What if you could edit not only the values of a program, but also the routines that produce those values? Sounds complex, but this technique can yield the most fruit. Instead of resetting the timer continually, what if you disabled it altogether? That’s the type of goal code disassembly can reach.

You’ll need a specific type of tool. The free PEBrowse for Windows (available via http://www.smidgeonsoft.com/) comes highly recommended, as does OllyDbg (http://home.t-online.de/home/Ollydbg/). There are plenty of other disassemblers. The commercial SoftIce disassembler also has its fans.

Though the specifics differ from game to game, the technique is simple:

Obviously, this is a simple step in a complex land. There are few limits to what you can do, given time, intuition, and a grasp of assembly language.

Modifying network games is a little trickier because you control only the part of the game running on your machine. That’s still control enough, though. Packet editors allow you to intercept incoming packets from a server (whether it be FPS, RTS, MMORPG, or whatever) and alter what you send back. The GameHacking page on packet editors (http://www.gamehacking.com/sites/tools.php?sort=Packeteditors) has a few choice downloads, but there’s very little public information about packet hacking online.

Serious companies, such as Blizzard, encrypt their packets. This makes packet hacking more difficult, though not impossible. As well, packet hacking can’t give you an infinite amount of energy or kill all the other players unless the server allows those operations. You’ll have to find some way to exploit the rules. Your grand dreams of loot and equipment in a MMO are probably unrealistic.

Also, there’s a big difference between cheating in a single-player game and cheating in a multiplayer game ( [Hack #34] ). It’s one thing to change the rules of the game for yourself, but it’s rude to change them for other people without their permission.

Specific game hacks are usually best when done by die-hard fans who know a little bit about the included and removed features and items. While poking around in memory, it’s easier for well-informed hackers to pick up on subtle hints in variables and names.

A good example is The Lost Worlds site (http://www.thelostworlds.net/), which hosts an amazingly canonical catalog of all of the hidden, missing, and otherwise unknown parts of Crystal Dynamics’s popular Legacy Of Kain series. In particular, one page deals with hacking the PC version of Legacy Of Kain: Soul Reaver with WinHack (http://www.thelostworlds.net/SR1-Hack.HTML). Because the author knows the context, he’s excellent at finding the exact nooks and crannies needed to hit to modify the game.

As it turns out, the command-line parameters for the game—originally used for debugging—are still embedded in the executable. You can’t change them from a shortcut, as the developers probably could during programming, between they’ve removed that feature. You can change them in memory, however. If you load the game up to the first window, where you select the video resolution, you can then load WinHack, select KAIN2.ICD or KAIN2.EXE, and go to the hex-style memory editor. Click the Go To Address button, and enter $ 00C651E0. This turns out to be the memory location containing those command-line parameters, described on another page (http://www.thelostworlds.net/SR1-Memory.HTML) of The Lost Worlds site. Most of these are disabled, but you can use them to change the start location of Kain in the world, as well as a few other mainly broken options.

The game’s default parameters are currently set to:

 under 1 -mainmenu -voice -inspectral

but you can click on this text and add your own options. Your best option is to change under 1 to another location in the game. Don’t forget to type in the rest of the existing options and then fill in the remainder of that location with zeros in the hex column.

Use The Lost Worlds’s gigantic rooms list (http://www.thelostworlds.net/SR1_Area_List.HTML) to place your character anywhere you want in the game, even locations that you can’t normally reach from inside the game. The Lost Worlds walkthrough suggests using skinnr 18, which is a secret passage (http://www.thelostworlds.net/SR1-Secret.HTML) that’s inaccessible from the normal game. Very neat indeed.

It’s also possible to modify specific variables that are resident in memory after you load Soul Reaver, adding extra hidden powers and increasing your health by various means. Although you’d normally have to search to find the appropriate memory locations, the creator of The Lost Worlds site has done it for you. Download his WinHack-specific tag-list file (http://www.thelostworlds.net/Misc/SR1-Hack.zip) and import it from the Tag List/Load A New Tag List option.

This makes hacking the game as easy as clicking on each named option and changing values to increase your number of health bars and your total health. You can also award yourself all abilities in the game by putting 255 in the Abilities Acquired tag^[15] cut from the game, which allows you to change between the normal and spectral planes at any time. There’s also a Player Z-Position value that controls the vertical height of Raziel, the main character, so you can place him on roofs you couldn’t normally reach. Be careful not to throw him too far out of the map, though!