Cheat Engine

Hatschi · Posted: Sun Oct 05, 2014 6:47 am Post subject:

//fixed

Dark Byte · Posted: Sun Oct 05, 2014 7:47 am Post subject:

oh yes, i forgot you also need to enumerate all the images first and try findclass on each of them till found

with bytebased i mean it doesn't require messages of specific size but just a stream of data

first sent byte is 0x15
followed by an 8 byte containing the image (which you got from the enumeration)
followed by a 2 byte containing the length of the classname string
followed by the bytes to the string (utf8 formatted) without 0 terminator

then it returns an 8 byte that contains either 0 or the class

Hatschi · Posted: Sun Oct 05, 2014 7:53 am Post subject:

Okay I've edited my text above. Anyway with enumerate you mean:

Using "MONOCMD_ENUMASSEMBLIES" which returns an array of QWORD for all assemblies?

Then using "mono_getImageFromAssembly" on each assembly returned

Then using "mono_findClass" on all images returned for each assembly.

Is that the work it works? Or do I have to use another function?

Dark Byte · Posted: Sun Oct 05, 2014 8:42 am Post subject:

Yes, but first get all domains (usually just one) to get the assembles from

Also, if you know the imagename you can limit it to only that image (you still have to enumerate them till you find it)

Hatschi · Posted: Sun Oct 05, 2014 9:22 am Post subject:

//fixed

Dark Byte · Posted: Sun Oct 05, 2014 10:23 am Post subject:

jitinfo is only if you wish to know the details of a piece of assembler code

you want the opposite, you want to find or create the assembler code
which is why you need to find the method of the class, and then compile it with MONOCMD_COMPILEMETHOD (if it's already compiled it gives the address where it currently resides)

When you get the domains, get the assemblies from that
Then get the images from that
Then find the class you need in one of those images
Then find the method you need in the class you've just found.
Then compile that method

Hatschi · Posted: Sun Oct 05, 2014 10:45 am Post subject:

//fixed

Dark Byte · Posted: Sun Oct 05, 2014 11:07 am Post subject:

this looks weird:

Hatschi · Posted: Sun Oct 05, 2014 12:35 pm Post subject:

Yeah it contained a few coding mistakes. Now it seems to work fine. At least it doesn't crash, it crashes later.

I've used the lua file to give me some output of CE:

Dark Byte · Posted: Sun Oct 05, 2014 1:14 pm Post subject:

BitConverter.GetBytes(StringBytes.Length).Length might not be 2

Hatschi · Posted: Sun Oct 05, 2014 1:24 pm Post subject:

Yep and "pipeClientStream.Write(BitConverter.GetBytes(image), 0, 7)" should be "pipeClientStream.Write(BitConverter.GetBytes(image), 0, Cool

" instead. I got confused because memory streams or arrays in general start at 0 that's why I tend to add a -1 or so behind it.

Anyway it looks like I were successful: