Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


AoB AA script to locate address and change value, crashing

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Kwhali
How do I cheat?
Reputation: 0

Joined: 08 Feb 2015
Posts: 7

PostPosted: Mon Feb 09, 2015 12:46 am    Post subject: AoB AA script to locate address and change value, crashing Reply with quote

I'm fairly new to CE, been going through tutorials on forums/youtube past few days. My choice in game doesn't seem to be the best to start learning CE with as most values I try to search for don't seem to be represented the same way. Some do though like timers so I'm trying to work with those.

I learnt about AoB scanning recently and while finding a matching byte array wasn't as small as the examples online I came across, I have found a matching pattern that works all the time. I can set this value on the address manually and toggle activation to keep the value freezed which is great. I'd like to be able to have an AA script do it though, however it's always causing the game to crash..

I've noticed that even though I've got an address and set/frozen the value, once the game is unpaused the GUI display and the value listed in CE that I set are jittering, it's a float value, the address is correct as the items effect duration never ends, so this hasn't bothered me. But perhaps it indicates why the AA script is breaking? The AoB will find the address no matter what the current value is, so the jitter isn't an issue for that. Nothing any the memory region of the AoB is changing apart from the bytes representing the jittering value and the next 2 bytes to the right of the values.

Here is my AA with AoB:

Code:

[ENABLE]
alloc(newmem,2048)
label(returnhere)
label(exit)
label(pauseECM)
registersymbol(pauseECM)
aobscan(aob1, 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 41 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00)


newmem:
db 00 00 70 41

exit:
jmp returnhere

aob1+60:
pauseECM:
jmp newmem
nop
returnhere:
 
[DISABLE]
dealloc(newmem)
pauseECM:
db 00 00 70 41
unregistersymbol(pauseECM)


I've tried with a smaller AoB but it's not reliably finding the address I'm assuming it's not a problem, just related to speed of searching for the address. The value has an offset of 60, and I'm changing the correct bytes far as I know. As soon as I enable it, the game will crash though, it's not behaving the same as typing a value in manually.

Here is the memory region the AoB picks up, you can see when it applies that the 4 bytes for the float are changed as well as 2 bytes to the right of that, I'm not sure why as I'm only setting the first 4 bytes to the same value prior to enabling the script?


I can't post urls for img tag, so please see attachments.

Any help would be appreciated, perhaps I misunderstood something or there is a better approach. I've tried pointerscan with defaults but got no results when scanning with the new address after a restart. I've tried manually as well via VEH debugger but any address pointers seem to only be present when using the debugger, so neither of those approaches seem valid.[/img]



memoryregion_1.png
 Description:
The AoB is successful with it's offset, the bytes are changed, game crashes
 Filesize:  28.44 KB
 Viewed:  8776 Time(s)

memoryregion_1.png



memoryregion_2.png
 Description:
The hex byte values before activating the script
 Filesize:  28.3 KB
 Viewed:  8776 Time(s)

memoryregion_2.png



memoryregion_float.png
 Description:
I've set the value manually to 15 and frozen the value, nothing breaks game works fine
 Filesize:  24.57 KB
 Viewed:  8776 Time(s)

memoryregion_float.png


Back to top
View user's profile Send private message
SteveAndrew
Master Cheater
Reputation: 30

Joined: 02 Sep 2012
Posts: 323

PostPosted: Mon Feb 09, 2015 2:11 am    Post subject: Reply with quote

Okay your problem is you are trying to "hook data"... lol

See when you're manually editing the value at address: 0x518708c0 aka "pauseECM" in your script.

pauseECM after finding the aob, is pointing to 0x518708c0 or whatever the address happens to be for that run of the game.

Instead of modifying it to a float value of 15.0 you are instead writing a JMP xxxxxxxx(5 bytes: 0xE9 XX XX XX XX) + nop (1 byte: 0x90)

and you're storing float value 15 at newmem which isn't doing anything for you... Because you have to hook code, data is not code and can't be hooked...

I would recommend adding the address: 0x518708c0 to your CT and doing a right click + "find what accesses" and then doing whatever it is in the game that changes the value, and see what comes up... You can hook that code to change the value...

However until then I have a solution for you since that aob seems to be working good for you, this can work your way.

However you said you have to freeze the value right? So just setting it once isn't going to do much right? Don't worry about the fidgeting the value looks like in CE while freezing it... That's only because you are constantly modifiying it, and the game is still able to modify it also... It's kind of like a tug of war, where the game is like no the value is supposed to be like this, then CE is like no but I'm changing the value to (float)15.0, etc... etc... and that goes on and on, back and forth. With CE and the game both fighting to "have it their way" with the value they each want it to be.

That is the benefit of finding the game's code which is changing the value, and then you can nullify it's ability to change it, and instead whenever it tries to change it, you insert your own value like 15.0 (float)

So here would be fixing your script, but it still only changes it once, so you'd have to keep enabling / disabling it for it to stay in effect:
Code:

[enable]
aobscan(aob1, 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 41 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00)
label(pauseECM)
registersymbol(pauseECM)

aob1+60:
pauseECM:
dd (float)15.0
//same as: db 00 00 70 41

[disable]

pauseECM:
dd (float)15.0

unregistersymbol(pauseECM)



So until you do a "find what accesses" and a code injection you can instead create a thread, which constantly writes 15.0 to that address: pauseECM
This will act like CE's Freeze function but even faster (with a delay of only 10ms rather than whatever setting you have in CE)

Code:

[enable]
aobscan(aob1, 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 41 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00)
alloc(ConstantlyWrite,1024)
label(StopWritingValueAndExitThread)
label(ScriptDisabled)
label(pauseECM)
registersymbol(ScriptDisabled)
registersymbol(pauseECM)
createthread(ConstantlyWrite)

aob1+60:
pauseECM: //only associate pauseECM with the proper address here

ConstantlyWrite:
push 0a
call kernel32.Sleep
cmp [ScriptDisabled],1
je StopWritingValueAndExitThread //when script disabled, thread will exit

mov eax,pauseECM //move address of pauseECM into register
mov edx,(float)15.0 //value to write into another register
mov [eax],edx //write value
jmp ConstantlyWrite //loop forever until script disabled

StopWritingValueAndExitThread: //only reached when script is disabled
ret

ScriptDisabled:
dd 0

[disable]

ScriptDisabled:
dd 1

unregistersymbol(ScriptDisabled)
unregistersymbol(pauseECM)


1. Upon enabling it finds the address with aob, pauseECM then equals the address you want to modify.
2. Thread is created which constantly writes to pauseECM address float value 15.0
3. That continues until you decide to disable it, when disabled the thread exits

Take note there is no dealloc at disable because other wise the game will crash. Deallocating the memory a thread is currently running on is obviously not a good thing to happen and that's why the crash happens.

You'll just have to live with the slight memory leak each time you enable+disable it... Which isn't much of a problem if you don't have to do that often or only have to do it once Razz

_________________
Back to top
View user's profile Send private message
Kwhali
How do I cheat?
Reputation: 0

Joined: 08 Feb 2015
Posts: 7

PostPosted: Tue Feb 10, 2015 3:31 pm    Post subject: Reply with quote

SteveAndrew wrote:
Okay your problem is you are trying to "hook data"... lol

D'oh, lol thanks for clarifying that. Although I'm just changing bytes to update a float, it'll still be listed in the top half of the memory viewer as instructions as well right? Little bit confusing for me, I'll have to look into opcodes more.

SteveAndrew wrote:

However you said you have to freeze the value right? So just setting it once isn't going to do much right?

So here would be fixing your script, but it still only changes it once, so you'd have to keep enabling / disabling it for it to stay in effect:
Code:

[enable]
aobscan(aob1, 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 41 03 00 00 00 ?? ?? ?? ?? 04 00 00 00 00 00 00 00 ?? ?? ?? ?? 07 00 00 00 ?? ?? ?? ?? 04 00 00 00)
label(pauseECM)
registersymbol(pauseECM)

aob1+60:
pauseECM:
dd (float)15.0
//same as: db 00 00 70 41

[disable]

pauseECM:
dd (float)15.0

unregistersymbol(pauseECM)


Well each level is about 5-20 mins long usually, this timer is for an ability that prevents the enemy setting off an alarm; so it's nice to have it running throughout. I could probably just set a very high value too Smile

I've used this script for some other timers I've come across, reducing them to 0 to trigger an event(usually opens a door). There is a drill you can apply to doors and when the timer reaches 0 it'll open it. Since these are instanced though. Not sure if they're stored via a hashmap, array or something else, my AoB always affects the first one, haven't looked into if it matches additional instances, toggling it on/off seems to work on them, probably targeting first element of an array that is removed by an event when the timer reaches 0. Would pointers still be worthwhile for instanced objects like this?

As the instanced objects are removed by the event function once the timer reaches 0, is the dealloc/disable needed? I've removed it and seems to be fine. Before it was crashing the game, obviously since that memory didn't belong to the removed object anymore.

SteveAndrew wrote:

You'll just have to live with the slight memory leak each time you enable+disable it... Which isn't much of a problem if you don't have to do that often or only have to do it once Razz

How much of a leak is it? 1024 bytes? I can live with that Smile How do I know how much bytes to alloc btw? As mentioned I only enable it once per level, I need to disable it before it ends as it crashes the game in between levels Razz

I really appreciate that help and detailed explanations, I'll need to look into pointers more as the basic tuts I've come across don't seem to be working smoothly in my case.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites