Little Fighter programs or other programs. The reason I have done OllyDbg seperately is because it is on a whole other level to the uses that you have with the other programs I'll be showing you. It takes a lot more time to explain in my eyes and so deserves a complete post of its own.

Okay, most of you are probably asking what tutorials are to come and how long they are going to be. There are quite a lot of tutorials to come and they will all be relatively long, some longer than this one and some shorter. I plan on only passing on the information you need to become proficient with the tools, languages and understanding and no further. I am not going to make you become absolute masters of the coding and programming languages, but I will not just scrape the surface on any of my subjects.

The tutorials that you can look ahead to:
- Introduction to ResourceHacker and Hex Editors (including Hex Workshop as a main Editor)
- The Basics of Assembly
- The Basics of C++
- Deeper Assembly and C++ Tutorials
- Specific Little Fighter Modifications (eventually involving the addition of new states and Itr's - when I get around to studying the program enough myself)
- Many, many more.

So yeah, this will not really be a short term fixture. I intend on keeping these tutorials coming for as long as there are people that may wish to read them or may inhabit this site/forum.

Now for a few side notes:

1) If you wish to take this tutorial and put it on another Little Fighter forum or website please come to me for permission to do so. I am not saying this because I feel harsh, I am saying this because I had intended on this tutorial giving people on Little Fighter Empire an upper hand or advantage against the other forums for Little Fighter programs. I also had a very polite young lady ask me through PM if she could take my last tutorial and put it on her school system, of course I gave her permission.

On the condition that I do give you permission, please state who wrote the tutorial and where it was from. It's only polite and is a good precaution against plaguerism.

2) For those of you that are interested, may you please post a reply if you want me to add some questions within the next few days for you to do. If not questions then ask and I will post some activities for you to try out where you can search through code and test your understanding of the tutorial. In general, just give me comments and criticism, it'd be great to improve in my next tutorial and make it more understandable for those of you who read the whole post (hopefully the majority).

Once again guys thank you for reading, it's been a pleasure to spend a lot of the last week writing this tutorial. And on one last note, based upon somewhat of a Hex Editing/Exe Modifying hero on these forums, Silva said:
'Not enough people read long posts'
Maybe it is a good idea if a lot of us start. If you don't read the length of my posts, most of the time you will not understand what I'm saying and so your replies will be useless.
If I have covered a topic that your reply specifically indicates and shows you haven't read it, I expect other forum members if not myself to simply tell you to 'read the first post'. I'm not trying to be harsh, but it will help you in the long run as most people will eventually tell you.

Thank you and I hope this helps,

Eddie

P.S - I think I just came up with a decent name instead of 'Unique Member'; Slave Driver. I've probably said it before, but the title fits.

[TUT] Understanding Computer Numeric Systems

Fri, 23 Jul 2010 13:35:31 +0200

Understanding Computer Numeric Systems

Note:
The only thing you will need for this tutorial is a bit of thought. You will not need any programs, although you may want to grab a calculator or do the math work in your head. I'll give points where you can do a bit of thinking/explaining to yourself so that you can make sure you understand the work. These will be provided at appropriate points in the tutorial.

Whenever you write a program you will be using a programming language, whether it is Java, C++, Python, you will be using a programming language. The languages you use are made up of 'characters' or symbols. In everyday language these characters/symbols would be called letters or signs (full stop, comma's, question marks, signs, etc), but for computer talk we will refer to them as characters.

In almost all cases, the computer would see these characters as jumbled up jargon, no matter how you put them in. Well constructed sentences still mean nothing to the computer if it is trying to run them directly. For the computer to understand what you're trying to tell it to do the characters are converted into numbers for various numeric systems.

This is where this tutorial is going to come into play. I'm going to teach you a few different numeric systems that the computer uses (decimal, binary and hexadecimal). Let it be known whether you deliberately use them or not in your work, the computer still uses and reads them. The latter two will be the most use to you in terms of modifying Little Fighter 2.

Decimal
The Decimal numeric system is the most familiar one to you. This is because you use it in every day life. It makes use of these 10 symbols:

Decimal Symbols Wrote:0, 1, 2, 3, 4, 5, 6, 7, 8, 9

Each symbol is known as a digit. Multiple digits are capable of being combined in various different ways to produce all sorts of numbers imaginable.

It is called Decimal as it is based on 10 digits (Dec- in Decimal means 10). Although it is common knowledge how to use the Decimal system I am going to show you anyway, purely for the sake of conversions and later ease through the tutorial.

So here is I would like you to represent your numbers, given a few as examples (Note * means to multiply by):

Decimal Examples Wrote:0 = 0 * 10⁰
1 = 1 * 10⁰
2 = 2 * 10⁰
10 = 1 * 10¹ + 0 * 10⁰
20 = 2 * 10¹ + 0 * 10⁰
24 = 2 * 10¹ + 4 * 10⁰
371 = 3 * 10² + 7 * 10¹ + 1 * 10⁰
632 = 6 * 10² + 3 * 10¹ + 2 * 10⁰

Now hopefully you've understood those fairly well by looking at the pattern. So I'm going to give some rough explanation. Anything to the power of 0 (⁰) = 1. You will always use 10⁰ on the furthest right digit. From the furthest right digit, you will count every digit to the left of it, to find what number to use to the power of. I'm going to use 2835561, 38471, 17 and 9643 as examples here to show you how its done:

Examples Wrote:l 6 l 5 l 4 l 3 l 2 l 1 l 0 l

l 2 l 8 l 3 l 5 l 5 l 6 l 1 l
l 0 l 0 l 3 l 8 l 4 l 7 l 1 l
l 0 l 0 l 0 l 9 l 6 l 4 l 3 l
l 0 l 0 l 0 l 0 l 0 l 1 l 7 l

Now you can see how they all line up perfectly. The numbers at the top are your positions or powers for each digit. Thats how you are going to allocate the correct powers when using the equations.

From the mock table you have also noticed that I put 0's in the entries where no other digit would take it up, but why don't we do that when we write down numbers? It is actually to save time, hassle and in this case confusion. You should not write any 0's infront of your numbers for future reference.

A faster and possibly more efficient way to find the powers is to do the "n-1" rule. n in this rule is how many digits from the right your digit is at. You then subtract (-) 1 from this to get the power that you will be using. Here's an example, where we'll find the power for the digit 3 in 28367:

n-1 rule Wrote:28367 l
3 is 3rd along from the line to the right aka n = 3.
n-1 rule is used.
3 - 1 = 2
So we do 3 * 10²

You start your counting from the line (visible or invisible - however you decide to do it) and go left. Simple right? You should use whichever you find easier out of the table and the "n-1" rule. Soon enough you will be able to do it in your head without even thinking about either of the rules, you'll just know it off by heart. These two methods are just stepping stones to get you on your way.

Questions
1) Split apart the numbers 84536, 487 and 14 into their seperate equations.
2) Find what power of 10 the 4's are in 84536, 487 and 14 using "n-1" rule.
3) Find what power of 10 the 2's are in 934218, 87326 and 2918345 using the table rule.

Binary
The most fundamental of computer or machine languages is the Binary system. It is known as the Binary system because it utilises a base 2 system (bi- in Binary means 2).

When a computer deals with a piece of information, it considers it either true or false. If it is considered true then it is given a value of 1, if it is considered false then it is given a value of 0. Hence there are only two symbols in this case that the computer will respond to.

Now we're going to learn to count in Binary. I'm assuming that when you first read something like 101000111110110010101 you do not have a clue what it's saying. In fact it probably just looks like a bunch of 1's and 0's with no logical pattern, which you may mispronounce and use the Decimal system of counting.

First of all I'll show you how to represent numbers:

Binary Representation Wrote:0 = 0 * 2⁰
1 = 1 * 2⁰
10 = 1 * 2¹ + 0 * 2⁰
11 = 1 * 2¹ + 1 * 2⁰
100 = 1 * 2² + 0 * 2¹ + 0 * 2⁰

As you can see it is much the same as representing in Decimals however instead of using the base 10 you will use the base 2.

Now that you've shown how you can represent the numbers, that means you can count or convert the Binary into Decimal. So here are some examples where we convert 101, 11 and 101010010 from Binary to Decimal:

Binary To Decimal Wrote:11 = 1 * 2¹ (1 * 2) + 1 * 2⁰ (1 * 1) = 3
101 = 1 * 2² (1 * 4) + 0 * 2¹ (0 * 2) + 1 * 2⁰ (1 * 1) = 5
101010010 = 1 * 2⁸ (1 * 256) + 0 * 2⁷ (0 * 128) + 1 * 2⁶ (1 * 64) + 0 * 2⁵ (0 * 32) + 1 * 2⁴ (1 * 16) + 0 * 2³ (0 * 8) + 0 * 2² (0 * 4) + 1 * 2¹ (1 * 2) + 0 * 2⁰ (0 * 1) = 338

As you can also see, the way that you find powers is the same as that done in Decimals. So if you need your memory refreshed on how to find the powers - go back to the Decimal section to do so, looking at the table method and "n-1" rule.

Keep refreshing your mind on Binary and Decimal as you move on through this tutorial, they're going to become important as we progress, especially Binary.

Questions
1) Split apart the following Binary numbers; 1011, 1011010, 101
2) Convert the following from Binary to Decimal; 1011, 1011010, 101
3) Convert the follow from Decimal to Binary; 6, 132, 24

Hexadecimal
Hexadecimal is the most important numeric system to you in terms of Little Fighter 2. This is because you will need it for when you are Hex or .exe editing the Little Fighter 2 program. So pay close attention to this section when you are reading through this tutorial.

Hexadecimal makes use of a base 16 system. However all latin languages only make use of 10 digits (0 to 9). To get around this problem, Hexadecimal makes use of the first 6 letters of the alphabet to represent their numbers (A-F). To make this slightly easier on you right now I'm going to convert Hexadecimal to Decimal for the first 16 numbers:

Hexadecimal to Decimal Wrote:0 = 0
1 = 1
2 = 2
3 = 3
4 = 4
5 = 5
6 = 6
7 = 7
8 = 8
9 = 9
A = 10
B = 11
C = 12
D = 13
E = 14
F = 15

Now we know the conversions of the base digits from Hexadecimal into Decimal, we're going to start representing some numbers in their split up form. So here are some examples:

Examples Wrote:9 = 9 * 16⁰
C = 12 * 16⁰ = 12
3F = 3 * 16¹ (3 * 16) + 15 * 16⁰ (15 * 1) = 63
1A1 = 1 * 16² (1 * 256) + 10 * 16¹ (10 * 16) + 1 * 16⁰ (1 * 1) = 417
FF = 15 * 16¹ (15 * 16) + 15 * 16⁰ (15 * 1) = 255

As you can see, base 16 is used instead of base 10. Once again the powers are worked out through the use of either the table method or the "n-1" rule. Go back to the Decimal section to refresh your mind on these methods.

Now to stop any confusion between Hexadecimal and Decimal numbers, when you write then down in pseudo-form (aka not in a Hex editor) you are going to put 0x infront of the number, like so:

0x2F3A, 0x345492, 0xF12

As some of you may notice, this is how you would represent them in C# or C++ (the language that the Little Fighter program was created in).

Questions
1) Split apart the following Hexadecimal numbers: 1F, 63C, A7C8
2) Convert the following from Hexadecimal to Decimal: 1F, 63C, A7C8
3) Convert the follow from Decimal to Hexadecimal: 19, 342, 92, 2435

Conversions
This is just going to be a quick section showing the conversions of several numbers from Binary to Decimal to Hexadecimal, in that order. I will then ask you to do a few more questions to convert some more yourselves.

Conversions Table Wrote:0 = 0 = 0
1 = 1 = 1
10 = 2 = 2
11 = 3 = 3
100 = 4 = 4
101 = 5 = 5
110 = 6 = 6
111 = 7 = 7
1000 = 8 = 8
1001 = 9 = 9
1010 = 10 = A
1011 = 11 = B
1100 = 12 = C
1101 = 13 = D
1110 = 14 = E
1111 = 15 = F
10000 = 16 = 10
10001 = 17 = 11
10010 = 18 = 12
10011 = 19 = 13
10100 = 20 = 14
10101 = 21 = 15
10110 = 22 = 16
10111 = 23 = 17
11000 = 24 = 18
11001 = 25 = 19
11010 = 26 = 1A
11011 = 27 = 1B
11100 = 28 = 1C
11101 = 29 = 1D
11110 = 30 = 1E
11111 = 31 = 1F

Those are the first 32 numbers written in Binary, Decimal and Hexadecimal. This is just to give you a head start for when you progress later on, a bit of a taster should we say.

Questions
1) Convert the following from Hexadecimal to Decimal; 48, F1F, AC
2) Convert the following from Decimal to Hexadecimal; 103, 8263, 72
3)Convert the following from Binary to Decimal; 1100010, 11101011, 1000001101101
4) Convert the following from Decimal to Binary; 82, 356, 93
5) Convert the following from Binary to Hexadecimal; 1100010, 11101011, 1000001101101
6) Convert the following from Hexadecimal into Binary; 48, F1F, AC

Bits
Computers use Binary to represent their information, utilising only 1's and 0's. These numbers are otherwise known as Digits, as you would find in the Decimal and Hexadecimal system. These Binary Digits are abbreviated to Bit (Binary Digit). As said before they are the most fundamental representation of a machine or computers counting system.

Bits can only store extremely tiny amounts of information. This means that for your computer to hold any decent or relevant information, the Bits would need to be combined. So I bring you to the Four-Bit Combination Model, which is more effective for the computer to use.

You treat this as you would Binary when working out the combinations, as each of the four sections on the Four-Bit Combination Model can only store either a 1 or a 0. We will count each bit the same way that we counted each digit in Decimal, the "n-1" rule helps out here, once again starting from right and going left.

The first or 0 bit on the right hand side of the Four-Bit Combination Model is known as the Low Order (LO) Bit. It is also the least significant Bit. The last or 3 bit, located on the left hand side of the Four-Bit Combination Model is known as the High Order (HO) Bit. It is known as the most significant Bit. However, you will not need to go into this for now, it's just for the purpose of knowledge.

The Four-Bit Combination Model allows for a variety of different combinations, because of the various placements of 0 or 1 that you can have on each bit. In fact, these are the exact combinations that you could have:

Bit Combinations Wrote:0000
0001
0010
0011
0100
0101
0110
0111
1000
1001
1010
1011
1100
1101
1110
1111

That just so happens to be 16 combinations. Now, why is this relevant to you? These 16 combinations just so happen to be equal to the number of Digits you use in Hexadecimal. Each combination is equal to one specific Digit in Hexadecimal.

This is why a computer is able to read Hexadecimal. It is far less confusing for the person controlling the computer to write in Hexadecimal as the numbers are not extremely long and the computer can easily convert any Hexadecimal Digit or number into Binary in no time at all.

Questions
1) What is a bit?
2) Why is the Four-Bit Combination Model useful to you?

Bytes
Bytes are actually groups of 8 consecutive bits. The Bits in a Byte are counted in the same way you would the Four-Bit Combination Model and also make use of the HO (High Order) and LO (Low Order) Bits, once again something you don't need to know much about.

Just as you would in the Four-Bit Combination Model, you can use varying different combinations of 1's and 0's to count in a Byte. The lowest value of which is 00000000 and the highest value would be 11111111.

I am not going to show you all the different combinations of Bits within a Byte, purely because that would take a long time and I would lose my patience. Instead I am going to tell you how many different combinations you can get and how you can work it out.

Byte Combinations Wrote:Using the Base 2 rule:
2⁷ + 2⁶ + 2⁵ + 2⁴ + 2³ + 2² + 2¹ + 2⁰ =
128 + 64 + 32 + 16 + 8 + 4 + 2 + 1
= 255

Now, the last Bit can also have a 0 and not just a 1, so we will add 1 more combination to it.

255 + 1 = 256

Now once again I'm going to ask you, why on earth is this important to you? The amount of information stored by a Byte is capable of storing a single character (A, B, C, D..., 1, 2, 3... ?, >, <.... etc) that you may use on your keyboard.
The characters are organised by something all coders or Hexers may have heard of or seen before; ASCII. This stands for the American Standard Code for Information Exchange (Don't ask by the way, I don't know why there is an I instead of an E... it is just there).
ASCII uses only 128 Decimal numbers (7 Bit) to represent symbols or characters counted from 0-127. Which brings you to another question... why on earth would you need to use a Byte or 8 bit combination? Answer; It's the minimum storage area offered by the computer (Intel). So what happens to the last bit? It's used for accents, mathematical symbols, small graphics.. etc.

Okay so why is this important to you? Sure a Byte can hold the ASCII that you need, but how does that really help with Hex Editing? Well, if by now you hadn't noticed or tested for 2 digits in Hexadecimal, the maximum number produced is 255 in Decimal (0xFF).

Now if you look at a true Hex Editor like Hex Workshop or OllyDbg you will notice that you get lots of 2 digit combinations of Hex in the Hex area. Thats because a Hex Editor is used to view every single byte that a program has. So of course, the Byte is very important for you to know about, purely for the sake of knowing about it and understanding what you're doing a little better.

Questions
1) What is the maximum number in Decimal that can be stored in a Byte?
2) How many Bits is a Byte made out of?
3) How many combinations of Bits in a Byte can you get?
4) What does ASCII stand for?
5) Why is a Byte useful to you?

Okay, I'm glad to see you stuck with this tutorial till the end, I hope it helps. Remember there will be a lot more tutorials to come from me, this is simply the basics for you to get your head around. Some of you this may have helped, some of you it may not have, some it may have just done an overall recap of something you already knew.

Now, as for the answers to the questions I will post them up soon. For now if you definately need them, try to google them as I'm sure most of them will be on there.

If anyone would like to know any more on a certain topic or section of this tutorial, feel free to leave a message on exactly what it is you'd like to learn more about. I'll then try my best to make a more in depth guide for it.

Next Tutorial will be:
Learning your way around Hex Editors -
I will be using a variety of different Hex Editors and programs, and displaying with pictures what you need to know to find your way around them and to find code.

Future Tutorials:
I will be writing small programs which I will then put for download. These programs can then be looked at in the Hex Editors by you. I will then explain how you can convert some of the Hex you see into pseudo code.
I will also explain certain commands and stuff you find in Hex Editors.
Later I will bring in specific Little Fighter related stuff - possibly going into detail about PLATFORMS, new ITR's and generally recovering the work that Silva did, explaining it a bit more idiot friendly though..

That's all for now guys, feel free to leave thanks please - would be much appreciated since I've spent since 5 this morning trying to write this guide perfectly and shorten it for you in places where I deemed necessary. I also tried to check the language I used and if anyone wants, point out the grammatical errors or flaws in my English and I will rewrite it.

Oh yeah, please keep reminding me when you can to stay true to this Hex Teaching Quest. If I don't post up new stuff in days/weeks please Mods and Admins, remind me that I need to!

Eddie