| View previous topic :: View next topic |
| Author |
Message |
deama1234
Master Cheater
![]() Reputation: 3
Joined: 20 Dec 2014
Posts: 328
|
 Posted: Sat Feb 28, 2015 9:36 pm Post subject: Shared opcodes... |
 |
|
Well, I got a problem, there's this instruction:
| Code: | | mov [esi+edi*4+14],edx |
that is used by a million or so addresses; but how do I pick a specific address to modify?
I watched a "shared code" cheat engine tutorial video, but that was kinda "simple" compared to this...
Here's the video I saw: https://www.youtube.com/watch?v=1l5eMLjePmA
|
|
| Back to top |
|
 |
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sat Feb 28, 2015 9:52 pm Post subject: |
|
|
Write down the values of every register as it relates to when the address you want is accessed.
Quit and reload the game then find out what accesses the address again.
Find out which register values are still the same. At the very least, I would expect EDI to be the same.
EDX can be ignored since it contains the value.
I assume ESI contains the base address, so it can be ignored too.
Then create a small script which checks the value of every register that didn't change.
If it does not equal, then jump to the regular code.
If it does equal, have it execute that same code before falling through and executing the original.
Jump to your code cave and find the first instruction that should be skipped in most circumstances.
Find out what addresses that instruction accesses.
Hopefully only the one address pops up? 
|
|
| Back to top |
|
|
deama1234
Master Cheater
![]() Reputation: 3
Joined: 20 Dec 2014
Posts: 328
|
| Posted: Sat Feb 28, 2015 10:19 pm Post subject: |
|
|
| Zanzer wrote: | Write down the values of every register as it relates to when the address you want is accessed.
Quit and reload the game then find out what accesses the address again.
Find out which register values are still the same. At the very least, I would expect EDI to be the same.
EDX can be ignored since it contains the value.
I assume ESI contains the base address, so it can be ignored too.
Then create a small script which checks the value of every register that didn't change.
If it does not equal, then jump to the regular code.
If it does equal, have it execute that same code before falling through and executing the original.
Jump to your code cave and find the first instruction that should be skipped in most circumstances.
Find out what addresses that instruction accesses.
Hopefully only the one address pops up? |
Here's my cave code...
| Code: | 001A0000 - cmp edi,01
001A0003 - je 001A000E
001A0009 - jmp 001A0026
001A000E - cmp edx,04
001A0011 - je 001A001C
001A0017 - jmp 001A0026
001A001C - mov [mine],edi //just a test...
001A0022 - mov [esi+edi*4+14],edx
001A0026 - mov [esi+edi*4+14],edx
001A002A - pop edi
001A002B - jmp iggy_w32.IggyIMEDrawRect+8FE8 |
I looked at the first "001A0014 - mov [esi+edi*4+14],edx" that is meant to be skipped, but it doesn't show any adresses this time, not even when I go back to change the value that I wanna hack.
EDIT: Nvm, I figured it out! Thanks.
|
|
| Back to top |
|
|
fahrenheiz
How do I cheat?
![]() Reputation: 0
Joined: 01 Mar 2015
Posts: 0
|
| Posted: Mon Mar 02, 2015 12:02 am Post subject: |
|
|
| I do know this much. Waiting for someone to help me.
|
|
| Back to top |
|
|
Matroix123
Cheater
![]() Reputation: 0
Joined: 08 Mar 2015
Posts: 25
Location: Hell Land of The Week
|
| Posted: Sat Mar 14, 2015 8:24 am Post subject: . |
|
|
lol, it's piss easy instruction. go learn then come back
_________________
It's piss easy  |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
