Cheat Engine

lp0 · Posted: Fri Aug 02, 2013 4:34 pm Post subject: Game reads my aobscan?

This is more of just making sure I am not insane as I have a basic/general understanding of how these things work, but as with all complicated technical topics the rabbit hole goes very deep.

Anyway .. to the point. I'm not looking for anyone to hold my hand, just to sort of point me in the right direction about what may or may not be going on here, and possibly validating or invalidating my current theory.

I'm messing around with a certain game, writing an assembler script using aobscan, and the first time you run it, it works fine - however, after that, the game appears to load the byte pattern being scanned for into a separate (but always earlier) memory location so that if the script is run again, it injects into the new earlier point rather than the later point for the routine the game actually uses.

First, is this possible or am I making something out of this that it is not?

Second, if it is possible, can I get around this?

I've thought that when I mess with it next time I will inject to a different routine in memory, but that sort of begs the question that the game might just trap that and any code injection I do.

If it helps, as far as I can tell the game is built on Mono/Unity.

Gniarf · Posted: Fri Aug 02, 2013 5:50 pm Post subject: Re: Game reads my aobscan?

lp0 · Posted: Fri Aug 02, 2013 6:18 pm Post subject:

I've written several scripts to test the theory as it were, and every time the first search is unique and works, and the second (and after) times the game always somehow produces another copy I never found before; and if I fiddle with it I can get it to generate a third copy, a fourth copy, so on and so forth.

The "new" code is sitting in the middle of memory just surround by a whole set of push statements, with no difference; just a set of 30 of the same push statements, with the aobscan pattern inserted at some arbitrary point in that set.

I looked into stealthedit and sort of drew the same conclusion; I am more apt to do the LUA approach just to test the theory and try to trim the actual cause of it down.

The dealloc is there; now that I think about it I will fiddle around with an offset jump instead of aobscan. If there is no aobscan and it is just a jump, and it works repeatedly then, I can sort of use that in conjunction with the LUA approach to say "yes, this is really what is happening."

Thanks.

edit: The offset jump does work repeatedly every time; very strange. I'll move to LUA and overwrite all the results. In the event the LUA approach works, I will maybe put something up regarding the game and my findings so people can look at it; it's possible I am just being stupid.

edit 2: Turns out the game had updated several times behind my back, each time while I was doing testing. A run of bad luck - lesson learned I suppose.

Gniarf · Posted: Fri Aug 02, 2013 9:18 pm Post subject:

lp0 · Posted: Fri Aug 02, 2013 9:32 pm Post subject:

Gniarf · Posted: Sat Aug 03, 2013 3:56 am Post subject:

I would have had a lot of wtf? on my head too after your experiments.
Now that the script work, are you sure that there is no copy of the code in memory (which, this time, would luckily be in higher memory than the executed code)?

Thinking again about it, you said earlier that the copy code was surrounded by push statements, I take it the game copies the whole function, so maybe you could have included some of the inter-function-padding in your aob (still, you probably already thought about this, so what's wrong with it?).

Dark Byte · Posted: Sat Aug 03, 2013 4:46 am Post subject:

mono is an emulator. This means it takes the original native code and when a function is executed for the first time, it converts it a code the system accepts, and might eventually free that runtime generated code if you're low on memory and it hasn't been executed in a while.

If there is a memory leak of some sorts, where it forgets to free, or clean previously allocated memory, the old runtime generated code will still be in memory.
Best way to get around this problem is just edit every occasion of the aob you find

also, mono exports some functions you may be able to call to get the address of a specific method. And if not, https://github.com/Unity-Technologies contains the mono sourcecode for unity, so you may even add that export yourself. (or build it so it auto generates the code immediately and never frees it)