 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Penjuin
How do I cheat?
![]() Reputation: 0
Joined: 09 Jun 2013
Posts: 2
Location: United Kingdom
|
 Posted: Sun Jun 09, 2013 6:50 am Post subject: How do I convert a Lua trainer into .EXE? |
 |
|
I have a trainer that operates by running some Lua into the Lua engine in memory view, and I was wondering if I could somehow turn it into an executable file?
I was also wondering how to delete/remove labels and buttons on GUI?
Thanks.
|
|
| Back to top |
|
 |
mgr.inz.Player
I post too much
 Reputation: 218
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
| Posted: Sun Jun 09, 2013 7:04 am Post subject: |
|
|
Maybe you should try making your own GUI. (create new form, etc)
You can still operate in "Memory View" window (hidden), just show results inside form you designed.
If you post CT file, I can help.
_________________
|
|
| Back to top |
|
|
Penjuin
How do I cheat?
![]() Reputation: 0
Joined: 09 Jun 2013
Posts: 2
Location: United Kingdom
|
| Posted: Sun Jun 09, 2013 7:18 am Post subject: |
|
|
It already has a GUI, I just need to know how to convert the lua script into an executable, and how to remove stuff like labels and buttons from the GUI.
| Code: | Exploits = {}
Successes = {}
scripts = {}
Config = {
Restore = false,
Bar = true
}
function AddExploit(name, hex, offset, func)
table.insert(Exploits, { name, hex, offset, func })
end
function GetExploit(index)
local tab = Exploits[index]
local scan = createMemScan(true)
memscan_returnOnlyOneResult(scan, true)
memscan_firstScan(scan, soExactValue, vtByteArray, rtTruncated, table.concat(tab[2], " "), nil, 0, 0x00FFFFFF, "", fsmNotAligned, nil, false, false, false, false)
memscan_waitTillDone(scan)
local result = memscan_getOnlyResult(scan)
if (result == nil) then return nil end
result = result + tab[3]
result = string.format("%x", result)
result = string.rep("0", 8-#result) .. result
return result
end
-- Exploit functions here
function HashChecker(addr)
_, instruction = splitDisassembledString(disassemble(addr))
local hcbyte = ""
for i = 1, #instruction do
if string.sub(instruction, i, i) == "[" then
hcbyte = string.sub(instruction, i+1, i+8)
break
end
end
writeBytes(hcbyte, 0x00)
print("Disabled - " .. hcbyte)
end
function ContextChanger(addr, arg)
print("ContextChanger invoked.")
local calladdr = string.format("%x", tonumber(addr, 16) + 2)
_, callInstruction = splitDisassembledString(disassemble(calladdr))
autoAssemble(string.format([[
alloc(newmem,20)
label(returnhere)
newmem:
mov [esi], %s
%s
jmp returnhere
%s:
jmp newmem
db 90 90
returnhere:
]], control_getCaption(Interface.ContextEdit), callInstruction, addr))
print("Modified context")
end
function UpdateScripts()
print("Script Table Updated")
for i,v in pairs(Interface) do
if tostring(i) == "scripti" then
end
end
for i,v in pairs(Scripts) do
Interface.scripti = createLabel(Interface.Frame)
control_setSize(Interface.scripti, 400, 22)
control_setPosition(Interface.scripti, 0, 135+(i*22))
control_setCaption(Interface.scripti, tostring(i)..":: "..string.sub(v,1,20).."...")
end
end
function Hook(addr)
if (Config.Restore) then
Config.Restore = false
writeBytes(addr, 0x83, 0xEC, 0x14, 0x56, 0x57)
return
end
local script = ""
for _,v in pairs(Scripts) do
script = "\n"..script..v
end
local mem = string.format("%x", allocateSharedMemory("scropt", #script))
mem = string.rep("0", 8-#mem) .. mem
writeString(mem, script)
local len = string.format("%x", #script)
local assemble = string.format([[
alloc(newmem,2048)
label(returnhere)
newmem:
mov [esp+18], %s
mov [esp+1C], %s
sub esp,14
push esi
push edi
jmp returnhere
%s:
jmp newmem
returnhere:
]], mem, len, addr)
autoAssemble(assemble)
end
function AddScript()
if Config.Bar then
nscript = control_getCaption(Interface.scriptEdit)
else
nscript = strings_getText(memo_getLines(Interface.scripts))
end
table.insert(Scripts,nscript)
UpdateScripts()
end
function Noclip(addr)
print(addr)
if readBytes(addr, 1) == 0xFF then
print("We're enabling it.")
Config.LegitBytes = readBytes(addr, 7, true)
writeBytes(addr, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90)
else
writeBytes(addr, Config.LegitBytes)
end
end
function DisableOtherChecks(addr)
print("Disabling other checks...")
writeBytes(addr, 0xEB)
end
-- Exploit definitions here
AddExploit("noclip", { 0x56, 0x8B, 0xf1, 0x83, 0xf8, 0x18}, 12, Noclip)
AddExploit("level", { 0x89, 0x74, 0x24, 0x0C, 0x89, 0x06, 0xe8}, 4, ContextChanger)
AddExploit("script", { 0x83, 0xEC, 0x14, 0x56, 0x57, 0x8B, 0x7C, 0x24, 0x2C, 0x85, 0xFF}, 0, Hook)
AddExploit("hash", { 0x00, 0x51, 0x53, 0x56, 0x83, 0xCB, 0xFF}, 7, HashChecker)
AddExploit("checks", { 0xe4, 0xC7, 0x45, 0xfc, 00, 00, 00, 00, 0x85, 0xC0, 0x74}, 10, DisableOtherChecks)
--
print("Autoscanning for " .. tostring(#Exploits) .. " exploits...")
for i,v in pairs(Exploits) do
local exploit = GetExploit(i)
if (exploit == nil) then
print("Failed to scan exploit " .. v[1])
else
print("Successful - " .. v[1] .. " is at " .. exploit)
table.insert(Successes, {v[1], exploit, v[4]})
end
end
showMessage(tostring(#Successes) .. " out of " .. tostring(#Exploits) .. " exploits could be found.")
--
function DoExploit(name)
split = 0
for i = 1, #name do
if string.sub(name, i, i) == " " then
split = i
break
end
end
if split ~= 0 then
arg = string.sub(name, split+1)
name = string.sub(name, 1, split-1)
else
arg = ""
end
print("name: " .. name .. "; arg: " .. arg)
for i,v in pairs(Successes) do
if v[1] == name then
v[3](v[2], arg)
end
end
end
--
Interface = {}
Interface.Frame = createForm(true)
control_setSize(Interface.Frame, 800, 478)
Interface.script = createLabel(Interface.Frame)
control_setSize(Interface.script, 400, 22)
control_setCaption(Interface.script, "Command line - doesn't change context!")
control_setPosition(Interface.script, 0, 7)
Interface.scriptEdit = createEdit(Interface.Frame)
control_setPosition(Interface.scriptEdit, 0, 22)
control_setSize(Interface.scriptEdit, 360, 300)
Interface.scriptBtn = createButton(Interface.Frame)
control_setPosition(Interface.scriptBtn, 360, 22)
control_setCaption(Interface.scriptBtn, ">")
control_setSize(Interface.scriptBtn, 40, 22)
control_onClick(Interface.scriptBtn, function() Config.Bar = true DoExploit("script") end)
Interface.Context = createLabel(Interface.Frame)
control_setSize(Interface.Context, 400, 22)
control_setPosition(Interface.Context, 0, 46)
control_setCaption(Interface.Context, "Context changer - doesn't have max; may crash if too high")
Interface.ContextEdit = createEdit(Interface.Frame)
control_setSize(Interface.ContextEdit, 360, 22)
control_setPosition(Interface.ContextEdit, 0, 60)
Interface.ContextBtn = createButton(Interface.Frame)
control_setSize(Interface.ContextBtn, 40, 22)
control_setPosition(Interface.ContextBtn, 360, 60)
control_setCaption(Interface.ContextBtn, ">")
control_onClick(Interface.ContextBtn, function() DoExploit("level") end)
Interface.Checkers = createButton(Interface.Frame)
control_setSize(Interface.Checkers, 400, 25)
control_setPosition(Interface.Checkers, 0, 85)
control_setCaption(Interface.Checkers, "Disable hash checker")
control_onClick(Interface.Checkers, function() DoExploit("hash") end)
Interface.Restore = createButton(Interface.Frame)
control_setSize(Interface.Restore, 400, 25)
control_setPosition(Interface.Restore, 0, 110)
control_setCaption(Interface.Restore, "Repair script execution")
control_onClick(Interface.Restore, function() Config.Restore = true DoExploit("script") end)
Interface.scripts = createMemo(Interface.Frame)
control_setSize(Interface.scripts, 400, 450)
control_setPosition(Interface.scripts, 400, 0)
memo_setScrollbars(Interface.scripts, ssVertical)
Interface.scripte = createButton(Interface.Frame)
control_setSize(Interface.scripte, 400, 25)
control_setPosition(Interface.scripte, 0, 450)
control_setCaption(Interface.scripte, "Run Scripts")
control_onClick(Interface.scripte, function()
DoExploit("script")
end)
Interface.scriptad = createButton(Interface.Frame)
control_setSize(Interface.scriptad, 400, 25)
control_setPosition(Interface.scriptad, 400, 450)
control_setCaption(Interface.scriptad, "Add script")
control_onClick(Interface.scriptad, function()
Config.Bar = false
AddScript()
end)
Interface.YScripts = createLabel(Interface.Frame)
control_setSize(Interface.YScripts, 400, 22)
control_setPosition(Interface.YScripts, 20, 135)
control_setCaption(Interface.YScripts, "Scripts")
Interface.Underbar = createLabel(Interface.Frame)
control_setSize(Interface.Underbar, 400, 22)
control_setPosition(Interface.Underbar, 20, 135)
control_setCaption(Interface.Underbar, "_______")
|
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 458
Joined: 09 May 2003
Posts: 25296
Location: The netherlands
|
| Posted: Sun Jun 09, 2013 7:34 am Post subject: |
|
|
in cheat engine save it with a .exe extention
the generated exe will execute the lua script when ran
note: Your script doesn't yet contain any code to open the target process
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
mgr.inz.Player
I post too much
Reputation: 218
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
| Posted: Sun Jun 09, 2013 7:45 am Post subject: |
|
|
Ohh, you just want to remove/destroy buttons, labels, etc.
Not hide them, just destroy?
Use this:
| Code: | | object_destroy( object ) |
If you have many labels and you want to destroy all of them when they aren't needed. Example:
creating:
| Code: | labelsToDestroy = {}
labelsToDestroy[#labelsToDestroy + 1] = createLabel(parent)
labelsToDestroy[#labelsToDestroy + 1] = createLabel(parent)
labelsToDestroy[#labelsToDestroy + 1] = createLabel(parent)
...
labelsToDestroy[#labelsToDestroy + 1] = createLabel(parent)
labelsToDestroy[#labelsToDestroy + 1] = createLabel(parent)
...
tmp = createLabel(parent)
control_setCaption(tmp, "label_45")
labelsToDestroy[#labelsToDestroy + 1] = tmp
...
tmp = createLabel(parent)
control_setCaption(tmp, "label_78")
labelsToDestroy[#labelsToDestroy + 1] = tmp
|
Destroying:
| Code: | for _,object in pairs(labelsToDestroy) do
object_destroy(object)
end
labelsToDestroy={} |
And what DB said.
You used "Lua engine window". So, before you save it as EXE, you must paste your Lua script inside "Lua script: Cheat Table" window. (ctrl+alt+L)
And don't forget this:
strings_add(getAutoAttachList(),"processName.exe")
_________________
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
