Cheat Engine

[mStorm]

Question:

I'm trying to make a cave that always catches when the ESI is a certain value, why is this crashing? Am I doing something wrong?

I know it's a sloppy method, but I'm still learning

01000F21: mov eax,[ebx+10] // Original opcode right before 1e23adf3
01000F24: cmp esi,138f83d0 // Check if ESI's value is 138F83D0 (is this correct?)
01000F2A: jne 01000f31
01000F2C: jmp 1e23adf3 // Jump back to original code if not equal
01000F31: mov [00401365],eax // If equal, move the value of EAX into that static address (just looked for an unused static addy)
01000F37: jmp 1e23adf3 // Jump back to original code.


The addresses are arbitrary, but when I do this to the game it crashes. Any ideas?

(I've already tried multiple times for the static pointer, it goes in loops and is way too much trouble than it's worth)

Basically, the instruction that writes to it, also writes to a lot of other addresses, but i've noticed that ESI is set to a specific hex that doesn't seem to relate to any other address or instruction so If i can only store what EAX is when the ESI is that certain hex, i've got the address i'm looking for.

Thanks

[Polynomial]

I'm still learning ASM myself, but doesn't the jne 01000f31 mean "If the cmp returned 'not equal', jump to 01000f31"? If so, your comment for 01000F31 line seems to suggest you're going wrong somewhere.

[mStorm]

Hm, ah. Good eye. But it still should execute and not crash the game, right? And give me all of the addresses I 'dont' want.

So:


01000F21: mov eax,[ebx+10] // Original opcode right before 1e23adf3
01000F24: cmp esi,138f83d0 // Check if ESI's value is 138F83D0 (is this correct?)
01000F2A: je 01000f31
01000F2C: jmp 1e23adf3 // Jump back to original code if not equal
01000F31: mov [00401365],eax // If equal, move the value of EAX into that static address (just looked for an unused static addy)
01000F37: jmp 1e23adf3 // Jump back to original code.

Is what we're working with. Which still crashes. :[

Possibly it's setting the ZF different than the original code expected?

[Polynomial]

Not sure, I'm not an expert in this

Try breakpointing 01000F21 in OllyDbg and stepping through it until you hit the exception.

[smartz993]

Do you want to compare the address of ESI, or the value inside it?

Try [esi].

[Chaosis13]

There are 16 and 32 bit jumps. 16 bit is a relative jump, 32 bit is a absolute jump. You need to be using 16 bit jumps (I think).

Also, is this AA or inline ASM?

[mStorm]

[Slugsnack]

i reckon it is crashing here :

[Polynomial]

Slug - Would that the an issue if he actually found an unused static pointer?

[Slugsnack]

he found an unused static address << what he means is buffer. if it has a pointer to it from somewhere else then it's not 'unused' if he is looking for codecaves he should not be looking in .text though, probably in places like .data section instead

if he wants to find a codecave dynamically then a good idea would be to virtualquery memory first to check its writability but if you're going to make it that complex then you're most likely injecting a dll in which case you could just allocate your own memory or declare it as a variable. in fact even in his codecaved code there, he could do 2 things :
1 ) allocate memory
2 ) make the memory that he is attempting to write to writable

with both, it would be a good idea to push/pop eax, ecx + edx to preserve them else you'll most likely crash the program or mess it up bad ( STDCall trashes those registers )

ps. section header names might differ depending on compiler/packed ( doesn't seem like that proggie is packed though if my assumption about its imagebase being 0x00400000 is correct )

[smartz993]