| View previous topic :: View next topic |
| Author |
Message |
RichRD How do I cheat?
Reputation: 0
Joined: 27 Apr 2012 Posts: 5
|
Posted: Sun Mar 24, 2013 12:12 am Post subject: Need help with assembly. |
|
|
Hello , so i was poking around with cheat engine to make a hack for application i want but i got in dead end i came across this code:
| Code: | .....(some code).....
int 3
push ebp
mov ebp,esp
mov eax,[ecx+04]
mov edx,[ebp+08]
cmp eax,edx
jne myapp.exe+5942F7
mov eax,[edx+04]
mov [ecx+04],eax
pop ebp
ret 0004
cmp [eax+04],edx
je myapp.exe+594308
lea esp,[esp+00]
mov eax,[eax+04]
cmp [eax+04],edx
jne myapp.exe+594300
mov ecx,[edx+04]
mov [eax+04],ecx
pop ebp
ret 0004
int 3
........(some code)...... |
can someone with knowledge explain me what it does
i understand most of the opcodes but i dont understand these:
ret 0004
lea esp,[esp+00]
this code supposed to open doors or im going the wrong way?
|
|
| Back to top |
|
 |
lucid Master Cheater
Reputation: 0
Joined: 23 Jan 2008 Posts: 424
|
Posted: Sun Mar 24, 2013 12:23 am Post subject: |
|
|
I'm not perfectly sure here, I'm still learning myself, but I'm pretty sure it's like this
ret 0004 is the counterpart to a call, which is like a jmp but it has a return point (utilized by ret). Look for call 0004 somewhere around there in the opcode (you can also do a search).
lea takes the address a pointer is pointing to and puts it inside of a register. In your case it is putting the address [esp+00] points to inside of esp.
I'm not sure how to help you work out finding doors or anything, as I don't know what game it is or how you found those opcodes. Hope what little I do know helped though (if it's right)
|
|
| Back to top |
|
 |
RichRD How do I cheat?
Reputation: 0
Joined: 27 Apr 2012 Posts: 5
|
Posted: Sun Mar 24, 2013 12:40 am Post subject: |
|
|
thx with that lea but with ret 0004 it says that it pops 4 bytes off the stack but i dont know how meany bytes i pushed in if i pushed more then 4 bytes will the rest still be used by the program?
Also if some one can translate me that code to c++ i would be very grateful.
jne myapp.exe+5942F7 jumps to cmp [eax+04],edx
je myapp.exe+594308 jumps to mov ecx,[edx+04]
jne myapp.exe+594300 jumps to mov eax,[eax+04]
|
|
| Back to top |
|
 |
TsTg Master Cheater
Reputation: 5
Joined: 12 Dec 2012 Posts: 340 Location: Somewhere....
|
Posted: Sun Mar 24, 2013 2:05 am Post subject: |
|
|
In the routine you posted, only EBP was pushed at begining, then the RET XX or RET will pop out the bytes it has pushed automatically on execution(so don't worry about it, and don't try to change it or mostly program will crash)
also, the lea esp,[esp+00] is actually useless, as esp+00 means esp, and the lea means to assign the pointer of what's inside esp, to esp, to be clear, this line is equivalent to mov esp,esp
|
|
| Back to top |
|
 |
RichRD How do I cheat?
Reputation: 0
Joined: 27 Apr 2012 Posts: 5
|
Posted: Mon Mar 25, 2013 4:18 am Post subject: |
|
|
I dont understand i changed all compares to cmp eax,eax and nothing happened game run good open doors still good no crash i got angry and changed all compares and jumps to NOP still game run fine open doors still game runs fine changed all code to NOP game crash when opening doors what the hell is happening i know im @ the right spot but this is madness.
forget to mention that locked doors wont open no mater what i do to the code.
|
|
| Back to top |
|
 |
TsTg Master Cheater
Reputation: 5
Joined: 12 Dec 2012 Posts: 340 Location: Somewhere....
|
Posted: Mon Mar 25, 2013 6:53 am Post subject: |
|
|
What exactly are you trying to hack in that game?, and why are you messing up with the compare commands ?, you can test the jumps instead(set them to nop, make unconditional jumps,etc)
and if you are trying to open those 'locked doors', and you say nothing happens whatever changes yo make to the code, then mostly it's not the 'right spot' you are looking for .
|
|
| Back to top |
|
 |
RichRD How do I cheat?
Reputation: 0
Joined: 27 Apr 2012 Posts: 5
|
Posted: Tue Mar 26, 2013 7:41 am Post subject: |
|
|
I will put some pic's to show what im doing in CE and how locked and unlocked doors look.
| Code: | 2qu6umu.jpg - locked doors
23s6a9w.jpg - locked doors when i come close to them.
20subr6.jpg - unlocked doors
i23uz9xz.jpg - unlocked doors when i come close to them.
29bsir.jpg - what i was doing before
iqpi9f8.jpg - what im trying to do now cuz it might not be at the right sopot.
|
tinypic directct links cant post urls yet
Im i doing good or im completely off course. thank you.
|
|
| Back to top |
|
 |
|