Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Help with replacing xmm1 with a floating point
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Fri Jul 19, 2013 8:27 am    Post subject: Reply with quote

DaSpamer wrote:
[x]+[y]+[Z] = 23.30.

Nope.
SPEED = SQRT(X*X + Y*Y + Z*Z)
So, no 27.30 or 23.30, it is: 25.0816666.....
(X = 25.00,Y = -2.00,Z = 0.30)



(btw. my keyboard is damaged, typos can occur)


@shadowpt
That will be (pseudo-code):

Code:
nX = x+dX*multiplier
nY = y+dY*multiplier
nZ = z+dZ*multiplier

NEWSPEED = SQRT(nX*nX + nY*nY + nZ*nZ)

if NEWSPEED > limit then
  do nothing
else
  dX := dX*multiplier
  dY := dY*multiplier
  dZ := dZ*multiplier
end



Quote:
This is going to be challenging

Not at all. My script
http://forum.cheatengine.org/viewtopic.php?p=5485103#5485103

Is almost finished. It works for all axis, etc. Yes it doesn't have limits, I planned to add limitation later.

Then I gave you this (30,34,38 as previously, and 40,44,48):
http://forum.cheatengine.org/viewtopic.php?p=5485144#5485144

You wrote back: "all the vehicles spazz". Still, I didn't added limitation, I focused on other things....

I asked you to test it more: "find out what addresses this .... " on movss xmm0,[eax+30]

I was almost sure that all opcodes you found are used for other objects too. I asked you to dig more, your answer here:
http://forum.cheatengine.org/viewtopic.php?p=5485189#5485189

Then you wrote this:
http://forum.cheatengine.org/viewtopic.php?p=5485210#5485210

Code:
D0 D4 D8 - Axis velocity (NS, WE, UD)
(...)
E0 E4 E8 - Vehicle tilts

D0 D4 D8 is accessed by [eax+30] [eax+34] [eax+38]
E0 E4 E8 is accessed by [eax+40] [eax+44] [eax+48]

now I know that we can skip changing tilts (but "driving" may be awkward )


DaSpamer scripts are wrong. Because they don't get deltas (speed delta for every axis, delta vector, acceleration vector, doesn't matter how we call it ) into account. Yes, you learned something from them (about comparing floating point values, the 'easy naive comparing' way). Don't get me wrong. Naive way is good for making cheats like godmode, stamina (floating point value is between 0 and some positive). If value is between -something and +something, we have to use FPU ( fcom ST(X) )
or SSE (xmmX registers - cmpss or comiss or ucomiss).


You say you have pointers. You meant "cheat engine multilevel pointer" ? Post it here, this way:
...[[[modulename+moduleoffset]+offset1]+offset2]+offset3....

You can change modulename to something else, if you don't want to tell which game is this, just give pointer base address instead of modulename+moduleoffset

Note: offset1 is first pointer offset, offset3 is the last. (inside add address/change address window, last offset is at the top)

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Fri Jul 19, 2013 11:24 am    Post subject: Reply with quote

Woow, I feel so stupid now...

Why do you use the sqrt of the sum of squares? I thought final vector is found by the sum of all 3 (2 in case of 2 dimensions) vector components.

Yeah, not changing the eax+40,44 and 48 won't matter much, the goal is the speed of 30 34 and 38 like you said.

And yes, CE mlp (offsets in order of reading, left is offset 1, right is offset 4):

Code:

"Game.exe"+02A6F758 ; + ac + 3d8 + 0 + 90   <- N / S


"Game.exe"+02A6F758 ; + ac + 3d8 + 0 + 94   <- U / D


"Game.exe"+02A6F758 ; + ac + 3d8 + 0 + 98   <- W / E


And in the format you requested:
Code:

[[[[["Game.exe"+02A6F758]+ac]+3d8]+0]+90]

[[[[["Game.exe"+02A6F758]+ac]+3d8]+0]+94]

[[[[["Game.exe"+02A6F758]+ac]+3d8]+0]+98]
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Fri Jul 19, 2013 11:46 am    Post subject: This post has 1 review(s) Reply with quote

Quote:
And in the format you requested

This format is an "official format" on CE forum.
Btw.
[[modulename+moduleoffset]+50]+60 - address
[[[modulename+moduleoffset]+50]+60] - value stored at address





OK. We can use those to filter out other addresses (other structures, other objects, vehicles).

I don't like to use pointers for that. Because, it almost always crash if pointer isn't stable. Of course, we can try....

Quote:
sum of squares

https://en.wikipedia.org/wiki/Euclidean_vector#Length

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Fri Jul 19, 2013 11:55 am    Post subject: Reply with quote

Wasn't aware of the official format, pardon me for that.

And those pointers have been stable since I found them, they are always there pointing to the right address everytime I am using a vehicle.

I'm glad they can be used to filter the other addresses, although I do not know how.

Also there is a twist, those are (how can I say this...) unique velocity addresses, the addresses that are present in any vehicle that I use.

But some vehicles carry more addresses if they are bigger and others less if they are smaller.

For example: A car only has 3 velocity addresses for each NS, UD and WE but a tank has 6 for each. These addresses are always coupled together. (I suspect that they are related to parts of the vehicle model which are responsible for physics effects, ie: tank hits a wall but his turret moves further due to cinetic energy, etc)

But that is not very important for now since the main address is sufficient as a starting point for all this adventure.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Fri Jul 19, 2013 12:25 pm    Post subject: Reply with quote

shadowpt wrote:
And those pointers have been stable since I found them, they are always there pointing to the right address everytime I am using a vehicle.

Great, pointer is stable in general (macro).

But what with micro (very short period of time).
What happens when you
- leave vehicle,
- you are a passenger


Can you launch game in window mode? If yes, go to CE settings, general settings, found address list update interval, and change it to 1. Place CE window so you can see "N / S" pointer (especially address and value columns ), go to game and use vehicle, leave vehicle, change map, go to main menu.

What you see? Does 'address' columns change very fast while entering to vehicle. Value is ?? while in main menu?


Example, if piece of code we hooked is called very often, like 300Hz (300 per second) and we use pointer which is 999 out of 1'000 good, our AA script can crash game after ~3,33 seconds.

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Fri Jul 19, 2013 12:37 pm    Post subject: Reply with quote

Nop, the address columns never change once I spawn a vehicle. I tried all you asked and no change.

And a few additional notes:

If I change map I lose my vehicle

If I exit the vehicle I can still control it like an RC car, using CE of course

If my vehicle is beyond the map rendering range then I cannot control it (basically once this happens the game is telling me that the vehicle does not exist anymore until it enters my rendering range again)


So does this mean that it is also stable in micro?

EDIT: It's as if once the vehicle is spawned and within range I can control it however I want with CE, even if I am not in the driver seat.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Fri Jul 19, 2013 12:42 pm    Post subject: Reply with quote

OK, last question. If you are in main menu, pointer just points to 00000000?

And just after map is loaded, it still points to 00000000 ?

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Fri Jul 19, 2013 12:45 pm    Post subject: Reply with quote

mgr.inz.Player wrote:
OK, last question. If you are in main menu, pointer just points to 00000000?

And just after map is loaded, it still points to 00000000 ?


If I am in main menu and I have a vehicle that belongs to me then it still points to the correct address (not 00000000)

After the map is loaded I have no vehicle so it points to 00000000
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Fri Jul 19, 2013 1:00 pm    Post subject: Reply with quote

I meant: in main menu just after you launch game, not the options/pause/inventory menu.

Never mind. I can try to make another AA script, today or tomorrow. I think, I'll use FPU.

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Fri Jul 19, 2013 1:06 pm    Post subject: Reply with quote

Oh I understand where you are trying to get, you want to see if it targets any other address that might cause conflict when being modified.

The answer is the same, from game launch till I get in it it always points to 00000000
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Fri Jul 19, 2013 3:38 pm    Post subject: Reply with quote

OK, see you tomorrow.
_________________
Back to top
View user's profile Send private message MSN Messenger
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Sat Jul 20, 2013 5:21 pm    Post subject: Reply with quote

Of course, there can be a typo, etc.
Test it. You can edit line 12,15,20.
Code:
[ENABLE]
alloc(UserValues,1024)
alloc(hack,1024)
label(retHere)
label(multiplyBy)
label(skip)
label(doNothing)
label(speedLimit)

UserValues:
multiplyBy:
dd (float)1.10   // speed multiplier

speedLimit:
dd (float)150.0  // speed limit


hack:
push ebx
mov ebx,[Game.exe+02A6F758]
test ebx,ebx
jz skip

mov ebx,[ebx+AC]
test ebx,ebx
jz skip

mov ebx,[ebx+3D8]
test ebx,ebx
jz skip

mov ebx,[ebx+0]
test ebx,ebx
jz skip

lea ebx,[ebx+60]          // we compare ebx+90 with eax+30, we can compare ebx+60 with eax as well
test ebx,ebx
jz skip

cmp eax,ebx
jne skip                  // not our vehicle


sub esp,20                  // prepare space
movdqu [esp],xmm1           // store xmm1
movdqu [esp+10],xmm2        // store xmm2

// now we can use xmm0,xmm1 and xmm2

movss xmm0,[multiplyBy]     // get multiply factor
shufps xmm0,xmm0,00

movups xmm1,[esi+00000094]  // get current delta vector
mulps xmm0,xmm1             // multiply delta vector by user value
// xmm0 keeps buffed delta vector

movups xmm1,[eax+30]        // get current speed vector
mulps xmm1,xmm1             // compute squares
movss xmm2,xmm1             // \
shufps xmm1,xmm1,09         //  \
addss xmm2,xmm1             //   calculate vector length
shufps xmm1,xmm1,09         //  /
addss xmm2,xmm1             // /
sqrtss xmm2,xmm2            ///

movlhps xmm2,xmm2           // store in high
// xmm2 (high) keeps original scalar speed

movups xmm1,[eax+30]        // get current speed vector
addps xmm1,xmm0             // and add buffed delta vector
mulps xmm1,xmm1             // compute squares
movss xmm2,xmm1             // \
shufps xmm1,xmm1,09         //  \
addss xmm2,xmm1             //   calculate vector length
shufps xmm1,xmm1,09         //  /
addss xmm2,xmm1             // /
sqrtss xmm1,xmm2            ///

movhlps xmm2,xmm2
// xmm1 (low) keeps buffed scalar speed
// xmm2 (low) keeps original scalar speed

comiss xmm1,xmm2             // compare new buffed speed with original speed
jb doNothing                 // if buffed is smaller, vehicle is slowing down. Do normally - do nothing!

comiss xmm1,[speedLimit]     // compare with limit
ja doNothing



movq [esi+00000094],xmm0    // store new delta
movhlps xmm0,xmm0
movss [esi+0000009C],xmm0

doNothing:
movdqu xmm1,[esp]           // restore xmm1
movdqu xmm2,[esp+10]        // restore xmm2
add esp,20

skip:
pop ebx
movss xmm0,[eax+30] //original code
jmp retHere


Phys_x86.dll+1D7C55:
jmp hack
retHere:

[DISABLE]
Phys_x86.dll+1D7C55:
db F3 0F 10 40 30

dealloc(hack)
dealloc(UserValues)

_________________
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Sat Jul 20, 2013 5:55 pm    Post subject: Reply with quote

That is amazing!

I just tried it and it crashes the game and I did replace the game.exe with the correct one.

I am not one to know this or comment the amazing coding you provided but it seems that it is affecting the opcodes that handle the deltas and addss opcodes but not the opcodes that handle the velocity, which are

Code:
movss [eax+30],xmm0
movss [eax+34],xmm0
movss [eax+38],xmm0


And just for the sake of organization I will paste the entire function again here in case it's necessary:

Code:
je Phys_x86.dll+1D7CB4
mov eax,[esi+40]
movss xmm0,[eax+30]
addss xmm0,[esi+00000094]
movss [eax+30],xmm0        <- This writes to the velocity pointer address that I have (NS)
movss xmm0,[esi+00000098]
addss xmm0,[eax+34]
movss [eax+34],xmm0        <- This writes to the velocity pointer address that I have (UD)
movss xmm0,[esi+0000009C]
addss xmm0,[eax+38]
movss [eax+38],xmm0        <- This writes to the velocity pointer address that I have (WE)
movss xmm0,[esi+000000A0]
addss xmm0,[eax+40]
movss [eax+40],xmm0
movss xmm0,[esi+000000A4]
addss xmm0,[eax+44]
movss [eax+44],xmm0
movss xmm0,[esi+000000A8]
addss xmm0,[eax+48]
movss [eax+48],xmm0
push 30



I have been trying to come up with the script for myself too, but... I am literally a noob, I am not aware of 99% of the opcodes that I can use and/or what each one does so I didn't get far.


EDIT: I have followed the jump once the script is activated (following a game crash) and this leads to what I assume to be the script function (game.exe has been edited here by my hand)

Code:
push ebx
mov ebx,[Game.exe+2A6F758]
test ebx,ebx
je 071E04EA
mov ebx,[ebx+000000AC]
test ebx,ebx
je 071E04EA
mov ebx,[ebx+000003D8]
test ebx,ebx
je 071E04EA
mov ebx,[ebx]
test ebx,ebx
je 071E04EA
lea ebx,[ebx+60]
test ebx,ebx
je 071E04EA
cmp eax,ebx
jne 071E04EA
sub esp,20
movdqu [esp],xmm1
movdqu [esp+10],xmm2
movss xmm0,[071E0000] : [3F8CCCCD]
shufps xmm0,xmm0,00
movups xmm1,[esi+00000094]
mulps xmm0,xmm1
movups xmm1,[eax+30]
mulps xmm1,xmm1
movss xmm2,xmm1
shufps xmm1,xmm1,09
addss xmm2,xmm1
shufps xmm1,xmm1,09
addss xmm2,xmm1
sqrtss xmm2,xmm2
lldt dx
movups xmm1,[eax+30]
addps xmm1,xmm0
mulps xmm1,xmm1
movss xmm2,xmm1
shufps xmm1,xmm1,09
addss xmm2,xmm1
shufps xmm1,xmm1,09
addss xmm2,xmm1
sqrtss xmm1,xmm2
movlps xmm2,xmm2
comiss xmm1,xmm2
jb 071E04DC
comiss xmm1,[071E0004] : [(float)150.0000]
ja 071E04DC
movq [esi+00000094],xmm0
movlps xmm0,xmm0
movss [esi+0000009C],xmm0
movdqu xmm1,[esp]
movdqu xmm2,[esp+10]
add esp,20
pop ebx
movss xmm0,[eax+30]
jmp Phys_x86.dll+1D7C5A


And this is the game function once the script is activated

Code:
je Phys_x86.dll+1D7CB4
mov eax,[esi+40]
movss xmm0,[eax+30]
addss xmm0,[esi+00000094]
jmp 071E0400                        <- This is the line being replaced
movss xmm0,[esi+00000098]
addss xmm0,[eax+34]
movss [eax+34],xmm0
movss xmm0,[esi+0000009C]
addss xmm0,[eax+38]
movss [eax+38],xmm0
movss xmm0,[esi+000000A0]
addss xmm0,[eax+40]
movss [eax+40],xmm0
movss xmm0,[esi+000000A4]
addss xmm0,[eax+44]
movss [eax+44],xmm0
movss xmm0,[esi+000000A8]
addss xmm0,[eax+48]
movss [eax+48],xmm0
push 30




In case you want to check if it is injecting correctly (if that is the correct term)

PS: I don't know if it is suppose to work this way but the script replaces
movss [eax+30],xmm0
but in the script the "//original code" line is
movss xmm0,[eax+30]

I just changed the address to the one pointing to movss xmm0,[eax+30] but still didn't work, game crashes once I activate the script. The address for movss xmm0,[eax+30] is Phys_x86.dll+1D7C48

Function with all the data that I can get

Code:
Phys_x86.dll+1D7C43 - 74 6F                 - je Phys_x86.dll+1D7CB4
Phys_x86.dll+1D7C45 - 8B 46 40              - mov eax,[esi+40]
Phys_x86.dll+1D7C48 - F3 0F10 40 30         - movss xmm0,[eax+30]
Phys_x86.dll+1D7C4D - F3 0F58 86 94000000   - addss xmm0,[esi+00000094]
Phys_x86.dll+1D7C55 - F3 0F11 40 30         - movss [eax+30],xmm0
Phys_x86.dll+1D7C5A - F3 0F10 86 98000000   - movss xmm0,[esi+00000098]
Phys_x86.dll+1D7C62 - F3 0F58 40 34         - addss xmm0,[eax+34]
Phys_x86.dll+1D7C67 - F3 0F11 40 34         - movss [eax+34],xmm0
Phys_x86.dll+1D7C6C - F3 0F10 86 9C000000   - movss xmm0,[esi+0000009C]
Phys_x86.dll+1D7C74 - F3 0F58 40 38         - addss xmm0,[eax+38]
Phys_x86.dll+1D7C79 - F3 0F11 40 38         - movss [eax+38],xmm0
Phys_x86.dll+1D7C7E - F3 0F10 86 A0000000   - movss xmm0,[esi+000000A0]
Phys_x86.dll+1D7C86 - F3 0F58 40 40         - addss xmm0,[eax+40]
Phys_x86.dll+1D7C8B - F3 0F11 40 40         - movss [eax+40],xmm0
Phys_x86.dll+1D7C90 - F3 0F10 86 A4000000   - movss xmm0,[esi+000000A4]
Phys_x86.dll+1D7C98 - F3 0F58 40 44         - addss xmm0,[eax+44]
Phys_x86.dll+1D7C9D - F3 0F11 40 44         - movss [eax+44],xmm0
Phys_x86.dll+1D7CA2 - F3 0F10 86 A8000000   - movss xmm0,[esi+000000A8]
Phys_x86.dll+1D7CAA - F3 0F58 40 48         - addss xmm0,[eax+48]
Phys_x86.dll+1D7CAF - F3 0F11 40 48         - movss [eax+48],xmm0
Phys_x86.dll+1D7CB4 - 6A 30                 - push 30
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 218

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Sat Jul 20, 2013 6:39 pm    Post subject: Reply with quote

Ok, we will test pointer only (this script shouldn't change anything)
And of course, replace game.exe

1:50 AM here, I go to sleep.

Code:
[ENABLE]
alloc(testing,1024)
label(retHere)
label(skip)

testing:
push ebx
mov ebx,[Game.exe+02A6F758]
test ebx,ebx
jz skip

mov ebx,[ebx+AC]
test ebx,ebx
jz skip

mov ebx,[ebx+3D8]
test ebx,ebx
jz skip

mov ebx,[ebx+0]

skip:
pop ebx
movss xmm0,[eax+30] //original code
jmp retHere

Phys_x86.dll+1D7C48:
jmp hack
retHere:

[DISABLE]
Phys_x86.dll+1D7C48:
db F3 0F 10 40 30

dealloc(testing)



EDIT:
yes, jmp testing

_________________


Last edited by mgr.inz.Player on Sun Jul 21, 2013 2:57 am; edited 1 time in total
Back to top
View user's profile Send private message MSN Messenger
shadowpt
Advanced Cheater
Reputation: 0

Joined: 04 Jun 2011
Posts: 82

PostPosted: Sat Jul 20, 2013 7:04 pm    Post subject: Reply with quote

I modified the "jmp hack" to "jmp testing" because you might have forgot that one. I can activate and deactivate that script and the game doesn't crash so the pointer is correct.

You help if you want and when you can, I got no hurry on this and you have been a great person helping me this far. We will continue this next time.

I have also ran the vector calculations to see which was the correct one and yours is the correct one : sqrt(x^2 +y^2 + z^2) mine isn't.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8  Next
Page 7 of 8

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites