[1.24] 1-time TieHack

[TyranO]

As we all know the infinite tiehack for AT has been fixed a while ago but you can still tiehack a 1v1 or AT game once, so it is still worth using for that one time you don't feel like losing and pissing off your opponent(s) (for example, if you are playing against a guy insulting you whole game for no reason).

Now, in 1.24, you can use a program to tiehack with the regular offset that requires a maphack enabled (or have an enemy unit in fov range) to click a enemy's unit and use one of his skills.

Here's a program I wrote quick to tiehack with the regular game.dll offset, remember, it will only work once and may be detected soon because it's static and it's in Game.dll:

http://www.d3scene.com/forum/attachm...-tyranotie.zip
(F4 for ON, F5 for OFF)

This is the patch used in this program:

6F286826   90               NOP
6F286827   90               NOP

Now here is another way to do it, without patching game.dll (except for a second)

1. Download OllyDBG.
2. Get inside a multiplayer game 1v1 or AT.
3. Start OllyDBG, attach process warcraft 3
4. Go to 6F00F503 (go to twice to make sure youre on it). Careful 6F00F503 is a detected offset. If you breakpoint it with F2 it's like you are patching it.
5. F2 to put a breakpoint on it.
6. Check the pane, you should see something like this:

DS:[07E9009C]=00000001
ECX=00000004

Right Click on DS:[0XXX009C]=00000001, modify data ---> change 1 to 0. Press F2 on 6F00F503 again and press play. Wait like 2-5 minutes. You will tie. Plan to do this before you are just about to lose.

Alternatively, you can breakpoint on 6F00F506 and change the value to 0 there, you should tie a bit faster. Changing the Address in both 6F00F503 and 6F00F506 should be the fastest (It's literally activating cheat "IseeDeadPeople" online, should take a minute).

This works only once too, but you are patching outside of game.dll on a dynamic offset. There is almost no way you can get detected using this method.

Thanks to:

- Stroh: For testing with me
- Darimus: What could I do without you?

[BlizzaP]

I don't get using it once. If I restart Warcraft 3 and then do this again I can use it in a different game? Anyway thanks a lot Tyrano.

[Stroh]

You can use it once per account.

[Killon-net]

once = once for one account.
new account = again 1 tie.
useless.

[BlizzaP]

Why does it only work once per account?

[Stroh]

once = once for one account.
new account = again 1 tie.
useless.

/care. Its usefull if you are pretty pissed off. (Oh, and you can use it as some kind of "winhack" when someone of the other team left. )

Why does it only work once per account?

Because Blizzard fixed it. Theres no way to get it working more than once again.

[LordTerror]

Now here is another way to do it, without patching game.dll

....

1. Download OllyDBG.
2. Get inside a multiplayer game 1v1 or AT.
3. Start OllyDBG, attach process warcraft 3
4. Go to 6F00F503 (go to twice to make sure youre on it).
5. F2 to put a breakpoint on it.

That's not correct. OllyDbg uses int3 patches for breakpoints, so you will still be patching the code either way.

[TyranO]

That's not correct. OllyDbg uses int3 patches for breakpoints, so you will still be patching the code either way.

Sure, but Warden does not scan an offset every 1 second. It's more like 30 seconds, which is enough time for breakpointing during 1 second (and the game is paused during the breakpoint too).

Also, there is a way to find the addresses without breakpointing which looks like this but does not work all the time:

Searches for string War3.cpp (part of it)

DWORD Address = 115;
DWORD Buffer = 0;
SIZE_T BytesRead = 0;
for (;;)

{
ReadProcessMemory(hProc, (LPCVOID)Address, &Buffer, 4, &BytesRead);

if(Buffer == 863134039)
{
Address -= 0;
break;
}
else
{
Address += 65536;
}
}

Thanks for the precision though.

[Darimus]

Sure, but Warden does not scan an offset every 1 second. It's more like 30 seconds, which is enough time for breakpointing during 1 second (and the game is paused during the breakpoint too).

Also, there is a way to find the addresses without breakpointing which looks like this but does not work all the time:

Searches for string War3.cpp (part of it)

DWORD Address = 115;
DWORD Buffer = 0;
SIZE_T BytesRead = 0;
for (;

{
ReadProcessMemory(hProc, (LPCVOID)Address, &Buffer, 4, &BytesRead);

if(Buffer == 863134039)
{
Address -= 0;
break;
}
else
{
Address += 65536;
}
}

Well, the steps listed to be used in Olly could be automated anyway; you could make your program attach to war3 as a debugger and modify that offset to 0xCC, and handle it from there. You could even detach afterwards without closing war3, unlike Olly without certain plugins.

[yellowsnow]

That's not correct. OllyDbg uses int3 patches for breakpoints, so you will still be patching the code either way.

You could also use hardware breakpoints, which are undetectable if you hook certain api calls.