Cheat Engine

[gunminiho]

well i want to ask something about this, AutoAssembler script and ASM, let's say i have this AA:

[NINTENDO]

google told me that
"To allocate memory in the address space of another process, use the VirtualAllocEx function."
if that is any help.

http://msdn.microsoft.com/en-us/library/aa366890(VS.85).aspx

[Zerith]

[Stylo]

why would you use virtualallocex?
you can use inline asm
and as cavecode you can write a function / procedure that you'd jump to the address of that procedure from your code
i can write it in C++ for you but i could be difficult for you to translate it to delphi

[gunminiho]

yes but how to use it? just declare it and then use addy that i declared?? i have no idea, well i have it but incomplete

[Stylo]

you can declare CSX as function that returns nothing (void).
that's your codecave in it use inline asm (in delphi the keyword is asm).
in it you will enter the codecave's code
now the memory editing part is to make the code will jump to your cavecode
at address: 008A52A2
so what we will do is to change the first byte at the address to 0xe9 which means jmp opcode
after that we will calculate the bytes to jump to our codecave.
so we can use the formula of: destination address - source address - 5
the result of it will be dword value (4 bytes value) that's represent the bytes to jump.

[gunminiho]

ok ^^ about formula hmm

its:

destination addy - source addy - 5 or destination addy:source addy - 5????????????????

if its first, my destination addy its a label? how do i calcule that? O.o! source addy :S what is that?


Extra question

how do i get hProcess in VirtualProtectEx or VirtuAllocEx?

[Stylo]

it's the first formula.
and your destination address isn't a label it's the CSX function you declared b4
that function has address at the memory space so CSX - source address - 5 should work since it'll take CSX as the numeric value of the function (it's address).
i know it works perfectly in C++ (CSX converted to it's numeric value) but i don't know about delphi.

[dnsi0]

[pkedpker]

alloc(CSX,128)

means make codecave

you don't have to use VirtualAlloac

you can use malloc/new in C/C++


P.S> I see you want to do this in Delphi hey.. Cheat Engine is made in delphi why not just look at the source code and rip stuff into your hack.


To get original address of something I used this in my C++ winsock hook

[&Vage]

I don't know about delphi, but here's C++

[lurc]

[&Vage]

Go fuck yourself :]

[tanjiajun_34]

For this...
function VirtualAllocEx (hProcess : Integer;
var lpAddress : Pointer;
var dwSize : Integer;
flAllocationType : Integer;
flProtect : Integer) : Integer;
stdcall; external 'kernel32.dll' name 'VirtualAllocEx'

How do I get lpAddress?
Lets take the first post script as example.

[gunminiho]