 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Sohail__Saha Advanced Cheater
Reputation: 0
Joined: 21 May 2014 Posts: 82 Location: India
|
Posted: Mon Jun 30, 2014 5:12 am Post subject: How to use AOB option?? |
|
|
How to use this feature..>
[/img] _________________
Don't underestimate the power of a common code.
 |
|
| Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Mon Jun 30, 2014 7:24 am Post subject: |
|
|
The aob injection ? Oh its this new template in CE 6.4 just like the code injection template but instead for aobscans.
Just give the address where you want to jump from your code, a name for the aobscan found address (game code) and CE takes cares of the rest. It was requested a lot and i am so glad to see DB finally made it.
I find the bytes it grabs for aobscan are not sufficient enough to be unique (it only grabs 6 bytes) but thats because i like my signatures(or aobs as some people call it) to be lengthier. You can easily copy paste more bytes though so i am not complaining. The writing of alloc/aobscan() was tiring in previous versions and this template takes care of that nicely. _________________
|
|
| Back to top |
|
 |
Sohail__Saha Advanced Cheater
Reputation: 0
Joined: 21 May 2014 Posts: 82 Location: India
|
Posted: Mon Jun 30, 2014 1:11 pm Post subject: |
|
|
Can you give an example  _________________
Don't underestimate the power of a common code.
 |
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Mon Jun 30, 2014 2:42 pm Post subject: |
|
|
| STN wrote: | | I find the bytes it grabs for aobscan are not sufficient enough to be unique |
Are you sure? I don't have the code in front of me at the moment, but I was thinking that template had internal routines that checked for and generated unique aobscans. _________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 30, 2014 2:48 pm Post subject: |
|
|
| Yes, they are unique in 6.4. |
|
| Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Tue Jul 01, 2014 1:20 pm Post subject: |
|
|
I can bet my ex-girlfriends crabs ridden snatch on it that i am 100% right.
I highly doubt there are any internal routines that checked for and generated unique aobscans but if there are, thats a big fail on DB's part because they are dumb as shit
This is a sample aob CE generated
E8 7A F6 FF FF 90
translates to
call 00418960
Another sample one it generated
48 8B 88 A0 00 00 00 8B 47
translates to
mov rcx,[rax+000000A0]
I just find it very offensive when someone tries to insult my intelligence. I mean i have written a tutorial on signatures way before they were known around these parts as aobs
http://deviatedhacking.com/index.php/topic/197-how-to-update-your-trainers-real-quick-and-easy/
So i know a unique signature and a poor one when i see one and so far CE hasn't generated a good enough one yet but thats because its just a template and no internal check or that shit is done.
I just wish people would stop speaking from their assess but i also wish for a lot of things and none come true, like my girl would let me do that thing but alas, that is only ever going to happen in my imagination or there were no taxes...ah the list goes on and on.
Now to go back to the thread:
@Sohail__Saha: Do you even know aob/signature scanning is ? if you don't give that thread i linked a read, once you understand what it is then you will easily understand what the function does.[/b] _________________
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Tue Jul 01, 2014 2:36 pm Post subject: |
|
|
| STN wrote: | I find the bytes it grabs for aobscan are not sufficient enough to be unique (it only grabs 6 bytes)
I can bet my ex-girlfriends crabs ridden snatch on it that i am 100% right.
I highly doubt there are any internal routines that checked for and generated unique aobscans | -You're wrong, I'm afraid. |
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Tue Jul 01, 2014 3:10 pm Post subject: |
|
|
| STN wrote: | I can bet my ex-girlfriends crabs ridden snatch on it that i am 100% right.
I highly doubt there are any internal routines that checked for and generated unique aobscans but if there are, thats a big fail on DB's part because they are dumb as shit
...
I just find it very offensive when someone tries to insult my intelligence. I mean i have written a tutorial on signatures way before they were known around these parts as aobs
...
I just wish people would stop speaking from their assess
...
|
Dunno' if there's something wrong with you or you just got out of bed on the wrong side or what, but that's out of line. Don't be a pricktard.
The code in question is around here (TfrmAutoInject.GetUniqueAOB). I'm not sure if it's part of the stuff JOEGrmat donated or if it is DB's work, but I'm pretty sure that its goal is to ensure that the template AoBscans are unique. If it can't find a unique AoBscan, it should print out an error ("ERROR: Could not find unique AOB, tried code [(your aob)]"). If you can document a case where it isn't working this way, please contribute a fix or supply an example for those who are able. _________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Tue Jul 01, 2014 3:28 pm Post subject: |
|
|
I gave an example in my post already
This is a sample aob CE generated
E8 7A F6 FF FF 90
translates to
call 00418960
So yeah maybe there are checks but my second part still stands. Dumb as shit. But its alright because it is a tool and has no brain.
I am not going to argue anymore if you think that is unique because then apparently we seem to working on a completely different level, the retarded and the smart level and you know which level you are on.
I have been once told by DB that i can be a prick/asshole and since this was a direct attack on a statement i made, i am using that right. Fuck off dumb shit _________________
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Tue Jul 01, 2014 5:46 pm Post subject: |
|
|
It is still useful feature. I myself unconsciously choose most suitable injection point. So, not on "calls", not at the end of function ("pop ebp; ret").
In many cases it is accurate. At least for me.
| STN wrote: | Another sample one it generated
48 8B 88 A0 00 00 00 8B 47
translates to
mov rcx,[rax+000000A0]
|
What's wrong with this?
If you want to know more about how this template works, read this thread:
http://forum.cheatengine.org/viewtopic.php?t=566415 _________________
Last edited by mgr.inz.Player on Tue Jul 01, 2014 5:49 pm; edited 1 time in total |
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Tue Jul 01, 2014 6:29 pm Post subject: |
|
|
Nice link, thanks. I'd forgotten that you can use the reassemble command to make use of hack points that use relative addressing, like the call example above. _________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
 |
Sohail__Saha Advanced Cheater
Reputation: 0
Joined: 21 May 2014 Posts: 82 Location: India
|
Posted: Wed Jul 02, 2014 4:27 am Post subject: |
|
|
Guys, stop quarrelling. And by the way, can I change a value immediately with AOBS?? ( I hope not ) _________________
Don't underestimate the power of a common code.
 |
|
| Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Wed Jul 02, 2014 1:26 pm Post subject: |
|
|
| mgr.inz.Player wrote: | It is still useful feature. I myself unconsciously choose most suitable injection point. So, not on "calls", not at the end of function ("pop ebp; ret").
In many cases it is accurate. At least for me.
| STN wrote: | Another sample one it generated
48 8B 88 A0 00 00 00 8B 47
translates to
mov rcx,[rax+000000A0]
|
What's wrong with this?
If you want to know more about how this template works, read this thread:
http://forum.cheatengine.org/viewtopic.php?t=566415 |
I have a half mind to even respond to this thread now that justa_dude has started acting like a little bitch pussy attacking me all over the forums but i guess thats what some people do when they get threatened.
Anyway mgr.inz.Player, as you can see the call aob is not unique because come next game patch you really think that call is going to be like that ?.
My site is scam and i have made a lot of trojans (according to justa_dude) and in my experience of making close to hundreds of trojans and teaching people how to make them, in fact anyone who has made one trojan and updated it would know that that call is not a good aob.
The other one
48 8B 88 A0 00 00 00 8B 47
is decent but again, its not a unique aob at all if you consider various patches the game is going to have. In the various trojans i made for borderlands 2 and game in famous for a lot of patches that aob is not even close to unique.
Of course if you mean in current running process/version of the game the aob maybe unique but is that the point of aob ?.
I said it in my first post already, i love the template because it saves me a lot of time but the aob it generates are not unique enough to withstand various game patches but thats understandable.
PS: Sorry for the you know what in my post above but i am really passionate about scamming people and my trojans and i just lose tamper when someone attacks my scamming site. _________________
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Jul 02, 2014 4:38 pm Post subject: |
|
|
| STN wrote: | | Anyway mgr.inz.Player, as you can see the call aob is not unique because come next game patch you really think that call is going to be like that? |
I never said that doing "aob injection" on "CALL rel32" is a good idea. Of course it can break on next game update or even next game launch.
Look, if you need hack point at "call XXXXXXXX" you can not use CE's "code injection". Or the new "aob injection" or "full injection" (added in CE6.3+, few days after releasing CE6.3, and added officially in CE6.4). You have to do it yourself, and with reassemble command. Or if it is changing offset, "label trick" is enough.
Those templates are for common scenarios, mov [ecx],eax or something like that. The same with trainer generator, it is for most common scenarios.
Example, MaxPayne3, bullets in clip:
mov [esi+eax*4+40],ecx
My first script looked like this, it allows to decrease, but not below 5:
| Code: | aobscan(bulletscodeAOB, 89 4C 86 40 5E C2)
bulletscodeAOB:
jmp newmem
returnhere:
newmem:
mov [esi+eax*4+40],ecx
cmp [esi+eax*4+40],5
jge +5
mov byte ptr [esi+eax*4+40],5
pop esi
jmp returnhere |
After game update, I figured out that 40 changed to 44. I used mask (signature was still unique) and some trick. New script:
| Code: | aobscan(bulletscodeAOB, 89 4C 86 xx 5E C2)
[bulletscodeAOB+3]:
changingOffset:
bulletscodeAOB:
jmp newmem
returnhere:
newmem:
//mov [esi+eax*4+44],ecx
db 89 4C 86 changingOffset
//cmp [esi+eax*4+44],5
db 80 7C 86 changingOffset 05
jge +5
//mov byte ptr [esi+eax*4+44],5
db C6 44 86 changingOffset 05
pop esi
jmp returnhere |
_________________
|
|
| Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Wed Jul 02, 2014 6:06 pm Post subject: |
|
|
| mgr.inz.Player wrote: | | STN wrote: | | Anyway mgr.inz.Player, as you can see the call aob is not unique because come next game patch you really think that call is going to be like that? |
I never said that doing "aob injection" on "CALL rel32" is a good idea. Of course it can break on next game update or even next game launch.
Look, if you need hack point at "call XXXXXXXX" you can not use CE's "code injection". Or the new "aob injection" or "full injection" (added in CE6.3+, few days after releasing CE6.3, and added officially in CE6.4). You have to do it yourself, and with reassemble command. Or if it is changing offset, "label trick" is enough.
Those templates are for common scenarios, mov [ecx],eax or something like that. The same with trainer generator, it is for most common scenarios.
Example, MaxPayne3, bullets in clip:
mov [esi+eax*4+40],ecx
My first script looked like this, it allows to decrease, but not below 5:
| Code: | aobscan(bulletscodeAOB, 89 4C 86 40 5E C2)
bulletscodeAOB:
jmp newmem
returnhere:
newmem:
mov [esi+eax*4+40],ecx
cmp [esi+eax*4+40],5
jge +5
mov byte ptr [esi+eax*4+40],5
pop esi
jmp returnhere |
After game update, I figured out that 40 changed to 44. I used mask (signature was still unique) and some trick. New script:
| Code: | aobscan(bulletscodeAOB, 89 4C 86 xx 5E C2)
[bulletscodeAOB+3]:
changingOffset:
bulletscodeAOB:
jmp newmem
returnhere:
newmem:
//mov [esi+eax*4+44],ecx
db 89 4C 86 changingOffset
//cmp [esi+eax*4+44],5
db 80 7C 86 changingOffset 05
jge +5
//mov byte ptr [esi+eax*4+44],5
db C6 44 86 changingOffset 05
pop esi
jmp returnhere |
|
You are preaching to the choir, mate. Thats what i said in my first post.
Perhaps you have missed it but after my argument justa_dude started attacking me in other threads calling my site scam which heh...itself has been around more than he has and my trainers trojans. Thats very childish to say the least.
Like you said yourself the offsets change, if you give the tutorial i linked to a read i have explained not every signature can be considered a good signature. Take this trainer of mine
http://deviatedhacking.com/index.php/topic/895-plants-vs-zombies-goty-all-versions-plus-3-trainer/
It has stood so many versions for a good 3 years until the recent origin patch (a very big one), simply because i used a good signature.
So maybe i wasn't clear enough but i was assuming i was between people who knew shit rather than wanna-be or idiots who can't read, guess i was wrong. Because this is what i said
| Quote: | | I highly doubt there are any internal routines that checked for and generated unique aobscans but if there are, thats a big fail on DB's part because they are dumb as shit |
Yes they are dumb as shit, you just agreed on that with me right now.
I am basically repeating myself now at this point so i think i have made my case. I am off to sell malware...wohoo for me _________________
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|