 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Hereisme
How do I cheat?
![]() Reputation: 0
Joined: 18 Oct 2017
Posts: 2
|
 Posted: Wed Oct 18, 2017 4:35 am Post subject: Game crashes because of Array of Bytes |
 |
|
So i made AOB script and the game crashes when i try use it:
| Code: |
[ENABLE]
aobscan(charpos,0F 28 01 0F 29 02 BA C0 A0 DE 01 8B 0D ?? ?? ?? ?? 83 E1 F0 89 C8 C1 E8 0C 8B 04 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 01 C1 0F 88 ?? ?? ?? ?? 0F 28 0A 0F 29 09 8B 0D 50 A1 DE 01 81 C1 ?? ?? ?? ?? 89 C8 C1 E8 0C 8B 04 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 01 C1 0F 88 ?? ?? ?? ?? 8B 01 A3 30 9F DE 01 BA 40 A1 DE 01 8B 0D 10 A2 DE 01 89 C8)
alloc(newmem,$1000)
globalalloc(characterpositions,1)
characterpositions:
dd 0
label(code)
label(return)
newmem:
code:
mov [characterpositions],ecx
movaps xmm0,[ecx]
movaps [edx],xmm0
jmp return
charpos+03:
jmp newmem
nop
nop
return:
registersymbol(charpos)
[DISABLE]
charpos+03:
db 0F 28 01 0F 29 02
unregistersymbol(charpos)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 3031048E
""+30310462: E9 99 6B 52 D3 - jmp pcsx2.exe+2B27000
""+30310467: BA C0 A0 DE 01 - mov edx,pcsx2.exe+10DA0C0
""+3031046C: 8B 0D 60 A0 DE 01 - mov ecx,[pcsx2.exe+10DA060]
""+30310472: 83 E1 F0 - and ecx,-10
""+30310475: 89 C8 - mov eax,ecx
""+30310477: C1 E8 0C - shr eax,0C
""+3031047A: 8B 04 85 30 D0 92 0D - mov eax,[eax*4+0D92D030]
""+30310481: BB 94 04 31 30 - mov ebx,30310494
""+30310486: 01 C1 - add ecx,eax
""+30310488: 0F 88 F2 1B 4A D3 - js pcsx2.exe+2AA2080
// ---------- INJECTING HERE ----------
""+3031048E: 0F 28 01 - movaps xmm0,[ecx]
""+30310491: 0F 29 02 - movaps [edx],xmm0
// ---------- DONE INJECTING ----------
""+30310494: BA C0 A0 DE 01 - mov edx,pcsx2.exe+10DA0C0
""+30310499: 8B 0D 10 A2 DE 01 - mov ecx,[pcsx2.exe+10DA210]
""+3031049F: 83 E1 F0 - and ecx,-10
""+303104A2: 89 C8 - mov eax,ecx
""+303104A4: C1 E8 0C - shr eax,0C
""+303104A7: 8B 04 85 30 D0 92 0D - mov eax,[eax*4+0D92D030]
""+303104AE: BB C1 04 31 30 - mov ebx,303104C1
""+303104B3: 01 C1 - add ecx,eax
""+303104B5: 0F 88 A5 1C 4A D3 - js pcsx2.exe+2AA2160
""+303104BB: 0F 28 0A - movaps xmm1,[edx]
} |
what im trying to do here is make the "characterpositions" show my character positions anywhere, but when i run this script it all crashes because the AOB is too big(?). I can't use smaller amount Array of bytes or else i get multiple results and then this doesn't work. 
|
|
| Back to top |
|
 |
FreeER
Grandmaster Cheater Supreme
![]() Reputation: 53
Joined: 09 Aug 2013
Posts: 1091
|
| Posted: Wed Oct 18, 2017 6:56 am Post subject: |
|
|
Disclaimer: I just woke up so...
Since the AOB starts with 0F 28 01 0F 29 02 the address it finds is for {""+3031048E: 0F 28 01 - movaps xmm0,[ecx]}, so
charpos+03 refers to {""+30310491: 0F 29 02 - movaps [edx],xmm0} which is only 3 bytes, but you're trying to assemble a jump to newmem (usually 5 bytes) and 2 nops there. That's going to cause the next 4 bytes (3-5-2=-4) to be overwritten, this instruction: {""+30310494: BA C0 A0 DE 01 - mov edx,pcsx2.exe+10DA0C0} minus the last 01 byte which is going to change how the rest of the code is read since the next instruction becomes something with 01 8B 0D 10 A2 DE 01 instead of just 8B 0D 10 A2 DE 01.
add another nop, and probably add the overwritten instruction into the newmem so edx can be set properly, and it may work.
Alternatively, removing a nop and using just charpos instead of charpos+3 should also work
|
|
| Back to top |
|
|
Hereisme
How do I cheat?
![]() Reputation: 0
Joined: 18 Oct 2017
Posts: 2
|
| Posted: Wed Oct 18, 2017 11:12 am Post subject: |
|
|
| FreeER wrote: | Disclaimer: I just woke up so...
Since the AOB starts with 0F 28 01 0F 29 02 the address it finds is for {""+3031048E: 0F 28 01 - movaps xmm0,[ecx]}, so
charpos+03 refers to {""+30310491: 0F 29 02 - movaps [edx],xmm0} which is only 3 bytes, but you're trying to assemble a jump to newmem (usually 5 bytes) and 2 nops there. That's going to cause the next 4 bytes (3-5-2=-4) to be overwritten, this instruction: {""+30310494: BA C0 A0 DE 01 - mov edx,pcsx2.exe+10DA0C0} minus the last 01 byte which is going to change how the rest of the code is read since the next instruction becomes something with 01 8B 0D 10 A2 DE 01 instead of just 8B 0D 10 A2 DE 01.
add another nop, and probably add the overwritten instruction into the newmem so edx can be set properly, and it may work.
Alternatively, removing a nop and using just charpos instead of charpos+3 should also work |
Thanks for trying to help i tried these and doesn't seem to work, the game either crashes or if i add pcsx2.exe after the aobscan, it doesn't let me activate it. EDIT. I did the "Alternatively, removing a nop and using just charpos instead of charpos+3 should also work" and it worked, i was able to active it and it pointed to right position but after i disabled it pcsx2 crashed. EDIT EDIT.. now it all works thanks alot man 
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
