Cheat Engine

[reverser69]

hi all

im trying to make a simple veh hook plugin.
there's a problem i encountered. to avoid fps drop i decided to copy a whole page and then jump to it by veh. now what should i do if the page does not start with a valid instruction? i.e an instruction is at boundary of two pages.

[Dark Byte]

copy the surrounding pages as well and adapt them so all their logic jumps back to the original code (e.g int3's in all instructions except the boundary instructions and on int3 make it jump to the corresponding page)

also adjust all rip relative instructions in case you haven't done that yet

[reverser69]

[Dark Byte]

disassemble it all

and as i said adjust all rip relative instructions. That includes long jumps (short jumps are fine as they can never jump beyond the int3 pages)

[reverser69]

there are "Disassembler" and "disassembleEx" exported functions. how are they different?

i know I'm being dumb here but when you say "disassemble it all" i don't really get where this "all" starts so that i can pass its address to those exported functions.

i can go back another 0x1000 bytes and start copying from there but what if that page also doesn't start with a complete instruction? what if i enter another function?

[Dark Byte]

I recommend invoking ce's lua so you have access to the lastDisassembleData which contains info like rip relativity etc... There's also a riprelative scanner in lua

Normally when you are at a wrong offset and disassemble it eventually snaps back to the correct code . If you start 0x1000 bytes before you should snap back correctly before the last instruction which is the important one

you can of course also scan for known function start markers and start the disassembler from there

I think the stealthedit plugin also uses ce's lua to do something like this

[reverser69]

thanks for the info.

i know there's the *L from CE C interface but how exactly should i call lastDisassembleData with that?
is there any debug capability (via VS or any other tool) that makes it possible to view returned object by lastDisassembleData? in real-time.