Cheat Engine :: View topic - Reliably call a function on memory change.

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Reliably call a function on memory change.
Goto page Previous 1, 2

Cheat Engine Forum Index -> General Gamehacking

View previous topic :: View next topic

Author

Message

Mal1t1a
Cheater

Reputation: 0

Joined: 03 Jan 2010
Posts: 40

Posted: Tue Jun 04, 2013 10:40 pm Post subject:

Gniarf wrote:

Mal1t1a wrote:

Although, I'm too inexperienced in C++ to write what I want to do.

May I inquire what you want to do?

Mal1t1a wrote:

Should I make a separate topic about trying to call a function from a vb.net library in C++?

I'd recommend googling instead, since someone MUST have had this issue before you. Otherwise the General programming should be appropriate.

Mal1t1a wrote:

As far as this method of using a C++ only .dll file, how would I do the same thing, but for a string of unknown length.

Err the "same thing"? Same as what?

Mal1t1a wrote:

The way I determined how long the string was is to read in 255 bytes, parse it until I hit the byte "00" and then concatenate everything before it.

strlen(AddressOfTheFirstCharOfAString); will give you the total length of that string.
Note: technically, strlen just searches for the first 00 in a string.

I would like to hook a location in memory that would call a function that would carry out a routine for me based on the data contained within that memory location.
I wanted to get an introduction to memory address hooking and I figured the absolute easiest way to create an introduction is to learn about memory locations that involve integers.

It would be amazing if I could get an example of using different hooks with different data which may include: doubles, floats, bytes, 2bytes, 4 bytes, ect. I'm not sure how I would do that.

In the end I would like to hook an address, say application.exe+0x0000FFFF and monitor any amount of bytes and interpret those bytes as individual characters, concatenate them together into a string. Based on the content of that string, say it started with an "!" or using different string manipulation methods to create my routine; I would like to send the information that I gathered to a URL via post, or get. Ideally I would prefer to connect to a database and enter the data directly.

Edit:
I've been trying to add hooks for memory addresses that contain Double's and Float's, I can not get it working.

I decided to not use pointers in the functions so I have this as my new library:

Code:

// MemoryHookTest.cpp : Defines the exported functions for the DLL application.
//

#include "stdafx.h"

__declspec( dllexport ) int __stdcall Barber(int Fools)
{
Fools += 4;
return Fools;
}

__declspec( dllexport ) double __stdcall Barber2(double Fools)
{
Fools += 2.5;
return Fools;
}

__declspec( dllexport ) float __stdcall Barber3(float Fools)
{
Fools += 3.14159265;
return Fools;
}

With the Barber function, I have to write this asm in auto assembly:

Code:

push eax
call Barber
mov [eax+160], eax

and it works fine.

I don't know how to do it with Barber2 and Barber3

The asm is so different.
I got something similar to this:

Code:

fstp PWORD ptr [eax+158]

I tried to write this:

Code:

push [eax_158]
call Barber2
fstp PWORD ptr [eax+158]

but it crashed the program. I also can not do it with floats because it's basically the exact same thing. I think it might've been DWORD instead of PWORD though.

Gniarf
Grandmaster Cheater Supreme

Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

Posted: Wed Jun 05, 2013 12:27 pm Post subject:

Mal1t1a wrote:

It would be amazing if I could get an example of using different hooks with different data which may include: doubles, floats, bytes, 2bytes, 4 bytes, ect. I'm not sure how I would do that.

A generic way is to use pointers. The assembly part doesn't change from what I've written in my previous post, only the C function changes.
for doubles: void __stdcall Barber(double* Fools)
for floats: void __stdcall Barber(float* Fools)
for ints: void __stdcall Barber(int* Fools)
for strings: void __stdcall Barber(char* Fools) //Fool is the address of the first character
for unicode strings: void __stdcall Barber(__wchar_t* Fools)
for wtfs: void __stdcall Barber(wtf* Fools)
...
You don't need to return anything, since you pass the pointer as argument you can do the reading an the writing in C.

If you absolutely want to pass arguments as values:
for doubles:

Code:

sub esp,8
fstp qword ptr [esp]
call BarberDouble //return value in the first FPU register afaik

for floats:

Code:

sub esp,4
fstp dword [esp]
call BarberFloat //return value in the first FPU register afaik

for 1,2,4 byte ints:

Code:

push eax //or other 32 bit register, even if you deal with a 8 bit int
call Barber //return value in eax

for 8 byte ints:

Code:

push MostSignificantRegister //generally edx
push LeastSignificantRegister //generally eax
call BarberInt64 //return value in in edx:eax (eax is the least significant register)

for strings: you pass a pointer to the first character.
for struct and class instances: as pointer.

Mal1t1a wrote:

In the end I would like to hook an address, say application.exe+0x0000FFFF and monitor any amount of bytes and interpret those bytes as individual characters, concatenate them together into a string.

No need to concatenate characters. If there are characters at addresses 10,11,12...they all belong to the same string, which ends at the first 00 character. Thus any pointer to a character is a pointer to a string.
There is a datatype called "string" aka "std::string" that is used to handle strings (sequences of characters) but I recommend you use CString instead which has a more appropriate replacement method. In future posts in this thread, I will never use "string" alone when I mean "std::string".

Mal1t1a wrote:

Based on the content of that string, say it started with an "!" or using different string manipulation methods to create my routine; I would like to send the information that I gathered to a URL via post, or get. Ideally I would prefer to connect to a database and enter the data directly.

I'm not competent on network stuff, so I can't help much on that part, (database access=sql request?). All I can say is that I suggest using libcurl to do the http part. See the example: http://curl.haxx.se/libcurl/c/postit2.html .

Hmmm...given your scenario description you don't need to modify the data (to alter the target's behaviour) you just want to read it, which removes the problem of the length of the return value, thus is C this is enough:

Code:

CURL *curl;

__declspec( dllexport ) stdcall void Barber(char* Fools)
{
CString HandyString=Fools; //HandyString is a copy of the string at address Fools
HandyString.Replace('p','q');
HandyString.MakeReverse(); //turns 1cba0 into 0abc1
if (HandyString.Find("abc")!=-1) //if "abc" is found in HandyString...
{
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, HandyString.GetBuffer()); //not sure about that line
curl_easy_perform(curl); //curl is initialized elsewhere

}

As for the asm part, is the code that writes on your string within a system dll (probably msvc***.dll, ntdll.dll, or kernel32.dll) ?

Mal1t1a wrote:

I tried to write this:

Code:

push [eax_158]
call Barber2
fstp PWORD ptr [eax+158]

but it crashed the program. I also can not do it with floats because it's basically the exact same thing. I think it might've been DWORD instead of PWORD though.

eax_158? PWORD?? How the hell did you even get cheat engine to chew this script? My cheat engine refuses it, and my brain says "parse error".

Display posts from previous:

	Cheat Engine Forum Index -> General Gamehacking	All times are GMT - 6 Hours Goto page Previous 1, 2
Page 2 of 2

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum