Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Help with replacing xmm1 with a floating point
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4196

PostPosted: Sun Jul 14, 2013 3:21 pm    Post subject: Reply with quote

Really, if you have the value that you want to change, just inject code at an instruction that accesses a keyboard key or controller button, and tell it to increment/decrement your value if the keys/buttons are being pressed.

If you insist on injecting at the instruction that handles your speed value, then you will need to filter out all of the unnecessary addresses.

EDIT:
Even further, all you really need are the address and pointers of three values: the speed, controller button #1 and controller button #2. You can inject your code at any instruction that is being accesses a couple of times per second - it can be any instruction in the game.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Sun Jul 14, 2013 4:44 pm    Post subject: Reply with quote

shadowpt wrote:
mgr.inz.Player wrote:
Game name ?


Sent you a PM.

You can not change physic attributes (speed, acceleration, position) in multiplayer games. This data is kept at server.

You can change those if you own server/host machine.

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Sun Jul 14, 2013 4:47 pm    Post subject: Reply with quote

mgr.inz.Player wrote:
shadowpt wrote:
mgr.inz.Player wrote:
Game name ?


Sent you a PM.

You can not change physic attributes (speed, acceleration, position) in multiplayer games. This data is kept at server.

You can change those if you own server/host machine.


But I can.. I actually did it, I even said it in the previous replies. I can effectively change the movement speed just by changing the value of the respective address. I sent my vehicle flying against a wall at 600mph when I used the multiplication suggestion of the forum admin.

And no, this isn't client side mistake, it is actually live movement manipulation because those are client-side in that game.


Isn't it possible to assemble a code which pops the value (xmm0 or xmm1, etc) out, multiplies by two and pops back in?
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 474

Joined: 09 May 2003
Posts: 25962
Location: The netherlands

PostPosted: Sun Jul 14, 2013 5:24 pm    Post subject: Reply with quote

If multiply by 3 goes too fast, then try something smaller, like 1.3 or 1.003
_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Sun Jul 14, 2013 5:36 pm    Post subject: Reply with quote

Dark Byte wrote:
If multiply by 3 goes too fast, then try something smaller, like 1.3 or 1.003


I did but since it is a multiplication it will always end up scaling to huge numbers, just slower at start with a smaller number.

And I have checked, those opcodes are responsible for all the speed values of all the addresses that I am using so it will be way better if I just modify the xmm value and then the game takes that value to all the addresses directly. It would be way better this way, no more need to update a ton of addresses each time the game updates.

Can I do that? Like mov [eax+40],xmm0*2?

Or even using an assembly code that takes that value out, modifies and then puts it back in?
Back to top
View user's profile Send private message
daspamer
Grandmaster Cheater Supreme
Reputation: 54

Joined: 13 Sep 2011
Posts: 1588

PostPosted: Sun Jul 14, 2013 6:32 pm    Post subject: Reply with quote

You can write
Code:
addss xmm0,xmm0

to achieve xmm0 * 2.

_________________
I'm rusty and getting older, help me re-learn lua.
Back to top
View user's profile Send private message Visit poster's website
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4196

PostPosted: Sun Jul 14, 2013 6:54 pm    Post subject: Reply with quote

Yes, you don't need to multiply anything. You should listen to advice and let people help you instead of focusing all of your energy on something that obviously isn't working.
Back to top
View user's profile Send private message
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Sun Jul 14, 2013 7:08 pm    Post subject: Reply with quote

DaSpamer wrote:
You can write
Code:
addss xmm0,xmm0

to achieve xmm0 * 2.


That looks so simple! But won't it cause problems when the EAX is not present? I can't try it now but once I do I will report back.

Also if I want to increase the speed can I use mul xmm0, 3? (I think mul is the multiplication opcode, hope I am not wrong)

@GNIREENIGNE

I don't understand what you mean by controllers or how to use them to achieve my result, my knowledge with CE is not that big, that is why I am trying to find help to make a simple speedhack.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4196

PostPosted: Sun Jul 14, 2013 7:29 pm    Post subject: Reply with quote

Anything that you do not understand, just ask. When you ask a specific question, you will get a specific answer...as you can see. However, sometimes it is better for us to ask questions to better determine what it is that you are trying to do because the approach that you think is correct may not be correct or ideal.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Mon Jul 15, 2013 2:11 am    Post subject: Reply with quote

OK, I saw that example from twitch.tv


You must find out how to filter out other addresses.

First, try this:
1. find address with your current vehicle speed.
2. do "find out what access ...".
3. just below "instruction" column, in that empty space, right click and choose "check if found opcodes ...."
4. go to game drive for a while
5. window "the following opcodes ...." should fill with data
6. make screenshots of whole window. Resize that window. And be sure that count column is wide enough. So we can see all entries. (you can shrink bottom list)









BTW.

addss xmm0,xmm0

is the same as:
sub esp,04
mov [esp],(float)2.0
mulss xmm0,[esp]
add esp,04
movss [eax+30],xmm0


Yes, the first one is easier, but what if you want to multiply it by 1.5 ??



EDIT:
try this code:


Code:
[ENABLE]
aobscan(aob,8B4640F30F104030F30F588694000000F30F114030F30F108698000000F30F584034F30F114034F30F10869C000000F30F584038F30F114038F30F1086A0000000F30F584040F30F114040F30F1086A4000000F30F584044F30F114044F30F1086A8000000F30F584048F30F1140486A30)
registersymbol(aob)

alloc(hack,1024)
label(retHere)
label(multiplyBy)

hack:

sub esp,10                  // prepare space
movdqu [esp],xmm1           // store xmm1

movss xmm1,[multiplyBy]     // get multiply factor
shufps xmm1,xmm1,00

movups xmm0,[esi+00000094]  // get current delta
mulps xmm0,xmm1             // multiply delta by user factor

movdqu xmm1,[esp]           // restore xmm1
add esp,10

movq [esi+00000094],xmm0    // store new delta
movhlps xmm0,xmm0
movss [esi+0000009C],xmm0


movss xmm0,[eax+30] //original code
jmp retHere

hack+100:
multiplyBy:

dd (float)1.5 // CHANGE THIS


aob+3:
jmp hack
retHere:

[DISABLE]
aob+3:
db F3 0F 10 40 30

unregistersymbol(aob)

dealloc(hack)

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Mon Jul 15, 2013 5:44 am    Post subject: Reply with quote

Alright I tried the adss xmm0,xmm0 and it "freezed" that axis movement, basically it is taking the final value and replacing itself with it, this means that no other value is added to it or decreased.

I also tried the assembly suggestions with and without limiter

Code:
[ENABLE]
//Speedhack
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

sub esp,04
mov [esp],(float)2.0
mulss xmm0,[esp]
add esp,04
movss [eax+30],xmm0

originalcode:
movss [eax+30],xmm0

exit:
jmp returnhere

"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:




[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F11 40 30


For the following OPcodes:

Code:
movss [eax+30],xmm0

addss xmm0,[esi+00000094]

and

movss xmm0,[eax+30]


But no luck, everytime I altered the xmm0 it would just ramp up insanely fast and throw me against a wall.

I suspect these opcodes are final value only so no matter what I change it will always add up to itself, no matter what I do. I am still trying to find where the increase/decrease value is being added to that xmm0 but so far it is not going well, kinda lost between all these opcodes and most of them are not something that I understand (what they do, where they are pulling info from etc).


I also tried your last script example but when I run it it says "This address specifier (AOB+3) is not valid".



--------------------

I forgot to add, I also did the address filtering like you said but nothing came up, no other window or anything and I waited for quite a while.


Also here it is an extended view on the opcode functions related to those mentioned before

Code:
push ebp
mov ebp,esp
sub esp,10
push esi
push edi
mov esi,ecx
call Phys_x86.dll+1D9B10
mov cl,[eax+00000548]
movzx edi,word ptr [esi+58]
mov dl,[ebp+14]
shr cl,03
and cl,01
mov [ebp-01],cl
cmp di,[esi+5A]
jne Phys_x86.dll+1D7B17
mov cl,[esi+5C]
shr cl,1
and cl,01
xor cl,dl
je Phys_x86.dll+1D7B19
mov cl,01
cmp byte ptr [esi+000000AC],00
jne Phys_x86.dll+1D7B44
test byte ptr [esi+5C],01
jne Phys_x86.dll+1D7CB4
cmp byte ptr [ebp+10],00
jne Phys_x86.dll+1D7B44
test cl,cl
je Phys_x86.dll+1D7CB4
cmp byte ptr [ebp-01],00
je Phys_x86.dll+1D7CB4
test dl,dl
je Phys_x86.dll+1D7B6F
or word ptr [esi+5C],02
cmp edi,01
jna Phys_x86.dll+1D7B78
cmp byte ptr [ebp-01],00
je Phys_x86.dll+1D7B78
movss xmm0,[Phys_x86.dll+2A0A04]
mov ecx,edi
xorps xmm1,xmm1
cvtsi2ss xmm1,ecx
divss xmm0,xmm1
jmp Phys_x86.dll+1D7B80
mov edx,0000FFFD
and [esi+5C],dx
movss xmm0,[Phys_x86.dll+2A0A04]
test byte ptr [esi+5C],01
movss xmm1,[esi+0000008C]
movss xmm4,[esi+7C]
movss xmm5,[esi+00000080]
movss xmm6,[esi+00000084]
movss xmm7,[esi+00000088]
movss [ebp-0C],xmm1
movss xmm1,[esi+00000090]
mulss xmm4,xmm0
mulss xmm5,xmm0
mulss xmm6,xmm0
movss [ebp-08],xmm1
jne Phys_x86.dll+1D7BEF
movss xmm2,[eax+18]
movss xmm3,[eax+1C]
movaps xmm1,xmm0
mulss xmm1,[eax+14]
mulss xmm2,xmm0
mulss xmm3,xmm0
addss xmm4,xmm1
addss xmm5,xmm2
addss xmm6,xmm3
xorps xmm0,xmm0
movss xmm1,[ebp-0C]
movss [esi+000000D0],xmm4
movss [esi+000000D4],xmm5
movss [esi+000000D8],xmm6
movss [esi+000000DC],xmm0
movss [esi+000000E4],xmm1
movss xmm1,[ebp-08]
movss [esi+000000E0],xmm7
movss [esi+000000E8],xmm1
movss [esi+000000EC],xmm0
test byte ptr [esi+000000AC],04
je Phys_x86.dll+1D7CB4
mov eax,[esi+40]
movss xmm0,[eax+30]
addss xmm0,[esi+00000094]
movss [eax+30],xmm0
movss xmm0,[esi+00000098]
addss xmm0,[eax+34]
movss [eax+34],xmm0
movss xmm0,[esi+0000009C]
addss xmm0,[eax+38]
movss [eax+38],xmm0
movss xmm0,[esi+000000A0]
addss xmm0,[eax+40]
movss [eax+40],xmm0
movss xmm0,[esi+000000A4]
addss xmm0,[eax+44]
movss [eax+44],xmm0
movss xmm0,[esi+000000A8]
addss xmm0,[eax+48]
movss [eax+48],xmm0
push 30
lea eax,[esi+7C]
push 00
push eax
call Phys_x86.dll+1EE980
mov dl,[esi+000000AC]
mov ax,[esi+58]
add esp,0C
shr dl,1
and dl,01
pop edi
mov [esi+000000AC],dl
mov [esi+5A],ax
pop esi
mov esp,ebp
pop ebp
ret 0010


PS: Added the entire function instead, thought it would be way bigger like the others I had analyzed but it was small compared to them.


Last edited by shadowpt on Mon Jul 15, 2013 5:58 am; edited 1 time in total
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Mon Jul 15, 2013 5:48 am    Post subject: Reply with quote

shadowpt wrote:
I also tried your last script example but when I run it it says "This address specifier (AOB+3) is not valid".


CheatEngine 6.3 Rolling Eyes

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Mon Jul 15, 2013 5:59 am    Post subject: Reply with quote

mgr.inz.Player wrote:
shadowpt wrote:
I also tried your last script example but when I run it it says "This address specifier (AOB+3) is not valid".


CheatEngine 6.3 Rolling Eyes


That is the version that I am using. Also I went ahead and just added the entire function related to those opcodes if you want to check it.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Mon Jul 15, 2013 6:04 am    Post subject: Reply with quote

Probably, you get it wrong.

Try this table:
1. open table
2. attach CE to game process
3. enable script



alterspeeddelta.CT
 Description:

Download
 Filename:  alterspeeddelta.CT
 Filesize:  1.37 KB
 Downloaded:  1455 Time(s)


_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Mon Jul 15, 2013 6:09 am    Post subject: Reply with quote

mgr.inz.Player wrote:
Probably, you get it wrong.

Try this table:
1. open table
2. attach CE to game process
3. enable script


Did exactly as you said and when I click to enable the script CE just stalls and then crashes.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8  Next
Page 2 of 8

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites