ollydbg and item hack error help

[Phatkone]

Hi All

Mainly looking at @SheenBR and bobsobol or @gzuz for help since I notice you guys seem to be the most active in this.

The server I am working on atm will ban the account if they purchase mana pots from the misc store (i added them to the store)

It gives this in the log file

Shop Item Hack has been detected - ItemCode( PM103 ) RecvItemPrice/OriginItemPrice( 500/500 ) ItemCount( 1 )

whilst trying to work it out using gregoos tututs on ollydbg (im pretty damn new to it)

using break point I found it giving me:

7781EF59   8A0A             MOV CL,BYTE PTR DS:[EDX]

now EDX is 0068C92F which is the ASCII of "Shop Item Hack has been Detected etc etc

The execution stack shows 00173D2C | 001744E0
If I follow that in hex dump it takes me to that ascii of the shop item hack etc etc

if I ctrl+g to 00173d2c in the cpu threads it takes me to a line:

00173D2C   E0 44            LOOPDNE SHORT 00173D72

if i follow that i get

00173D72   0000             ADD BYTE PTR DS:[EAX],AL

and if i follow that in dump it takes me to that ascii again.

I presume i am doing it wrong, what should i be doing to find out WHERE it gets the ban/error code on the PM101/2/3/4 to stop it from happening?

Any help is greatly appreciated.



also if i ctrl G and go for 0068c92f
(what shows in EDX )
it gives me
0068C92F 53 PUSH EBX

and if i go to 026e6733 (EBX)
It gives me
026E6733 0000 ADD BYTE PTR DS:[EAX],AL

 

[zaharavn]

What is your file server use?

 

[hades12]

Just search for potion item code in olly and compare them with magicpt files.