 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Mon Jul 27, 2015 5:47 pm Post subject: |
|
|
When you do an aobscan for those compare bytes, you still aren't able to activate the script?
| Code: | [ENABLE]
aobscan(myaob,00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F)
registersymbol(myaob)
[DISABLE]
unregistersymbol(myaob) |
1. Right-click "movq [eax+00000090],xmm0" and select Find out what addresses this instruction accesses.
2. Go back in game and do some stuff that changes various values in-game.
3. See if anything other than the one address you originally found appears in the list.
4. If it is the only address, select "movq [eax+00000090],xmm0" and press CTRL-A.
5. From the menu, select Template > AOB Injection.
6. Accept all the defaults.
7. Copy and paste that script here.
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Tue Jul 28, 2015 12:08 pm Post subject: |
|
|
No, I couldn't active the script you sended.
I got a bit confused by the instructions you told me. At point 1 I couldn't right click it also I was already in the window "Find out what writes to this address".
At point 4 I thought u ment copying althought I couldn't selected it, so I guess I'm at some wrong window there.
Anyways this was the findings of what writes to this address with the following script below:
movq [eax+00000090,xmm0
The value of the pointer needed to find this address is probably 0B2DD5C4
| Code: | { Game : Offspring Fling.exe
Version:
Date : 2015-07-28
Author : Jan24
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,0D 00 00 20 A0) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
or eax,A0200000
jmp return
INJECT:
jmp code
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 0D 00 00 20 A0
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 0B2DD5C4
0B2DD5B1: 00 00 - add [eax],al
0B2DD5B3: 00 00 - add [eax],al
0B2DD5B5: 00 00 - add [eax],al
0B2DD5B7: 00 00 - add [eax],al
0B2DD5B9: 00 00 - add [eax],al
0B2DD5BB: 00 00 - add [eax],al
0B2DD5BD: 00 00 - add [eax],al
0B2DD5BF: 00 68 EB - add [eax-15],ch
0B2DD5C2: 3F - aas
0B2DD5C3: 10 0D 00 00 20 - db 10 0D 00 00 20 // SHORTENED TO HIT INJECTION FROM: adc [A0200000],cl
// ---------- INJECTING HERE ----------
0B2DD5C8: A0 D0 AA 12 58 - mov ax,[5812AAD0]
// ---------- DONE INJECTING ----------
0B2DD5CD: 03 CD - add ecx,ebp
0B2DD5CF: 10 00 - adc [eax],al
0B2DD5D1: 00 00 - add [eax],al
0B2DD5D3: 00 01 - add [ecx],al
0B2DD5D5: 00 00 - add [eax],al
0B2DD5D7: 00 02 - add [edx],al
0B2DD5D9: 00 00 - add [eax],al
0B2DD5DB: 00 01 - add [ecx],al
0B2DD5DD: 00 00 - add [eax],al
0B2DD5DF: 00 00 - add [eax],al
} |
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Tue Jul 28, 2015 4:35 pm Post subject: |
|
|
Select "movq [eax+00000090],xmm0"
Select Tools > Auto Assemble (or press CTRL-A)
Select Template > AOB Injection
Click OK twice
Paste that code here
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Wed Jul 29, 2015 9:21 am Post subject: |
|
|
| Code: | { Game : Offspring Fling.exe
Version:
Date : 2015-07-29
Author : Jan24
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,66 0F D6 80 90 00 00 00 8B 95) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
movq [eax+00000090],xmm0
jmp return
INJECT:
jmp code
nop
nop
nop
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 66 0F D6 80 90 00 00 00
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 1285D1DC
1285D1B9: 8B E5 - mov esp,ebp
1285D1BB: 5D - pop ebp
1285D1BC: C3 - ret
1285D1BD: 8B 45 B8 - mov eax,[ebp-48]
1285D1C0: F3 0F 7E 80 90 00 00 00 - movq xmm0,[eax+00000090]
1285D1C8: 8B 95 78 FF FF FF - mov edx,[ebp-00000088]
1285D1CE: 66 0F 57 C9 - xorpd xmm1,xmm1
1285D1D2: F2 0F 2A CA - cvtsi2sd xmm1,edx
1285D1D6: F2 0F 58 C1 - addsd xmm0,xmm1
1285D1DA: EB 00 - jmp 1285D1DC
// ---------- INJECTING HERE ----------
1285D1DC: 66 0F D6 80 90 00 00 00 - movq [eax+00000090],xmm0
// ---------- DONE INJECTING ----------
1285D1E4: 8B 95 60 FF FF FF - mov edx,[ebp-000000A0]
1285D1EA: 89 95 2C FF FF FF - mov [ebp-000000D4],edx
1285D1F0: EB 00 - jmp 1285D1F2
1285D1F2: 8B 82 F8 00 00 00 - mov eax,[edx+000000F8]
1285D1F8: 89 85 24 FF FF FF - mov [ebp-000000DC],eax
1285D1FE: 8D 89 48 05 00 00 - lea ecx,[ecx+00000548]
1285D204: 8D 95 50 FF FF FF - lea edx,[ebp-000000B0]
1285D20A: E8 DF C0 D0 FC - call "Adobe AIR.dll"+4D92EE
1285D20F: 8B 95 2C FF FF FF - mov edx,[ebp-000000D4]
1285D215: 8B C8 - mov ecx,eax
} |
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Wed Jul 29, 2015 5:32 pm Post subject: |
|
|
I've lost track of what it is we were trying to accomplish here.
| Code: | [ENABLE]
aobscan(myaob,66 0F D6 80 90 00 00 00 8B 95)
alloc(newmem,$1000)
alloc(mypointer,4)
label(code)
label(return)
newmem:
code:
mov [mypointer],eax
movq [eax+00000090],xmm0
jmp return
myaob:
jmp code
nop
nop
nop
return:
registersymbol(myaob)
registersymbol(mypointer)
[DISABLE]
myaob:
db 66 0F D6 80 90 00 00 00
unregistersymbol(myaob)
unregistersymbol(mypointer)
dealloc(newmem)
dealloc(mypointer) |
Add a pointer to your table with the base address "mypointer".
The first offset may need to be "90" to get to the address you want.
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Thu Jul 30, 2015 7:11 am Post subject: |
|
|
Okay what I try to do:
Game: Offspring Fling!
Version: Steam version
Cheat: No-clip
For this I'm trying to get the base address on some sort of way of the Y-cords.
This can maybe be done through a AOB scan.
The Y-cords address keeps changing at each level and when restarting the game.
I still see myself as a beginner and don't know much of assambling yet.
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Jul 30, 2015 9:50 am Post subject: |
|
|
| And the results of implementing my script?
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Thu Jul 30, 2015 2:49 pm Post subject: |
|
|
| Your script can be activated, although nothing happens after that.
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Jul 30, 2015 3:45 pm Post subject: |
|
|
Did you add a pointer to the address "mypointer" like I stated?
Try it both with an offset of "90" or "0" depending on the address you're expecting.
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Thu Jul 30, 2015 4:27 pm Post subject: |
|
|
I'm new to assambling so here is what I tried:
| Code: | [ENABLE]
aobscan(INJECT,66 0F D6 80 90 00 00 00 8B 95) // should be unique
alloc(newmem,$1000)
alloc(mypointer,00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F)
label(code)
label(return)
newmem:
code:
mov [mypointer+00000090],eax
movq [eax+00000090],xmm0
jmp return
INJECT:
jmp code
nop
nop
nop
return:
registersymbol(INJECT)
registersymbol(mypointer)
[DISABLE]
INJECT:
db 66 0F D6 80 90 00 00 00
unregistersymbol(INJECT)
unregistersymbol(mypointer)
dealloc(newmem)
dealloc(mypointer) |
When I try to assign it to the cheat table I get the following error:
| Code: | Not all code is injectable.
(Error in line 13(alloc(mypointer,00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F)) :"00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 ?? ?? 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 1D 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 A0 ?? ?? ?? ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? 0F ?? ?? ?? ?? ?? ?? ?? 0F" is an invalid integer)
Are you sure you wan't to edit it to this? |
I probably did something wrong, it's just since I'm totally new to assambling it's hard for me to find the issue.
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Jul 30, 2015 4:31 pm Post subject: |
|
|
Activate my previous script.
Copy the following, go to your table, and press CTRL-V to paste.
Go in game and move or whatever to cause it to change the address you're hacking.
Did the addresses you pasted update to something meaningful?
| Code: | <?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>0</ID>
<Description>"No description"</Description>
<LastState Value="??" Activated="0" RealAddress="300905A4D"/>
<ShowAsHex>1</ShowAsHex>
<Color>80000008</Color>
<VariableType>4 Bytes</VariableType>
<Address>mypointer</Address>
<Offsets>
<Offset>0</Offset>
</Offsets>
</CheatEntry>
<CheatEntry>
<ID>1</ID>
<Description>"No description"</Description>
<LastState Value="??" Activated="0" RealAddress="300905ADD"/>
<Color>80000008</Color>
<VariableType>Double</VariableType>
<Address>mypointer</Address>
<Offsets>
<Offset>90</Offset>
</Offsets>
</CheatEntry>
</CheatEntries>
</CheatTable> |
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Fri Jul 31, 2015 5:24 am Post subject: |
|
|
Nice that seems to work, now I wonder how you did that.
I see you added a few lines, could you maybe explain those to me ?
And how did you find the pointer (real address) ?
Now that I got the Y-cords I wanna try to make a noclip.
I am trying to do this by implanting the script of a other side scrolling game (140), see post here http://forum.cheatengine.org/viewtopic.php?p=5598969
Add .ct file to make it a bit easier to view.
| Description: |
|
 Download |
| Filename: |
offspringfling.ct |
| Filesize: |
5.02 KB |
| Downloaded: |
476 Time(s) |
|
|
| Back to top |
|
 |
Rydian Grandmaster Cheater Supreme
Reputation: 31
Joined: 17 Sep 2012 Posts: 1358
|
Posted: Fri Jul 31, 2015 6:30 am Post subject: |
|
|
Zanzer's script allocates 4 bytes for an address with a specific name/label. Assuming a 32-bit program without >4GB of RAM usage, 4 bytes is all that's needed for an address.
He then inserted "mov [mypointer],eax" to copy the base address of the structure into the allocated memory. He's copying just the base address because it's simpler that way (opposed to copying the base+offset), and makes things easier when you're working with multiple values in the same structure.
And the registersymbol() is to make that label work as a variable of sorts for the table itself to use. That's why after that script runs, you can add an address or pointer that uses that value as a base, for example. And the table knows what the value is.
_________________
|
|
| Back to top |
|
 |
jan24 Cheater
Reputation: 0
Joined: 12 Jul 2013 Posts: 34
|
Posted: Fri Jul 31, 2015 9:02 am Post subject: |
|
|
Thanks for the explanation
It's still looks like a bit of magic for me but it works like a charm.
After this I thought adding the noclip would be easy but it's harder then I thought hehe.
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|