Overwriting an address in memory

[enhanceddevelopment]

Disclosure: this is for reverse engineering experience, I'm not planning to doing anything malicious with it such as malware, I just want to learn. I'm currently experimenting making cheats for an FPS game.

Short version: how do I overwrite a string at 0xDEADBEEF address in memory? I'm trying to replace two strings of varying length - both with the same string, which is also a different length. None of them are the same. Memcpy isn't an option here for various reasons that are task-specific, so I'm stumped :(

Can anyone please help me?

Long version:

Let's say I have a module injected into my process. The trick here is that the process has no way of knowing my module exists, and it cant under any circumstances - so its not like I can just nicely ask it to change the variable for me. I've worked out the address in memory of the variable:

processHandle + 0xStaticOffset

and the strings I'm trying to replace are 'reload' and 'select'.

My theory is that assuming I can replace these strings in memory, from looking at the pseudocode provided in ollydbg, I can make instant reload and weapon switching. I would need to replace them with the string 'fire'. Memcpy works, but the game disconnects me after about 30 seconds, so I never have a chance to get into a game & test it (note: I've studied this greatly and determine that the string CAN be modified, it's not that - they're detecting the call to memcpy somehow).

Can anyone please help me?

[helios]

They're not detecting the memcpy() call, the server is detecting that a client is doing something that should be impossible according to the game rules everyone is supposed to follow.

Imagine we're playing mail chess. We each have a board that maintains the state of the game. If you try to move "queen at 1A to 5E" and I look and there's a pawn at 1A, I don't need to look at your board to know that you're trying to cheat.

That's why cheating in online games is usually limited to cheats that are undetectable to outside observers. For example, seeing other players through walls can usually be done by just altering the way the game area is rendered on the screen, but flying requires changing the observable state of the game (other players must be able to see that you're up in the air).

[enhanceddevelopment]

This game is very old and while I appreciate your logic, it is 100% wrong.
I've reversed this game to some great extent in IDA disassembler and other tools of the like.

I've already managed to create some basic cheats by changing some simple floats - flying, walking through walls, speedhacking, instant c4 defuse. It's an old game with a bad anticheat, hence it being my target to learn.

I've already determined the reload, select thing will work - I'm 99% sure. I've seen no code specifically blocking that from happening.

The problem is that when reversing the anticheat to find the cause of my disconnection, they are monitoring common functions used for cheating such as memcpy(). Hence why I need to find an alternative method.

If it was just a float, I'd do this

*reinterpret_cast<float*>(address) = (float)value;

but that doesn't work for strings I don't think :/

[helios]

If the program really is hooking memcpy(), which I seriously doubt, you could simply write your own memcpy() implementation. The function is fairly trivial, if you don't care about having equivalent performance:

void my_memcpy(void *void_dst, const void *void_src, size_t size){
    char *dst = (char *)void_dst;
    const char *src = (const char *)void_src;
    for (; size; size--)
        *(dst++) = *(src++);
}

memcpy() can do some tricks to copy several (usually 4 or 8) bytes per loop, but this is enough for small buffers.

[jonnin]

you could actually use the regular memcpy in your hacked memcpy, and inject whatever around it, if you discovered that the game actually uses it for large blocks and needs the high performance. Since you said its an old game, it probably does not matter... a new pc can brute-force things that had to be down to the wire when it was released.

[enhanceddevelopment]

Thanks guys! I'll do some research into this.