Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


*Pointer pointed by pointer and comparing :- I need help

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions
View previous topic :: View next topic  
Author Message
Twistedfate
Expert Cheater
Reputation: 1

Joined: 11 Mar 2016
Posts: 231

PostPosted: Sat Aug 06, 2016 6:24 am    Post subject: *Pointer pointed by pointer and comparing :- I need help Reply with quote

The picture explain :
lets assume this :
1-external pointer //not important
2-Upper offset
3-lower offsets // I mean the offsets of (428offset pointer) look the pic

I want to do :
cmp upperoffset,external pointer
je lower offset(my injection is here)
_________________________________________________________
The questions :
1- How do I know if the register is unused.
ie. ( I want to push the external pointer In a register to compare it with upper part )

2- I can compare the upper offset with the external pointer But My injection point is down . How can i tell the code go to upper offset then check if the upper=external pointer if equal then do the injection .


//Please explain every thing because I am newbie .
// If my code of injection required ask me i dont want to make the post longer



06-08-2016 13-23-03.jpg
 Description:
My offsets
 Filesize:  166.87 KB
 Viewed:  7987 Time(s)

06-08-2016 13-23-03.jpg


Back to top
View user's profile Send private message
PinPoint
Expert Cheater
Reputation: 10

Joined: 07 Apr 2016
Posts: 223
Location: Scotland

PostPosted: Sat Aug 06, 2016 7:17 am    Post subject: Reply with quote

post your injection please.

there might be a better way of doing this but here is what i would first try...
say your external pointer is [[game.exe+1234]+18]+1C to put it into a register use a code cave like:
Code:
codecave:
mov eax,[game.exe+1234]
mov eax,[eax+18]
mov eax,[eax+1c]//you dont always need this step in the code cave, it depends on what you are comparing it with as in a register or value in a register

so now eax holds your pointer value for comparing. might need to push registers depending on which is being used already or depending on the one you use and pop them after they are finished being used.

say ebx holds the address of the start of the structure it could be like:
Code:

newmem:
cmp [ebx+40C],eax
jne originalcode
//put changed code here


or if you had a pointer for the 40C offset address you could put that pointer in a register too and compare it to the other. so if the 40c pointer was: [[[game.exe+1234]+24A]+4C]+40C you could have it like:
Code:
mov ecx,[game.exe+1234]
mov ecx,[ecx+24A]
mov ecx,[ecx+4c]
//then leave the last offset until the compare.

//the compare would look like
cmp eax,[ecx+40C]
Back to top
View user's profile Send private message
Twistedfate
Expert Cheater
Reputation: 1

Joined: 11 Mar 2016
Posts: 231

PostPosted: Sat Aug 06, 2016 7:42 am    Post subject: Reply with quote

sorry for my bad English

The compare is done but the main problem still .l

this is the comparing of offset 40c with external address :
look the last line of the first code

Code:
push ecx

mov ecx,[mygame.exe+00773BF0]
mov ecx,[ecx+3ac]
mov ecx,[ecx+6e8]
mov ecx,[ecx+400]
mov ecx,[ecx+2f8]
mov ecx,[ecx+1c]

cmp [esi+40c], ecx
je to offset20code&do the injection     //I need help here . 




the code of offset20:
NB. offset 20 is holded by pointer at offset 428

Code:
[enable]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here


fimul [esi+20]
mov [esi+20],#0 //my injection
fdiv qword ptr [00E4F3A0]

jmp exit
originalcode:
fimul [esi+20]
fdiv qword ptr [00E4F3A0]

exit:
jmp returnhere

"RoleView.dll"+21B0:
jmp newmem
nop
nop
nop
nop
returnhere:
[disable]
"RoleView.dll"+21B0:
fimul [esi+20]
fdiv qword ptr [00E4F3A0]

Back to top
View user's profile Send private message
PinPoint
Expert Cheater
Reputation: 10

Joined: 07 Apr 2016
Posts: 223
Location: Scotland

PostPosted: Sat Aug 06, 2016 7:53 am    Post subject: Reply with quote

assuming the registers have the values you need when you inject, try:

Code:
[enable]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
push ecx
mov ecx,[mygame.exe+00773BF0]
mov ecx,[ecx+3ac]
mov ecx,[ecx+6e8]
mov ecx,[ecx+400]
mov ecx,[ecx+2f8]
mov ecx,[ecx+1c]
cmp ecx,[esi+40c]
jne originalcode
fimul [esi+20]
mov [esi+20],#0 //my injection
fdiv qword ptr [00E4F3A0]
jmp exit

originalcode:
fimul [esi+20]
fdiv qword ptr [00E4F3A0]

exit:
pop ecx
jmp returnhere

"RoleView.dll"+21B0:
jmp newmem
nop
nop
nop
nop

returnhere:

[disable]
"RoleView.dll"+21B0:
fimul [esi+20]
fdiv qword ptr [00E4F3A0]
Back to top
View user's profile Send private message
Twistedfate
Expert Cheater
Reputation: 1

Joined: 11 Mar 2016
Posts: 231

PostPosted: Sat Aug 06, 2016 8:00 am    Post subject: Reply with quote

crashed the game Sad
Quote:
cmp ecx,[esi+40c]



this will compare the 40c of the lower part not the upper ?
Back to top
View user's profile Send private message
PinPoint
Expert Cheater
Reputation: 10

Joined: 07 Apr 2016
Posts: 223
Location: Scotland

PostPosted: Sat Aug 06, 2016 8:18 am    Post subject: Reply with quote

I just used the same cmp you did. I can see looking back on it though it wouldnt work. I've not done alot of what you are trying to do but since I don't know the register etc the upper part is cant you get a pointer for the 40C offset address and compare to that? you could always just have the 3 pointers and try using createthread() instead of injecting a code, or change the injection point so it is in the upper part. like i said in my first post though, there a probably better ways of doing this that i'm not aware of.
whats the game?
Back to top
View user's profile Send private message
Twistedfate
Expert Cheater
Reputation: 1

Joined: 11 Mar 2016
Posts: 231

PostPosted: Sat Aug 06, 2016 8:47 am    Post subject: Reply with quote

the code work I forget to deallco(newmem)
But the compare still dont ,
I dont want to get the pointer because its belong to one monster

lets say what iam trying to apply :
in my game when i press alt+left click i get the monster name in some box in the game e
and there are alot of names with the same monster shape .. the names which stored at the box is our external address .
At another offset I assumed it 40c because its appear in my pic . the monster name is stored at the structure of monster the code under the 428 pointer is
the size of monster
so when I press alt+left click i get the monster name then conver the value of him to 0
but if I got the pointer of 40c i will get pointer of one monster and one name but if i can compare the upper i can conver any monster size i want to 0
____________________________
ie
external address = the box in the game which can contain variables names

40c offset = the name of monster in the structure

offset 20 = the size of monster

compare 40c with external address if equal convert the monster selected by alt+left click to 0 .
_________________________________________
sorry for wasting your time and my complicated thinking but iam newbie trying to learn
_____________________________
createthread() can do the compare for this ? or slove this case then i study it ?
Back to top
View user's profile Send private message
PinPoint
Expert Cheater
Reputation: 10

Joined: 07 Apr 2016
Posts: 223
Location: Scotland

PostPosted: Sat Aug 06, 2016 9:05 am    Post subject: Reply with quote

Is there not an identifier in the "lower part" for the monster you can compare to? lock the address when your monsters name is in the box (right click the address in structure view and lock) and add a another of the same address in a different group. look at it when a different name is in the box, then lock that address too. add a few more of the same addresses and do the same with different monsters names in the box and then see if any values in the pointer are unique to the monster you want.
Back to top
View user's profile Send private message
Twistedfate
Expert Cheater
Reputation: 1

Joined: 11 Mar 2016
Posts: 231

PostPosted: Sat Aug 06, 2016 10:46 am    Post subject: Reply with quote

I did that for hours before the only way to me is comparing the upper part and injecting the lower part Sad my experience is very low
Back to top
View user's profile Send private message
PinPoint
Expert Cheater
Reputation: 10

Joined: 07 Apr 2016
Posts: 223
Location: Scotland

PostPosted: Sat Aug 06, 2016 11:29 am    Post subject: This post has 1 review(s) Reply with quote

whats the game, i can get it maybe and take a look into it.

if you inject at the upper part it would be easier to do what you what you are trying to do as you would be able to get the lower part from inside the upper register. [register+428]+20.

wait.. if the value 121 is for the monster you are manipulating and the pointer changes per monster name in the box, then why not just compare it to that value?

Code:
mov ecx,[mygame.exe+00773BF0]
mov ecx,[ecx+3ac]
mov ecx,[ecx+6e8]
mov ecx,[ecx+400]
mov ecx,[ecx+2f8]
mov ecx,[ecx+1c]
cmp ecx,#121
jne originalcode
//your code
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites