Cheat Engine

mStorm · Posted: Mon Jul 20, 2009 5:19 am Post subject: Invoke a function...

I found the beginning of the opcodes that actually make my character jump. How do I invoke that function though? (is there any way to do it non-injected?)

Slugsnack · Posted: Mon Jul 20, 2009 6:40 am Post subject:

if it is actually a function and not a macro ( ie. it ends in a ret ) then you can create a remote thread there but that only works when there is 0 or 1 parameters to that function

mStorm · Posted: Mon Jul 20, 2009 6:50 am Post subject:

it definately has a "ret" at the end.. so how do i know how many parameters it has?

*also: how do you tell how many parameters are to a function?

smartz993 · Posted: Mon Jul 20, 2009 7:28 am Post subject:

Follow the stack in the function.

ex:

Slugsnack · Posted: Mon Jul 20, 2009 8:21 am Post subject:

sometimes you can tell by the 'ret x'

another method is breakpoint at the start of the function, look at the return address and go there and before that is the function call and arguments which unless deliberately obfuscated is probably the easiest way of finding how many parameters and what each does

mStorm · Posted: Mon Jul 20, 2009 8:55 am Post subject:

Which register holds the return address?

And is it a relative location value or absolute?

Slugsnack · Posted: Mon Jul 20, 2009 12:00 pm Post subject:

eax. return address is an absolute pointer

my return address hook :
http://wnz.zwit.org/

mStorm · Posted: Mon Jul 20, 2009 5:09 pm Post subject:

if i toggle at the "ret" i get a address to the beginning of a data structure that i'm editing...

Damn, theres no way to see "which function called this function?" or simply, where it is returning to Sad

Guy · Posted: Mon Jul 20, 2009 5:33 pm Post subject:

Slugsnack · Posted: Tue Jul 21, 2009 3:48 am Post subject:

mStorm · Posted: Tue Jul 21, 2009 11:56 am Post subject:

Hm.. Looks interesting. I traced back where the call was made from, now its a block of code with tons of jumps..

I am just toggling a breakpoint, and seeing if me jumping in the game triggers a break. I've traced it all the way up to a point that has int 3's all above it, so it must be a point where something "jumps" to it, yet I cannot find what is calling the jump. What is a good method of finding this?

(It wont let me +rep you twice in a row Slug, so I gotta rep someone else first.. heh)

Slugsnack · Posted: Tue Jul 21, 2009 2:55 pm Post subject:

if you're in olly then breakpointing you can see what last called/jmped from it by pressing '-'

mStorm · Posted: Tue Jul 21, 2009 3:09 pm Post subject:

Cool, I'll try that when I get off work.

So just set a breakpoint at that address, make it trigger, then hit the minus key, and it will go to the instruction that was directly before it?

Slugsnack · Posted: Wed Jul 22, 2009 1:53 am Post subject:

should do.. if that fails you i guess you could try using the run trace functions in olly

mStorm · Posted: Wed Jul 22, 2009 9:56 am Post subject:

I used the "Previous" option in Olly and it took me back to a memory address that didn't make much sense, i think like 10010000 (first address in the module)

:[