Theurer, D.; Kennedy, M.; Venkataraman, H. and Muntean, G.M. “Analysis of individual energy consuming components in a wireless handheld device”, in Proceedings of China Ireland International Conference on Information Technology (CIICT 2010), Wuhan, China, Oct. 8-9, 2010.

This paper is the result of my research of my summer internship. I would like to thank my supervisors for their great support! Unforunately funding did not allow me to attend the conference in China myself. I prepared the presentation slides and Mr. Zhenhui Yuan, a PhD student in DCU, who attended the conference was so kind to present my paper. Thanks a lot!

Energy measurements on a Nexus One using an Arduino

My project involved measuring the energy consumption of a Nexus One phone and breaking it down into individual components. The analysis will then help to implement an algorithm for video streaming that will assure that a video stream can be played before battery depletion and to maximize the ratio of quality to energy consumption.

I suppose many students will face the decision of whether to go into industry or pursue research. Industry appears to promise better and more stable incomes but research seems to be more interesting in that your research projects can be diverse and in an area of your interest. You enjoy a greater freedom over both your work schedule as well as the content of your work. This of course comes with responsibilities to make progress and deliver results.

Me during poster presentations

The greatest challenge I faced in my internship was the fact that rather than looking for an answer to a predefined question, the question itself was not always clear. This left me at times confused over what is the next step as the path of project was not laid out for me but I had to discover it for myself. Another challenge is presenting and defending your project in front of an audience. I left the internship in good spirits, being awarded a certificate for giving one of the five best final presentations and a prize for the best overall project.

Best Overall Project

Overall, I gained a good impression of research that, I am sure, will assist me in my decision for the route I take after my graduation. I can definitely recommend such an internship to anyone who is seriously considering going into research. For the next summer I am aiming for an industry internship so that I can be sure to make the right choice.

I would like to thank Gabriel Muntean for organizing this internship and Martin Kennedy, my supervisor, for his great guidance.

I was aiming for this award when I was asked to create the website by the Japanese Society. Given all the effort it took I am happy that the website is appreciated like this.

Shibuya, Tokyo

Shibuya at night

Shinjuku, Tokyo

After my work camp I spent another five weeks travelling around Japan. Eriko, a friend from college, was so kind to let me stay with her and her parents for a week in Hiratsuka which is not far from Tokyo. During that week I often visited Tokyo, sometimes alone, sometimes with friends I made in the work camp. Eriko guided me around Kamakura and Enoshima. Before I would leave for a journey by myself, we visited Hakone where we watched fireworks during the Bon festival.

Enoshima near Kamakura

If you look close, you can see Mt Fuji far in the distance

Fireworks! (Hakone)

For the following two weeks I used a Japan Rail Pass to travel the west of Japan. I did not know where my trip would take me as I hadn’t planned it but I would decide my next destinations about two days in advance. Like this I was flexible and could follow recommendations I got from other tourists and locals. My first stop was Nagoya. After an evening of exploring Nagoya by myself I met two nice Koreans in the hostel and we spent the following day sightseeing.

My next stop was Kyoto. From the first moment Kyoto impressed me a lot. Compared to other cities it seems to be the most popular tourist destination and there are times when I saw more foreigners than Japanese in the streets. Beside all the temples and shrines (which I tried to rush through in one day), I will remember Kyoto for its beautiful and atmospheric alleys. I can absolutely understand why it is so highly recommended to every Tourist! Taking a stroll at night through the dark alleys made me feel like being in a different world. The occasional Maiko crossing your way is the icing on the cake!

Nagoya castle

Kyoto

Maiko in Kyoto

Osaka, the next stop on my trip, doesn’t quite captivate with beauty like Kyoto, but nevertheless left a very good impression. I really enjoyed how lively the city is, especially during the night. Before my vacation I decided that I definitely want to spend a night in a capsule hotel and so I did. And it was pretty great! The only downside is that unlike a hostel it is very difficult to meet people. Everything is fairly anonymous and it’s full of old business men. Luckily I was approached my a very friendly old Japanese man when I visited the Osaka castle (who unfortunately couldn’t speak any English) and he guided me around the city.

Osaka at night

Capsule hotel in Osaka

Temple in Osaka

After visiting Nara I decided that I had seen enough shrines and temples and instead followed a recommendation that I got from a guy I met in a bar in Osaka and made a day trip to Shirahama. That was exactly what I needed for a change: 35°C, sun, the sea and white sand imported from Australia. And so I took it easy before I continued my journey further west to Hiroshima.

Okonomiyaki in Osaka

Somewhere in Nara

Beach in Shirahama

In Hiroshima I met Kaori, a friend from college, and she guided me around the city. Her mother also took us to Miyajima (Itsukushima) to see the famous shrine as well as to the Kintai bridge in Iwakuni where we saw the white snakes in Kikko park.

Hiroshima

Itsukushima Shrine

Kintai Bridge

My final stop before making my way back to Tokyo was Beppu. I never heard of it before but a tourist in a hostel recommended it to me and as my rail pass was about to expire soon I had to choose between visiting Nagasaki and Beppu and went with the more exotic choice. I spent two nights there and visited some hot springs including a mud bath and the “sea hell”.

Kikko Park in Iwakuni

Sea hell in Beppu

Hot spring with nice view

After spending another night in Kyoto and visiting Osaka again where I had a good time with a German friend of mine I went back to Tokyo and finally met Hideo, a college friend and house mate, with whom I would spend my remaining two weeks. Together with another college friend and house mate Declan we would set off for many great adventures.

Declan, Hideo and me on the top of Mt Fuji

Sunrise!

A meal in a Ryokan

Showa-mura, Fukushima

Far, far away in the hills of the Fukushima prefecture in Japan lies the village called Showa-mura that created many lasting memories for me. After spending one day in Tokyo the contrast could not have been bigger when I arrived in the village far off any cities and surrounded by rice fields and forest. Ten days I would spend there together with a small group of foreigners like me and Japanese who all decided to do voluntary work.

The group of volunteers

Showa-mura suffers the fate of many villages in Japan: the youth moves to the cities leaving the elderly behind and without anybody to take over their farms. Without knowing any specifics about the Japanese pension system, many of the elderly seem to continue working past the retirement age and struggle to take care of their farm work. In order to help the locals and to give young people from the cities an insight into the life in the countryside, yearly work camps are organized. The labour of voluntary workers participating in the work camps is offered to the locals for a cheap price or even for free if the people in need are past a certain age. While for some of them the work is a great help, others are simply happy to have some young people around to talk to. The group of volunteers in my case consisted of 5 foreigners (including me) and 4 Japanese. Especially for us foreigners the trip to the Japanese countryside allowed us to experience Japan in a way that not every tourist has the opportunity to.

Practice using the grass cutters

In exchange for their efforts the participants in the work camp are provided with free board and lodging. We stayed in a school building that due to the lack of children in the village was no longer in use. Apart from the work some social events were held including a visit to a hot spring, a museum, a wonderful lake surrounded by mountains as well as meetings with locals. Everybody was extremely friendly and happy to have us young people around and I truly enjoyed the Japanese hospitality.

A junsai field

The work was of agricultural nature. Specifically, this included cutting grass, transporting and cutting wood, weeding rice fields and planting junsai. A typical work day would start from around 6 am and last six hours until 12 pm when the heat would make it difficult to work in the fields. The work was pretty hard indeed but as the volunteers consisted mostly of girls I should not complain. However, after a job done the appreciation by the locals and the good feeling of accomplishment you are left with are absolutely worth all the sweat.

Weeding in a rice field (photo by Elsa Caron)

I made some great memories during my time in the work camp and I would absolutely do it again. In fact, I really want to do another work camp if I get another opportunity. I deliberately went with a short camp of only ten days because I was afraid I wouldn’t like it and at least ten days are easy to pass. And indeed they passed quickly, way to quickly in fact, and so my next camp should certainly be longer, maybe a month. I can wholeheartedly recommend participating in a camp to anyone who is interested. Just do it!

Bedroom in the school building

A Japanese house and garden

Our attempt at making a human pyramid

What is this tutorial about?

In this tutorial I want to show you how to modify another application to call a function in your injected DLL. I use the game Ragnarok Online as an example. I want a function in my DLL to be called when I open a shop in the game. In my last tutorial you can see how I found the piece of code that is executed when a shop is opened.

The method

This is how it will work when we are finished:

1. At the address that you specify we jump to our code.
2. There we will call our “event” function.
3. Then we will execute the original code that we had to replace for the jump to our code…
4. …and finally jump back.

Here is a simple flash that illustrates the method I just described.

Now these are the steps I follow to code it.

1. Allocate memory for the gateway.
2. Write a call to your function into the allocated space.
3. Copy the piece of code where you want to create the link to your gateway into the allocated memory.
4. Write a jump back to the address after the link.
5. Create the link to the gateway.

This was the short version, there is a lot you have to take care of as it is very critical to modify memory. One wrong command or wrong address will crash the application.

The code

I will give you my code for the gateway right away and explain it then.

The code is pretty easy but it is very important that you really get how the whole thing works.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

void SetJumpgate (BYTE *targetAdd, BYTE *funcAdd, const int len)
{
	BYTE *myAdd = (BYTE*)malloc(len+10);
 
	DWORD origProt;
	VirtualProtect(targetAdd, len, PAGE_READWRITE, &origProt);
 
	myAdd[0] = 0xE8;
	*(DWORD*)(myAdd + 1) = (DWORD)(funcAdd - myAdd) - 5;
	myAdd += 5;
 
	memcpy(myAdd, targetAdd, len);
	myAdd += len;
 
	myAdd[0] = 0xE9;
	*(DWORD*)(myAdd + 1) = (DWORD)(targetAdd + len - myAdd) - 5;
 
	targetAdd[0] = 0xE9;
	*(DWORD*)(targetAdd + 1) = (DWORD)(myAdd - 5 - len - targetAdd) - 5;
	targetAdd += 5;
 
	if (len > 5)
		for (int i = 0; i < len - 5; i++)
			targetAdd[i] = 0x90;
 
	VirtualProtect(targetAdd, len, origProt, &origProt);
}

Explanation

BYTE *myAdd = (BYTE*)malloc(len + 10);

Here we allocate memory for the gateway (see step 1).

Remember: we want to write a call to our function (length 5), the code we are going to replace (length len) and a jump back (length 5) into the memory. Thus the length has to be 10 for the calls + len.

DWORD origProt;
VirtualProtect(targetAdd, len, PAGE_READWRITE, &origProt);

Now we are preparing to read/write at our target address. We save the original protection in origProt to restore it later.

myAdd[0] = 0xE8;
*(DWORD*)(myAdd + 1) = (DWORD)(funcAdd - myAdd) - 5;
myAdd += 5;

This is the call to our function (see step 2). The first byte 0xE8 is the opcode for a CALL command. The four following bytes are the offset to our function. Finally we jump 5 bytes forward so we won’t overwrite what we have just written.

memcpy(myAdd, targetAdd, len);
myAdd += len;

Here we copy the original code that we are going to replace into our allocated memory after the call (see step 3).

myAdd[0] = 0xE9;
*(DWORD*)(myAdd + 1) = (DWORD)(targetAdd + len - myAdd) - 5;

And now the jump back to our target address (see step 4). This is similar to the CALL we have already written with the difference of the first byte being 0xE9 this time which is the opcode for a JMP.

targetAdd[0] = 0xE9;
*(DWORD*)(targetAdd + 1) = (DWORD)(myAdd - 5 - len - targetAdd) - 5;
targetAdd += 5;

This is the jump to our allocated memory/gateway (see step 5).

if (len > 5)
	for (int i = 0; i < len - 5; i++)
		targetAdd[i] = 0x90;
 
VirtualProtect(targetAdd, len, origProt, &origProt);

The jump to our gateway has the length of 5 bytes. If the original code at the target address is longer than 5 byte our jump won´t replace the whole code and some garbage is left over. So we have to fill it with 0x90 which is the opcode for NOP (no operation). If we don’t do this, the program might crash. Finally we restore the protection.

Usage

Please note that the code you want to replace must have at least the size of 5 bytes!

You can call the function like this:

SetJumpgate((BYTE*)0x004A42C2, (BYTE*)OnOpenShop, 6);

This is how my OnOpenShop looks like:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

void OnOpenShop (void)
{
	__asm
	{
		pushfd
		pushad
	}
 
	AddChat("Opening a shop eh?");
 
	__asm
	{
		popad
		popfd
	}
}

You need the asm there because you would change the stack of the game otherwise and that would lead to a crash.

And this is my result:

What is this tutorial about?

In this tutorial I want to show you how to call a function of another program or game and how to get the address of this function. The tutorial is written for people who have little to no assembly knowledge.

Requirements

For this tutorial you need to know how to inject a dll into a process. If you don’t know it, there are many tutorials about that (just google for them) or you can simply download an injector and read about how it works later. There are also plenty of websites and forums that deal with game hacking and things like that which can be very helpful.

You will also need a disassembler. I use ollydbg that you can download here for free.

