Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Could really use some help an injection copy
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
memorasus
Newbie cheater
Reputation: 0

Joined: 27 Sep 2016
Posts: 19

PostPosted: Thu Nov 10, 2016 1:14 pm    Post subject: Could really use some help an injection copy Reply with quote

I'm trying to make a script for teleporting, I've found the opcode that writes to the players coordinates and verified if i change the value at the address/coordinate i can teleport. I tried just using pointer scanning but unfortunately the game uses a different pointer for every map. Here is the snippet of the function for the coordinate:

Code:


+C01FF - movaps [rbp-70],xmm0
+C0203 - mulps xmm6,xmm10
+C0207 - movaps [rsi+10],xmm6
+C020B - movaps xmm0,[rbp-70]
+C020F - movaps [rsi],xmm


at this point im mainly concerned with being able to make an injection copy, I'm already working on dissecting the structure around the coordinate addresses to identify if it's me or enemy. I appreciate any help because I've hit a wall.

edit: cleaned up the code
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Thu Nov 10, 2016 5:11 pm    Post subject: Reply with quote

You may not have to look at the structure for a unique identifier. Typically, with coordinates, you can use a second injection point that is exclusive to hero player.

Anyway, work on finding an identifier first, before proceeding, as any script that you write will be mostly worthless without it.
Back to top
View user's profile Send private message
memorasus
Newbie cheater
Reputation: 0

Joined: 27 Sep 2016
Posts: 19

PostPosted: Thu Nov 10, 2016 5:21 pm    Post subject: Reply with quote

++METHOS wrote:
You may not have to look at the structure for a unique identifier. Typically, with coordinates, you can use a second injection point that is exclusive to hero player.

Anyway, work on finding an identifier first, before proceeding, as any script that you write will be mostly worthless without it.


I've found my unique identifier, at offset +24 I have a value of 0, enemies have a value of -0.15. I'm still trying to figure out how to right the value of RSI to a variable I create, nothing seems to work.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Fri Nov 11, 2016 2:42 am    Post subject: Reply with quote

That identifier may not be reliable. Typically, you want to avoid any identifiers that contain 0, but not always.

Why are you trying to write the value of RSI? Which of the above lines is your primary injection point?

Anyway, let CE build a script for you, using AOB Injection template, at your primary injection point, and paste it here...then we can assist you further.
Back to top
View user's profile Send private message
memorasus
Newbie cheater
Reputation: 0

Joined: 27 Sep 2016
Posts: 19

PostPosted: Fri Nov 11, 2016 11:58 am    Post subject: Reply with quote

Here is my primary injection point:
Code:

+C020F - movaps [rsi],xmm0


Here is the AA script, without any edits, since all my edits don't work

Code:

[ENABLE]

aobscanmodule(INJECT,RainbowSix.RDsGPolygonSurface2D<RLcHybridArray<RDsSegment,16>,RLcHybridArray<RDs2DTri,16> >::WillMergedPolygonBeConvex+C020F,0F 29 06 E8 B9)
alloc(newmem,2048,RainbowSix.RDsGPolygonSurface2D<RLcHybridArray<RDsSegment,16>,RLcHybridArray<RDs2DTri,16> >::WillMergedPolygonBeConvex+C020F)
stealtheditex(stealth,INJECT,5)


label(originalcode)
label(returnhere)
label(_teleport)

registersymbol(_teleport)

//======================================================

newmem:

   
   movaps [rsi],xmm0
   call RainbowSix.RDcBreakAllCutter::GetCutterType+1B9A0





originalcode:

   jmp returnhere

//enable:
//db 0

//======================================================

stealth:
_teleport:
   jmp newmem
   db 90 90 90

returnhere:

[DISABLE]

_teleport:
   movaps [rsi],xmm0
   call RainbowSix.RDcBreakAllCutter::GetCutterType+1B9A0

unregistersymbol(_teleport)
dealloc(newmem)



Also, while there are a dozen addresses that contain my coordinates, the address at RSI is the only one that actually changes anything when i change the value, and this is the only thing that writes to it. I noticed there also is actually a static address that always contains my coordinates but changing it does nothing, and when i try to "see what accesses this address" the game crashes.

edit:
The static address for my coordinates is "RainbowSix.exe"+6194280. Could I potentially cmp the value of the address at RSI to see if it matches, if so write RSI to my variable, instead of comparing an offset of RSI?


Last edited by memorasus on Fri Nov 11, 2016 12:05 pm; edited 1 time in total
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Fri Nov 11, 2016 12:05 pm    Post subject: Reply with quote

Your problem is you're overwriting a CALL instruction, which changes each time the game loads.
Have you tried simply moving your injection point up by 1 instruction?
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Fri Nov 11, 2016 12:08 pm    Post subject: Reply with quote

You also did not follow my instructions - you're using a custom template for your script.

Regarding the compare, if you recall, I mentioned using a secondary injection point. I would advise trying that first. If you can't attach on 'what accesses', try using the VEH debugger or different breakpoint/debugger settings.
Back to top
View user's profile Send private message
memorasus
Newbie cheater
Reputation: 0

Joined: 27 Sep 2016
Posts: 19

PostPosted: Fri Nov 11, 2016 12:15 pm    Post subject: Reply with quote

Oh oops, I'm sorry here is the original, I should have had the injection point up 1 line like Zanzer said, here is original AOB injection:

Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat

 
 
aobscanmodule(PlayerLocation,RainbowSix.exe,0F 28 45 90 0F 29 06) // should be unique
alloc(newmem,$1000,"RainbowSix.exe"+210C6AB)

label(code)
label(return)

newmem:

code:
  movaps xmm0,[rbp-70]
  movaps [rsi],xmm0
  jmp return

PlayerLocation:
  jmp newmem
  nop
  nop
return:
registersymbol(PlayerLocation)

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
PlayerLocation:
  db 0F 28 45 90 0F 29 06

unregistersymbol(PlayerLocation)
dealloc(newmem)


Regarding a second injection point, (I feel so dumb even thinking this) what exactly do you mean? This is the only code that writes to the address. Do you mean to try finding an address close to the RSI address, find out what writes to that, and see if I can inject there?
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Fri Nov 11, 2016 1:01 pm    Post subject: This post has 1 review(s) Reply with quote

Regarding the second injection point, you need to check 'what accesses' the coordinate address (instead of what writes). As I said, you may need to change your debugger/breakpoint settings. Once the debugger shows you the additional instructions, you'll want to check if those opcodes access other addresses by right-clicking on an open white space inside the debugger window. You'll be able to see if any instructions ONLY access the coordinate address, and thus, are exclusive to YOUR coordinates. Once you have this, you can store the address that it accesses and use it inside of your script for your compare.

This may contain errors, but should give you the gist:

Code:
//Target:  RainbowSix.exe
//Author:  ++METHOS
//Script:  Teleport

[ENABLE]

{====================  teleport  ====================}

aobscanmodule(aob_teleport,RainbowSix.exe,0F 28 45 90 0F 29 06)
alloc(newmem_teleport,$1000,"RainbowSix.exe"+210C6AB)

label(return_teleport)
label(originalcode_teleport)
label(save_c)
label(load_c)
label(save_coordinates)
label(load_coordinates)
label(x_c)
label(y_c)
label(z_c)

registersymbol(aob_teleport)
registersymbol(save_coordinates)
registersymbol(load_coordinates)
registersymbol(x_c)
registersymbol(y_c)
registersymbol(z_c)


newmem_teleport:
cmp [rsi+24],0               //////////////include compare here
jne originalcode_teleport

cmp byte ptr [save_coordinates],1
je save_c
cmp byte ptr [load_coordinates],1
je load_c
jmp originalcode_teleport

save_c:
mov byte ptr [save_coordinates],0
push rax
mov rax,[rsi]
mov [x_c],rax
mov rax,[rsi+4]
mov [y_c],rax
mov rax,[rsi+8]
mov [z_c],rax
pop rax
jmp originalcode_teleport

load_c:
mov byte ptr [load_coordinates],0
cmp [x_c],0
je originalcode_teleport
push rax
mov rax,[x_c]
mov [rsi],rax
mov rax,[y_c]
mov [rsi+4],rax
mov rax,[z_c]
mov [rsi+8],rax
pop rax
jmp originalcode_teleport

originalcode_teleport:
movaps xmm0,[rbp-70]
movaps [rsi],xmm0
jmp return_teleport

save_coordinates:
db 0
load_coordinates:
db 0
x_c:
dq 0
y_c:
dq 0
z_c:
dq 0

aob_teleport:
jmp newmem_teleport
db 90 90
return_teleport:


[DISABLE]
dealloc(newmem_teleport)
aob_teleport:
db 0F 28 45 90 0F 29 06

unregistersymbol(aob_teleport)
unregistersymbol(save_coordinates)
unregistersymbol(load_coordinates)
unregistersymbol(x_c)
unregistersymbol(y_c)
unregistersymbol(z_c)


Once the script is activated, you'll want to create custom addresses for your activation toggles and assign hotkeys for them:

save_coordinates (byte type)
load_coordinates (byte type)


Last edited by ++METHOS on Sat Nov 12, 2016 12:11 am; edited 1 time in total
Back to top
View user's profile Send private message
Betcha
Expert Cheater
Reputation: 4

Joined: 13 Aug 2015
Posts: 232
Location: Somewhere In Space

PostPosted: Fri Nov 11, 2016 4:03 pm    Post subject: Reply with quote

++METHOS wrote:
This may contain errors, but should give you the gist:


I guess this:
Code:
aobscanmodule(PlayerLocation,RainbowSix.exe,0F 28 45 90 0F 29 06)
alloc(newmem,$1000,"RainbowSix.exe"+210C6AB)

Into this:
Code:
aobscanmodule(aob_teleport,RainbowSix.exe,0F 28 45 90 0F 29 06)
alloc(newmem_teleport,$1000,"RainbowSix.exe"+210C6AB)


Awesome Script !
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Sat Nov 12, 2016 12:12 am    Post subject: Reply with quote

Thanks for pointing that out, Betcha.
Post updated.
Back to top
View user's profile Send private message
memorasus
Newbie cheater
Reputation: 0

Joined: 27 Sep 2016
Posts: 19

PostPosted: Sat Nov 12, 2016 4:49 pm    Post subject: Reply with quote

Thanks, that actually helped me out a lot, unfortunately, my compares aren't working right they seem to sometimes change values sometimes they don't. as a result sometimes i teleport sometimes an enemy does, lol. Im going to have to dissect more structures, or analyze the traces to see if i can pinpoint something that won't change on me
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Sat Nov 12, 2016 4:57 pm    Post subject: Reply with quote

I already gave you the answer, did you try it? Mr. Green
Back to top
View user's profile Send private message
memorasus
Newbie cheater
Reputation: 0

Joined: 27 Sep 2016
Posts: 19

PostPosted: Sun Nov 13, 2016 12:16 pm    Post subject: Reply with quote

I'm working on converting it to use stealth edit, without stealth edit game crashes. but then again this game also crashes all the time without any mods, lol. I think I need to do some more reversing and find a better unique identifier, or something before trying to run any more injections. I did try implementing the cmp part of the code you provided and it still sometimes would teleport enemies or even sometimes, a block of wood..?
Back to top
View user's profile Send private message
Betcha
Expert Cheater
Reputation: 4

Joined: 13 Aug 2015
Posts: 232
Location: Somewhere In Space

PostPosted: Sun Nov 13, 2016 12:39 pm    Post subject: Reply with quote

memorasus wrote:
sometimes would teleport enemies or even sometimes, a block of wood..?

It is cause there isnt unique value for cmp..
Some items / enemies use same value on your cmp, so -

Do dissect data structure on everything what pops out in:
''Find Out What Addresses This Instruction Accesses''
Move your value in group 2 - and write down all group differences -

Restart game couple times by doing same i wrote above.
After few restarts you must end up with unique cmp -
That will stop teleport items / enemy's with you.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page 1, 2, 3  Next
Page 1 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites