Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


jump in auto assemble

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
spacebar
How do I cheat?
Reputation: 0

Joined: 23 Aug 2008
Posts: 7

PostPosted: Wed Mar 15, 2017 3:26 pm    Post subject: jump in auto assemble Reply with quote

Hi guys,

I'm trying to use auto assemble to change a je to a jmp. When I change it manually in memory (set the bytes to EB to get a jmp), it works fine but when i do it through auto assemble it crashes.

I think it has something to do with the return point. since im jumping somewhere and then autoassemble might go back to where it came from (the place where i changed je to jmp)?

I'm not quite sure how to deal with it, any advice would be appreciated.

Here's the code:
Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
jmp game.exe+B20A9
mov ebx,[ebp-38]

exit:
jmp returnhere

"game.exe"+B2098:
jmp newmem
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"game.exe"+B2098:
je game.exe+B20A9
mov ebx,[ebp-38]
//Alt: db 74 0F 8B 5D C8
Back to top
View user's profile Send private message AIM Address
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3534

PostPosted: Wed Mar 15, 2017 4:42 pm    Post subject: Reply with quote

More than likely, you are breaking a jump. Try injecting above that injection point, or, write a script that only changes the bytes for that one instruction (i.e. that does not require a codecave).

EDIT:
So, for example, something like these:

Code:
//Target:  firefox.exe
//Author:  ++METHOS

[ENABLE]

{====================  example  ====================}

aobscanmodule(aob_example,firefox.exe,74 0F 57 6A 02)
registersymbol(aob_example)

aob_example:
db EB 0F


[DISABLE]
aob_example:
db 74 0F

unregistersymbol(aob_example)


Code:
[ENABLE]
"firefox.exe"+5E7B:
jmp firefox.GetHandleVerifier+3BCA

[DISABLE]
"firefox.exe"+5E7B:
je firefox.GetHandleVerifier+3BCA
Back to top
View user's profile Send private message
spacebar
How do I cheat?
Reputation: 0

Joined: 23 Aug 2008
Posts: 7

PostPosted: Wed Mar 15, 2017 5:13 pm    Post subject: Reply with quote

ooo you're right. i am messing things up by linking to that code cave.

there is a jne just above the place where i inject that points to the value that gets moved to the code cave and thus does not exist at the place where it is expecting it.

Code:

game.exe+B208F - 75 09                 - jne game.exe+B209A
game.exe+B2091 - 83 3D F0D76500 00     - cmp dword ptr [game.exe+25D7F0],00 { [00000000] }
game.exe+B2098 - 74 0F                 - je game.exe+B20A9
game.exe+B209A - 8B 5D C8              - mov ebx,[ebp-38]


is it possible to move this whole part to the code cave with the auto assemble function?

Thanks!
Back to top
View user's profile Send private message AIM Address
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3534

PostPosted: Wed Mar 15, 2017 5:18 pm    Post subject: Reply with quote

Yes -- just add the appropriate number of NOP's to your script and make sure that you include all of the code that you are wanting to relocate. You will want to make sure to restore it all in your disable section as well.
Back to top
View user's profile Send private message
spacebar
How do I cheat?
Reputation: 0

Joined: 23 Aug 2008
Posts: 7

PostPosted: Wed Mar 15, 2017 5:20 pm    Post subject: Reply with quote

alright i'll try that. thx again.
Back to top
View user's profile Send private message AIM Address
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3534

PostPosted: Wed Mar 15, 2017 5:35 pm    Post subject: Reply with quote

For example:

Code:
//Target:  firefox.exe
//Author:  ++METHOS

[ENABLE]

{====================  example  ====================}

aobscanmodule(aob_example,firefox.exe,55 8B EC 8B 45 08 56 8B 48)
alloc(newmem_example,1024,firefox.exe)

label(return_example)
label(originalcode_example)

registersymbol(aob_example)


newmem_example:

originalcode_example:
push ebp
mov ebp,esp
mov eax,[ebp+08]
push esi                                      //Additional code
mov ecx,[eax+3C]                              //Additional code
add ecx,eax                                   //Additional code
jmp return_example

aob_example:
jmp newmem_example
db 90 90 90 90 90 90 90                       //Additional NOP's
return_example:


[DISABLE]
dealloc(newmem_example)
aob_example:
db 55 8B EC 8B 45 08 56 8B 48 3C 03 C8        //Additional Bytes

unregistersymbol(aob_example)
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites