Question

Tibia is an online multiplayer game which works via a C++ client (image). There are some cheating tools that allow, for example, changing the look of your char, using recovery items when your HP hits a certain point and even depicting the map without aesthetics (image).

How can those software access the internal memory used by Tibia and how do they figure out where specific information is stored?

Answer 1

As you might know, all instructions/data of an application are saved at specific offsets in memory, usually set by the compiler. Using debuggers/disassemblers (eg. ollydbg) or memory “searchers” (eg. CheatEngine), you can view these.
One easy process would be searching memory for a given value (ingame health for example) and then change it through game dynamics and repeat the search till you have the memory address of the value in question, which usually is static i.e: doesn’t change till the executable gets updated. (In reality techniques like ASLR are used to randomize but can be circumvented)

Now using that acquired address, you can produce a handler which deals with it either through using the Windows API to perform mouseclicks/keystrokes or through calling the ingame functions, which addresses and arguments can also be found by debugging. (Example: if health < 50%, call this function)

Another way is to use a proxy through which all traffic is routed, and where you can inject outgoing packets to perform actions, or parse incoming ones to deduce conditions.

Obviously, I can’t provide sample code but you could start by reading about reverse engineering basics and packetsniffing, and practice by solving crackmes and following tutorials for cheating on single player games like the ones on the CheatEngine forums.

You could also check this chatlog about botting and countermeasures as explained to a non-programmer:
http://pastebin.com/6WWif7gK
(Start at :20)