| View previous topic :: View next topic |
| Author |
Message |
RendakDewo
How do I cheat?
![]() Reputation: 0
Joined: 13 Jul 2015
Posts: 3
|
 Posted: Mon Jul 13, 2015 7:51 am Post subject: help opcode aobscan with dynamic address |
 |
|
If you look at sample code below, there is mov [00E16218],F and mov [00E1621C],F . 00E16218 and 00E1621C is dynamic, so how to make it ... well "searchable" so my aobscan can work?
| Code: |
[ENABLE]
aobscan(INJECT_reset_tooltilereach,3B 05 ?? ?? ?? ?? 75 14 C7 05 ?? ?? ?? ?? 05 00 00 00) // should be unique
alloc(newmem,$1000)
globalalloc(xTileR,10)
globalalloc(yTileR,10)
label(code)
label(return)
xTileR:
dd 0
yTileR:
dd 0
newmem:
code:
mov [00E16218],F
mov [00E1621C],F
//cmp eax,[00E15954] //we just skip this since we forced it to edit
jmp INJECT_reset_tooltilereach+1c //force jump
jmp return
INJECT_reset_tooltilereach:
jmp code
nop
return:
registersymbol(INJECT_reset_tooltilereach)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
INJECT_reset_tooltilereach:
db 3B 05 54 59 E1 00
unregistersymbol(INJECT_reset_tooltilereach)
dealloc(newmem)
dealloc(xTileR)
dealloc(yTileR)
{
// ORIGINAL CODE - INJECTION POINT: 1E3536BC
1E3536A5: 7E 12 - jle 1E3536B9
1E3536A7: 8B 79 04 - mov edi,[ecx+04]
1E3536AA: 3B F7 - cmp esi,edi
1E3536AC: 73 3D - jae 1E3536EB
1E3536AE: 33 C0 - xor eax,eax
1E3536B0: 89 44 B1 08 - mov [ecx+esi*4+08],eax
1E3536B4: 46 - inc esi
1E3536B5: 3B DE - cmp ebx,esi
1E3536B7: 7F F1 - jg 1E3536AA
1E3536B9: 8B 42 08 - mov eax,[edx+08]
// ---------- INJECTING HERE ----------
1E3536BC: 3B 05 54 59 E1 00 - cmp eax,[00E15954]
// ---------- DONE INJECTING ----------
1E3536C2: 75 14 - jne 1E3536D8
1E3536C4: C7 05 18 62 E1 00 05 00 00 00 - mov [00E16218],00000005
1E3536CE: C7 05 1C 62 E1 00 04 00 00 00 - mov [00E1621C],00000004
1E3536D8: 8B 8A D8 00 00 00 - mov ecx,[edx+000000D8]
1E3536DE: 39 09 - cmp [ecx],ecx
1E3536E0: FF 15 40 6C 45 06 - call dword ptr [06456C40]
1E3536E6: 5B - pop ebx
1E3536E7: 5E - pop esi
1E3536E8: 5F - pop edi
1E3536E9: 5D - pop ebp
}
|
|
|
| Back to top |
|
 |
Daijobu
Master Cheater
 Reputation: 13
Joined: 05 Feb 2013
Posts: 301
Location: the Netherlands
|
| Posted: Mon Jul 13, 2015 3:19 pm Post subject: |
|
|
Find out what writes (not writes to) 00E16218 and 00E1621C and hook at that point. Store generated addresses and use these as pointers.
_________________
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 458
Joined: 09 May 2003
Posts: 25295
Location: The netherlands
|
| Posted: Mon Jul 13, 2015 3:49 pm Post subject: |
|
|
reassemble(address) is useful here
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Mon Jul 13, 2015 5:04 pm Post subject: |
|
|
Does this work?
| Code: | mov ecx,[INJECT_reset_tooltilereach+A]
mov [ecx],F
mov ecx,[INJECT_reset_tooltilereach+14]
mov [ecx],F |
Should also be able to add those values as pointers in your table.
INJECT_reset_tooltilereach+A
INJECT_reset_tooltilereach+14
|
|
| Back to top |
|
|
RendakDewo
How do I cheat?
![]() Reputation: 0
Joined: 13 Jul 2015
Posts: 3
|
| Posted: Mon Jul 13, 2015 5:24 pm Post subject: |
|
|
| Dark Byte wrote: | | reassemble(address) is useful here |
do you have tutorial for these "reassemble(address)"?
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 458
Joined: 09 May 2003
Posts: 25295
Location: The netherlands
|
| Posted: Mon Jul 13, 2015 6:25 pm Post subject: |
|
|
let's say you do an aobscan for 8B 42 08 3B 05 ?? ?? ?? ?? 75 14 and do the actual hook at 3b 05 ?? ?? ?? ??
Now you'd want to save the original instruction, and for that you use reassemble(address)
e.g:
| Code: |
aobscan(bla,8B 42 08 3B 05 ?? ?? ?? ?? 75 14)
alloc(newmem,1024)
label(originalcode)
label(returnhere)
newmem:
//do stuff
originalcode:
reassemble(bla+4)
//do other stuff
jmp returnhere
bla+4:
jmp newmem
nop
returnhere:
|
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
mgr.inz.Player
I post too much
 Reputation: 218
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
| Posted: Tue Jul 14, 2015 2:55 am Post subject: |
|
|
@DB
bla+3
_________________
|
|
| Back to top |
|
|
Rudo
Advanced Cheater
 Reputation: 2
Joined: 27 Jun 2015
Posts: 80
|
| Posted: Tue Jul 14, 2015 3:04 am Post subject: |
|
|
@DB
This is the very first time I see you posted something wrong haha
It should be bla+3
|
|
| Back to top |
|
|
RendakDewo
How do I cheat?
![]() Reputation: 0
Joined: 13 Jul 2015
Posts: 3
|
| Posted: Wed Jul 15, 2015 7:08 am Post subject: |
|
|
yup thanks for the help, today I randomly search around and found this tutorial from Rydian in forum.cheatengine.org/viewtopic.php?t=572465 (ahahaha I can't post url?), and looks good on my problem. so my final code something like this
| Code: |
[ENABLE]
aobscan(INJECT_blockP, 3B 05 ?? ?? ?? ?? 75 14 C7 05 ?? ?? ?? ??)
label(_xblockP)
label(_yblockP)
registersymbol(_xblockP)
registersymbol(_yblockP)
INJECT_blockP+8:
_xblockP:
INJECT_blockP+12:
_yblockP:
[DISABLE]
unregistersymbol(_xblockP)
unregistersymbol(_yblockP)
|
and add address manually, and put _xblockP+6 and _yblockP+6 as normal address 4 bytes, and done, now I can edit it as I want.
@Daijobu :: yeah, that's what Im thinking, but how to do that in CE? since at first I do not understand from just reading Rydian's tutorial.  forgot to mention that my skill is limited X)
@Zanzer :: nope, throwing a warning, saying it cannot inject or something, but thanks for trying to help me.
@Dark Byte :: wow interesting, I'll try your method too. thanks for the info.
@mgr.inz.Player and @Rudo-kun :: ahahaha no worries, make mistake once in a while is normal 
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
