Cheat Engine

ta_trainer

Hi

I have the following function call that ends with this:
mov al, bl
mov large fs:0, ecx
pop ebx
mov esp, ebp
pop ebp
retn 8

if I modify the first line to "mov al, 1" to return 1 all the time, the hack works with some issues

the above function call is called from 2 different places, one of them is this:
mov eax, [esp+arg_0]
mov eax, [eax]
push esi
push eax
call the_above_function***
test al, al
setnz al
retn 4

I want this *** to return the same answer as if I have modified the first call

how can I do that
I tried replacing "call the_above_function***" with "mov al, 1" but it crashed!!!?

smartz993 · Posted: Sat Jan 31, 2009 7:10 pm Post subject:

Hook after the pop ebp, and check against the value of ESP.

If the value of ESP is the address after the address of the actual CALL, then do whatever.

rapion124 · Posted: Sat Jan 31, 2009 8:01 pm Post subject:

You crashed because of this:

Notice the push esi; push eax? Values are being pushed onto the stack without being popped (by the function). You need to nop those and then change the call to "mov al, 1." Then it won't crash.

Zerith · Posted: Sun Feb 01, 2009 9:57 am Post subject:

tombana · Posted: Sun Feb 01, 2009 12:45 pm Post subject:

Zerith · Posted: Sun Feb 01, 2009 1:22 pm Post subject:

Oh, I didn't see that he replaced the call, my bad.

Well, the best thing you can do, instead of replacing the call and removing the parameters, just inject a small script:

ta_trainer · Posted: Tue Feb 03, 2009 4:23 pm Post subject:

thank you guys
I managed it as per ur help
but a CRC check cought me

as per Dark Byte, a kernal breakpoint with EAX = 1 would help
and it did

thanks to you all