Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Need help with AOB scan
Goto page Previous  1, 2, 3
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Mon Jul 27, 2015 5:47 pm    Post subject: Reply with quote

When you do an aobscan for those compare bytes, you still aren't able to activate the script?

Code:
[ENABLE]
aobscan(myaob,00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F)
registersymbol(myaob)
[DISABLE]
unregistersymbol(myaob)


1. Right-click "movq [eax+00000090],xmm0" and select Find out what addresses this instruction accesses.
2. Go back in game and do some stuff that changes various values in-game.
3. See if anything other than the one address you originally found appears in the list.
4. If it is the only address, select "movq [eax+00000090],xmm0" and press CTRL-A.
5. From the menu, select Template > AOB Injection.
6. Accept all the defaults.
7. Copy and paste that script here.
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Tue Jul 28, 2015 12:08 pm    Post subject: Reply with quote

No, I couldn't active the script you sended.

I got a bit confused by the instructions you told me. At point 1 I couldn't right click it also I was already in the window "Find out what writes to this address".
At point 4 I thought u ment copying althought I couldn't selected it, so I guess I'm at some wrong window there.

Anyways this was the findings of what writes to this address with the following script below:
movq [eax+00000090,xmm0
The value of the pointer needed to find this address is probably 0B2DD5C4

Code:
{ Game   : Offspring Fling.exe
  Version:
  Date   : 2015-07-28
  Author : Jan24

  This script does blah blah blah
}

[ENABLE]

aobscan(INJECT,0D 00 00 20 A0) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:

code:
  or eax,A0200000
  jmp return

INJECT:
  jmp code
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 0D 00 00 20 A0

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 0B2DD5C4

0B2DD5B1: 00 00                 -  add [eax],al
0B2DD5B3: 00 00                 -  add [eax],al
0B2DD5B5: 00 00                 -  add [eax],al
0B2DD5B7: 00 00                 -  add [eax],al
0B2DD5B9: 00 00                 -  add [eax],al
0B2DD5BB: 00 00                 -  add [eax],al
0B2DD5BD: 00 00                 -  add [eax],al
0B2DD5BF: 00 68 EB              -  add [eax-15],ch
0B2DD5C2: 3F                    -  aas
0B2DD5C3: 10 0D 00 00 20        - db 10 0D 00 00 20  // SHORTENED TO HIT INJECTION FROM:  adc [A0200000],cl
// ---------- INJECTING HERE ----------
0B2DD5C8: A0 D0 AA 12 58        -  mov ax,[5812AAD0]
// ---------- DONE INJECTING  ----------
0B2DD5CD: 03 CD                 -  add ecx,ebp
0B2DD5CF: 10 00                 -  adc [eax],al
0B2DD5D1: 00 00                 -  add [eax],al
0B2DD5D3: 00 01                 -  add [ecx],al
0B2DD5D5: 00 00                 -  add [eax],al
0B2DD5D7: 00 02                 -  add [edx],al
0B2DD5D9: 00 00                 -  add [eax],al
0B2DD5DB: 00 01                 -  add [ecx],al
0B2DD5DD: 00 00                 -  add [eax],al
0B2DD5DF: 00 00                 -  add [eax],al
}
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Tue Jul 28, 2015 4:35 pm    Post subject: Reply with quote

Select "movq [eax+00000090],xmm0"
Select Tools > Auto Assemble (or press CTRL-A)
Select Template > AOB Injection
Click OK twice
Paste that code here
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Wed Jul 29, 2015 9:21 am    Post subject: Reply with quote

Code:
{ Game   : Offspring Fling.exe
  Version:
  Date   : 2015-07-29
  Author : Jan24

  This script does blah blah blah
}

[ENABLE]

aobscan(INJECT,66 0F D6 80 90 00 00 00 8B 95) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:

code:
  movq [eax+00000090],xmm0
  jmp return

INJECT:
  jmp code
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 66 0F D6 80 90 00 00 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 1285D1DC

1285D1B9: 8B E5                    -  mov esp,ebp
1285D1BB: 5D                       -  pop ebp
1285D1BC: C3                       -  ret
1285D1BD: 8B 45 B8                 -  mov eax,[ebp-48]
1285D1C0: F3 0F 7E 80 90 00 00 00  -  movq xmm0,[eax+00000090]
1285D1C8: 8B 95 78 FF FF FF        -  mov edx,[ebp-00000088]
1285D1CE: 66 0F 57 C9              -  xorpd xmm1,xmm1
1285D1D2: F2 0F 2A CA              -  cvtsi2sd xmm1,edx
1285D1D6: F2 0F 58 C1              -  addsd xmm0,xmm1
1285D1DA: EB 00                    -  jmp 1285D1DC
// ---------- INJECTING HERE ----------
1285D1DC: 66 0F D6 80 90 00 00 00  -  movq [eax+00000090],xmm0
// ---------- DONE INJECTING  ----------
1285D1E4: 8B 95 60 FF FF FF        -  mov edx,[ebp-000000A0]
1285D1EA: 89 95 2C FF FF FF        -  mov [ebp-000000D4],edx
1285D1F0: EB 00                    -  jmp 1285D1F2
1285D1F2: 8B 82 F8 00 00 00        -  mov eax,[edx+000000F8]
1285D1F8: 89 85 24 FF FF FF        -  mov [ebp-000000DC],eax
1285D1FE: 8D 89 48 05 00 00        -  lea ecx,[ecx+00000548]
1285D204: 8D 95 50 FF FF FF        -  lea edx,[ebp-000000B0]
1285D20A: E8 DF C0 D0 FC           -  call "Adobe AIR.dll"+4D92EE
1285D20F: 8B 95 2C FF FF FF        -  mov edx,[ebp-000000D4]
1285D215: 8B C8                    -  mov ecx,eax
}
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Wed Jul 29, 2015 5:32 pm    Post subject: Reply with quote

I've lost track of what it is we were trying to accomplish here. Smile

Code:
[ENABLE]
aobscan(myaob,66 0F D6 80 90 00 00 00 8B 95)
alloc(newmem,$1000)
alloc(mypointer,4)

label(code)
label(return)

newmem:

code:
  mov [mypointer],eax
  movq [eax+00000090],xmm0
  jmp return

myaob:
  jmp code
  nop
  nop
  nop
return:
registersymbol(myaob)
registersymbol(mypointer)

[DISABLE]
myaob:
  db 66 0F D6 80 90 00 00 00
unregistersymbol(myaob)
unregistersymbol(mypointer)
dealloc(newmem)
dealloc(mypointer)


Add a pointer to your table with the base address "mypointer".
The first offset may need to be "90" to get to the address you want.
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Thu Jul 30, 2015 7:11 am    Post subject: Reply with quote

Okay what I try to do:

Game: Offspring Fling!
Version: Steam version
Cheat: No-clip

For this I'm trying to get the base address on some sort of way of the Y-cords.
This can maybe be done through a AOB scan.
The Y-cords address keeps changing at each level and when restarting the game.

I still see myself as a beginner and don't know much of assambling yet.
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Thu Jul 30, 2015 9:50 am    Post subject: Reply with quote

And the results of implementing my script?
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Thu Jul 30, 2015 2:49 pm    Post subject: Reply with quote

Your script can be activated, although nothing happens after that.
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Thu Jul 30, 2015 3:45 pm    Post subject: Reply with quote

Did you add a pointer to the address "mypointer" like I stated?
Try it both with an offset of "90" or "0" depending on the address you're expecting.
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Thu Jul 30, 2015 4:27 pm    Post subject: Reply with quote

I'm new to assambling so here is what I tried:
Code:
[ENABLE]

aobscan(INJECT,66 0F D6 80 90 00 00 00 8B 95) // should be unique
alloc(newmem,$1000)
alloc(mypointer,00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F)

label(code)
label(return)

newmem:

code:
  mov [mypointer+00000090],eax
  movq [eax+00000090],xmm0
  jmp return

INJECT:
  jmp code
  nop
  nop
  nop
return:
registersymbol(INJECT)
registersymbol(mypointer)

[DISABLE]

INJECT:
  db 66 0F D6 80 90 00 00 00

unregistersymbol(INJECT)
unregistersymbol(mypointer)
dealloc(newmem)
dealloc(mypointer)


When I try to assign it to the cheat table I get the following error:
Code:
Not all code is injectable.
(Error in line 13(alloc(mypointer,00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F)) :"00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F" is an invalid integer)
Are you sure you wan't to edit it to this?


I probably did something wrong, it's just since I'm totally new to assambling it's hard for me to find the issue.
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278

PostPosted: Thu Jul 30, 2015 4:31 pm    Post subject: Reply with quote

Activate my previous script.
Copy the following, go to your table, and press CTRL-V to paste.
Go in game and move or whatever to cause it to change the address you're hacking.
Did the addresses you pasted update to something meaningful?

Code:
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>0</ID>
      <Description>"No description"</Description>
      <LastState Value="??" Activated="0" RealAddress="300905A4D"/>
      <ShowAsHex>1</ShowAsHex>
      <Color>80000008</Color>
      <VariableType>4 Bytes</VariableType>
      <Address>mypointer</Address>
      <Offsets>
        <Offset>0</Offset>
      </Offsets>
    </CheatEntry>
    <CheatEntry>
      <ID>1</ID>
      <Description>"No description"</Description>
      <LastState Value="??" Activated="0" RealAddress="300905ADD"/>
      <Color>80000008</Color>
      <VariableType>Double</VariableType>
      <Address>mypointer</Address>
      <Offsets>
        <Offset>90</Offset>
      </Offsets>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Fri Jul 31, 2015 5:24 am    Post subject: Reply with quote

Nice that seems to work, now I wonder how you did that.
I see you added a few lines, could you maybe explain those to me ?
And how did you find the pointer (real address) ?

Now that I got the Y-cords I wanna try to make a noclip.
I am trying to do this by implanting the script of a other side scrolling game (140), see post here http://forum.cheatengine.org/viewtopic.php?p=5598969

Add .ct file to make it a bit easier to view.



offspringfling.ct
 Description:

Download
 Filename:  offspringfling.ct
 Filesize:  5.02 KB
 Downloaded:  476 Time(s)

Back to top
View user's profile Send private message
Rydian
Grandmaster Cheater Supreme
Reputation: 31

Joined: 17 Sep 2012
Posts: 1358

PostPosted: Fri Jul 31, 2015 6:30 am    Post subject: Reply with quote

Zanzer's script allocates 4 bytes for an address with a specific name/label. Assuming a 32-bit program without >4GB of RAM usage, 4 bytes is all that's needed for an address.

He then inserted "mov [mypointer],eax" to copy the base address of the structure into the allocated memory. He's copying just the base address because it's simpler that way (opposed to copying the base+offset), and makes things easier when you're working with multiple values in the same structure.

And the registersymbol() is to make that label work as a variable of sorts for the table itself to use. That's why after that script runs, you can add an address or pointer that uses that value as a base, for example. And the table knows what the value is.

_________________
Back to top
View user's profile Send private message
jan24
Cheater
Reputation: 0

Joined: 12 Jul 2013
Posts: 34

PostPosted: Fri Jul 31, 2015 9:02 am    Post subject: Reply with quote

Thanks for the explanation Smile
It's still looks like a bit of magic for me but it works like a charm.
After this I thought adding the noclip would be easy but it's harder then I thought hehe.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page Previous  1, 2, 3
Page 3 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites