 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Jamboz
How do I cheat?
![]() Reputation: 0
Joined: 12 Jan 2011
Posts: 9
Location: Finland
|
 Posted: Sat Mar 29, 2014 9:30 pm Post subject: [Bug] 64bit jmp disassembly |
 |
|
The comments explain the bug. I'm not sure if this bug is already acknowledged
| Code: | [ENABLE]
alloc(newmem, 256)
alloc(newmemptr, 8)
alloc(speedhackspeed, 4)
registersymbol(speedhackspeed)
alloc(olddata, 8)
registersymbol(olddata)
aobscanmodule(address, {name here}, {aob here})
registersymbol(address)
olddata:
readmem(address+11, 8)
newmemptr:
dq newmem
address+11:
jmp qword ptr[newmemptr]
db 90
newmem:
movss xmm0, [142E42960] // The script won't enable unless I comment this line
mulss xmm0, [speedhackspeed] // this line works
addss xmm0, [142E42960] // This has to be commented out too
jmp address+19
[DISABLE]
address+11:
readmem(olddata, 8)
dealloc(newmem)
dealloc(newmemptr)
dealloc(speedhackspeed)
unregistersymbol(speedhackspeed)
dealloc(olddata)
unregistersymbol(olddata)
unregistersymbol(address) |
Ok, I figured the problem above out while making this thread, but I'll leave it here so someone can explain me why it didn't work the way I tried to accomplish it. Was the address 142E42960 out of the instruction's scope or something similar? Below is the way I got it to work.
| Code: | newmem:
push rax
mov rax, 142E42960
movss xmm0, [rax] // The script won't enable unless I comment this line
mulss xmm0, [speedhackspeed] // this line works
addss xmm0, [rax] // This has to be commented out too
pop rax
jmp address+19 |
This is definitely a bug: for some reason the newmem's jmp is disassembled like this:
| Code: |
31D10000 - F3 0F59 04 25 0801D131 - mulss xmm0,[speedhackspeed]
31D10009 - FF 25 00000000 - jmp qword ptr [31D1000F]
31D1000F - 59 - pop rcx
31D10010 - 04 27 - add al,27
31D10012 - 40 01 00 - add [rax],eax
31D10015 - 00 00 - add [rax],al
|
As you might've noticed, I'm fairly newbie with 64 bit so I'm not really sure what's going on here, but to me it seems like the opcode size for the instruction is wrong. The code is assembled correctly, but the disassembly is wrong.
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25785
Location: The netherlands
|
| Posted: Sun Mar 30, 2014 4:50 am Post subject: |
|
|
The code is assembled correctly
Because the jump distance is bigger than a 32 bit signed value can hold the jmp instruction changes to
| Code: |
Jmp [addresswithlocation]
Addresswithlocation:
Dq destination
|
To prevent this problem use the third parameter of alloc, which sets the region to allocate in
| Code: |
Alloc(newmem, 256, address)
|
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
panraven
Grandmaster Cheater
![]() Reputation: 62
Joined: 01 Oct 2008
Posts: 958
|
| Posted: Wed Oct 21, 2015 11:51 am Post subject: |
|
|
| Dark Byte wrote: | The code is assembled correctly
Because the jump distance is bigger than a 32 bit signed value can hold the jmp instruction changes to
| Code: |
Jmp [addresswithlocation]
Addresswithlocation:
Dq destination
|
To prevent this problem use the third parameter of alloc, which sets the region to allocate in
| Code: |
Alloc(newmem, 256, address)
|
|
Just a suggestion, could the indirect jump made like this?
| Code: |
Jmp [addresswithlocation+1]
Addresswithlocation:
db b8
Dq destination
|
Then the 64-bit disassembler should show like this
| Code: |
jmp qword ptr [31D10010]
mov rax, 140270459 // address = 31D1000F
|
This make disassembler display neatly.
_________________
- Retarded. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