Finding the address of the function

This is definitely the hardest part. For this tutorial I chose the game Ragnarok Online and the function I want to call is the one to write text into the chat. Either open up ollydbg and load the exe of the game there or start the game and attach ollydbg to it.

It should look like this:

Press F9 to start the game.

So I know that when I open a shop the following lines are always written into the chat:

In ollydbg right click and select Search for->All referenced text strings.

Search for the string that is written into the chat and double click it.

If you are not sure that the piece of code you found is called when you open the shop then you could right click on the address and set a breakpoint there.
This time it is so obvious that it isn’t needed.

Let’s have a look at the code:

004A455A  |. 68 5CE96400    PUSH rag.0064E95C
004A455F  |. 50             PUSH EAX
004A4560  |. E8 134C1600    CALL rag.00609178
004A4565  |. 83C4 08        ADD ESP,8
004A4568  |. 8D8D 50FEFFFF  LEA ECX,DWORD PTR SS:[EBP-1B0]
004A456E  |. 6A 00          PUSH 0
004A4570  |. 68 FFFF9600    PUSH 96FFFF
004A4575  |. 51             PUSH ECX
004A4576  |. 6A 01          PUSH 1
004A4578  |. B9 70806900    MOV ECX,rag.00698070
004A457D  |. E8 2E7D0100    CALL rag.004BC2B0
004A4582  |. EB 20          JMP SHORT rag.004A45A4

In case you aren’t familiar with this: the first row is the address, the second the opcode and the third the assembler commands.

For those who hardly know any assembly like me I will try to explain what the lines of code do. At 004A455A the string at memory address 0064E95C is added to the stack. The next line adds the value of EAX to the stack. This is done to pass them to the function that is called at 004A4560. In assembly the parameters are added to the stack in reversed order.

C++:	MyFunction(arg1, arg2);
ASM:	PUSH arg2
	PUSH arg1
	CALL MyFunction

So we basically have a function here that takes two parameters, the second one being the string that is written into the chat:

SomeFunction(parameter1, "text");

Let’s have a look at another piece of code:

004A452B  |. 50             PUSH EAX
004A452C  |. 68 98E96400    PUSH rag.0064E998 ; ASCII "Current Zeny : %s Z"
004A4531  |. 51             PUSH ECX
004A4532  |. E8 414C1600    CALL rag.00609178
004A4537  |. 83C4 20        ADD ESP,20
004A453A  |. 8D95 50FEFFFF  LEA EDX,DWORD PTR SS:[EBP-1B0]
004A4540  |. B9 70806900    MOV ECX,rag.00698070
004A4545  |. 6A 00          PUSH 0
004A4547  |. 68 FFFF7800    PUSH 78FFFF
004A454C  |. 52             PUSH EDX
004A454D  |. 6A 01          PUSH 1
004A454F  |. E8 5C7D0100    CALL rag.004BC2B0
004A4554  |. 8D85 50FEFFFF  LEA EAX,DWORD PTR SS:[EBP-1B0]

Again the function at 00609178 is called. By having a look at the PUSHes we see that 3 parameters are passed. So we know that the function can take a variable number of parameters. I set a breakpoint at 004A4532 and open a shop. In the Registers part of ollydbg I see that EAX has the value of ASCII 500.
So the code in C++ should look like this.

char* s1 = "Current Zeny : %s Z";
char* s2 = "500";
SomeFunction(parameter1, s1, s2);

Doesn’t this look familiar to you? Yes, it looks like the function sprintf().

Desc:     Write formatted data to a string
Buffer:   Storage location for output
Format:   Format-control string
Argument: Optional arguments
Return:   Number of bytes stored in buffer

Now we know that the function 00609178 is not the one we search for but formats the string that is written into the chat.

We skip the next 3 lines of code and see that starting at 004A4545 4 values are added to the stack and a function is called after that.

Function(1, EDX, 0x78FFFF, 0);

You can right click on CALL rag.004BC2B0, select Follow and set a breakpoint there. Unfortunately the debugger stops there every frame, so if it is the function to add text to the chat it has to serve some other purpose as well. Let’s check the parameters. What’s the value of EDX? A few lines before at 004A453A we see

004A453A |. 8D95 50FEFFFF LEA EDX,DWORD PTR SS:[EBP-1B0]

This command loads the address of EBP-1B0 into EDX. We need to know the value of EBP to get the address. Set a breakpoint on that command and open a shop. The debugger stops at that line.

At the registers part you see that EBP has a value of 0012FA28. We subtract 1B0 and get the value 12F878 which is the address of the string “Current Zeny : 500 Z”.

Now we know that EDX points to the string which is written into the chat window and we have all parameters of the function.

AddChat(1, "text", 0x78FFFF, 0);

Let’s call the function in our injected DLL. You could do this in C++ only; I did it with assembly because it was less work. This is how your function could look like:

void AddChat (char *text)
{
	void *pChat = (void*)0x004BC2B0;
	__asm
	{
		mov ecx, text
		push 0
		push 0x96FFFF
		push ecx
		push 1
		call [pChat]
	}
}

Let’s test it to see if it works. Ingame I call AddChat ("test"); and the game crashes… huh? Ok, this time I start the game with my dll injected but also attach ollydbg to it. Again I crash the game with my code but this time ollydbg stops at the line of code that is responsible for the crash:

004BC6E9 8B11 MOV EDX,DWORD PTR DS:[ECX]

The address is 004BC6E9 so it’s in the function we call starting at 004BC2B0. In Ollydbg we can see that ECX has a value of 00000020. Now the error message: Access violation when reading [00000020]. Of course, 00000020 doesn’t exist. ECX for some reason has a wrong value.

We could follow the code backwards and see where the value comes from but I preferred to compare my code with the one in Ragnarok. The only difference I see is that line:

004A4540 |. B9 70806900 MOV ECX,rag.00698070

The function we call must somehow work with the value of ECX and because we don’t set it to the correct value it crashes.

So we add the line to our code:

void *pChat = (void*)0x004BC2B0;
void *pSomething = (void*)0x00698070;
__asm
{
	mov ecx, text
	push 0
	push 0x96FFFF
	push ecx
	push 1
	mov ecx, [pSomething]
	call [pChat]
}

The value for ECX is not static so we need to get it from 00698070 as well. Let’s see if it works now:

As you can see it works! :-)

Thanks for reading my tutorial.

Credits go to many people from the game-deception forums where I learned much of this.

This was my first project to be released to the public. The program was a 3rd party program for the game Ragnarok Online.

I haven’t really made it to get advantages in the game but to learn about DLL injection and network programming. There were two different versions using two different methods.

Version one

Ragnarok Online had to be changed to connect to your local machine using the port RCT was listening on. As soon as the connection was established, RCT connected to the real Ragnarok server pretending to be the Ragnarok Online client. Then it forwarded packets from each side to the other.
It was important to modify specific packets containing ip addresses to keep Ragnarok Online to connect to RCT instead of the server.
Using this method it was possible to intercept, modify and view every packet which gives a lot of possibilities. But furthermore you could send your own packets to both the client and the server. Given this option you could do nearly everything.

Here is a list of features:

• Display monster’s HP below each monster
• Show gained exp after each kill and calculation how many you have to kill until level up
• Calculate routes through maps and display them with “Safety Walls”
• Show walking paths of the monster you have attacked last making vertical firewalls easier
• Communication between IRC and Ragnarok Online

Example: monster HP

I used a database containing all information about the monsters and made RCT notice every packet about a monster.
To display the HP I used the health bars of party members and because you can’t attach them to monsters I had to send fake packets to Ragnarok Online to make it think that at the very same position as the monster there is an invisible player. Fortunately you can make invisible characters (yes invisible GMs are noticed by your client, they just don’t show up!) and thus I could attach the HP bar to them. I then subtracted all damage the monster received because the server doesn’t send the actual HP but you have to calculate it on your own. This has some minor problems like miscalculation if the monster hadn’t had full HP when it came on your screen.

Version two

Version two used a more complex but more reliable system: DLL injection. Because I didn’t know anything about it, I used the DLLs that the Kore bot uses. Although I got the basic functions to work there were still serious problems: When I sent a packet to Ragnarok Online, the game lagged for a second making it impossible to play. My packets however were received successfully but I never found a way to fix this problem. But I thought of other features because I was at a point where you kill monsters way too fast or partied all the time making the monster HP completely useless.

Here are some examples of features I implemented in the different versions of RCT (which were all private):

• WoE warning system (^^): this is one weird feature you might think. As soon as someone who is not from your guild enters a castle the program makes a loud sound.
  Yes, there is a use for this. You can watch TV and do WoE at the same time! :)
• EXP monitor: EXP/h, time until level up, EXP gained in one session and a nice diagram