| View previous topic :: View next topic |
| Author |
Message |
lazybug Newbie cheater
Reputation: 0
Joined: 06 Dec 2011 Posts: 10
|
Posted: Mon Dec 19, 2011 9:00 pm Post subject: what the diffrences of custom scan between 5.6.1 and 6.1 |
|
|
It looks there much diffrences . I write a custom scan script in 6.1 .it cannot run in 5.6.1.
And seems the custom scan of 5.6.1 is more powerful.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Dec 19, 2011 9:31 pm Post subject: |
|
|
I made modifications to ce6.2Alpha3 (cheatengine-i386.exe)
I added:
- alloc(fastScanAlignSize,4) [[an old alloc(fastscanstepsize,4) known from ce561]]
- alloc(treatAsFloat,1) (it makes cast: 4-bytes-integer to 4-bytes-Float) (3F800000 to 1.0)
but, they are not verified by Dark Byte. And only for AA Custom Type.
_________________
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25993 Location: The netherlands
|
Posted: Mon Dec 19, 2011 9:45 pm Post subject: |
|
|
a 6.1 custom scan script has added support for 64-bit in the same script so it will not work in 5.6.1 unless you remove that
Not sure what you mean with custom scan of 5.6.1 is more powerful, you can't even do value to type conversions there
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
lazybug Newbie cheater
Reputation: 0
Joined: 06 Dec 2011 Posts: 10
|
Posted: Tue Dec 20, 2011 12:46 am Post subject: |
|
|
Thanks a lot.
I write AA like this. I wanna search some datas encoded.
| Code: |
alloc(TypeName,256)
alloc(dllName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
TypeName:
db 'FC_Encode',0
dllName:
db 'xxxx.dll',0
ByteSize:
dd 4
ConvertRoutine:
push ebp
mov ebp,esp
push ebx
push esi
push edi
mov ebx,dword ptr [ebp+8]
//push offset dllName
//call GetModuleHandleA
//mov edx,eax
mov edx,38a0000
add edx,047E0
push eax
lea ecx,[ebx-4]
call edx //call decrypt function .
fstp [esp] //the return value is in ST0
mov eax,dword ptr [esp]
pop edi
pop esi
pop ebx
mov esp,ebp
pop ebp
ret 4
//function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);
ConvertBackRoutine:
push ebp //NOT USE
mov ebp,esp
push ecx
mov ecx,dword ptr [ebp+4]
mov eax,dword ptr [ebp+8]
xor ecx,034e7
mov dword ptr [eax],ecx
pop ecx
ret 8
|
I consider that 5.6.1 is more powerful ,because the comment of the AA template generated by custom scan looks like support a dll which can be writed by any language.And it looks more complicated.
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25993 Location: The netherlands
|
Posted: Tue Dec 20, 2011 9:17 am Post subject: |
|
|
6.1 also supports dll's like 5.6.1
loadlibrary and just calling the functions as described. 6.1 even has the function template required for C written in the comments. Of course, if your dll is 32 bit, use the 32-bit version of ce. Remember: The custom type code is executed inside Cheat Engine, not inside the game
| Code: |
mov edx,38a0000
add edx,047E0
push eax
lea ecx,[ebx-4]
call edx //call decrypt function .
fstp [esp] //the return value is in ST0
|
would cause a problem if 38a47e0 does not exist in CE
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
lazybug Newbie cheater
Reputation: 0
Joined: 06 Dec 2011 Posts: 10
|
Posted: Wed Dec 21, 2011 12:31 am Post subject: |
|
|
Thk u very much. Dark Byte.
I'll rewrite the script.
I found that the only way for call game internal routine with AA is that Creating a thread in the game process.
Maybe It is hard to call game internal routine with AA,so as to It's not easy for scan data enctryped by a little complex arithmetic.
I think out a way is copying the game codes to memory of CE and call it.
but I consider put the copy process in ConvertRoutine is not well,where to place it?
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25993 Location: The netherlands
|
Posted: Wed Dec 21, 2011 7:42 am Post subject: |
|
|
You'll have to put the decryption routine inside CE and let it function on the data the aa gives it
Another method that is way to slow to even bother:
Inject a dll that starts a thread and waits for communication
An the custom scan type write the code that sends a message to that thread (e.g pipe or events) and wait for it to finish processing and then read the result out
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
lazybug Newbie cheater
Reputation: 0
Joined: 06 Dec 2011 Posts: 10
|
Posted: Thu Dec 22, 2011 6:10 am Post subject: |
|
|
| Thks a lot.I'll try it.
|
|
| Back to top |
|
 |
|