 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
mgr.inz.Player
I post too much
 Reputation: 218
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
 Posted: Thu Dec 08, 2016 5:25 pm Post subject: |
  |
|
| Code: | [ENABLE]
aobscanmodule(focus,HMA.exe,8B 41 0C D9 00 C3 CC CC) // should be unique
registersymbol(focus)
alloc(newmem,$1000)
newmem:
mov eax,[ecx+0C]
mov [eax],(float)1000
fld dword ptr [eax]
ret
focus:
jmp newmem
return:
[DISABLE]
focus:
db 8B 41 0C D9 00
unregistersymbol(focus)
dealloc(newmem) |
_________________
|
|
| Back to top |
|
 |
Flux.
Advanced Cheater
![]() Reputation: 0
Joined: 10 Nov 2016
Posts: 84
Location: Another World - N5X2 106311411+2123518
|
| Posted: Mon Dec 12, 2016 2:28 pm Post subject: |
|
|
Have been trying and trying to get this right, and have had help and tips from mgr.inz.Player, can't really thank him enough, @mgr.inz.Player | Code: | _
/(|
( :
__\ \ _____
(____) `|
(____)| |
(____).__|
(___)__.|_____
|
Update, my goal was to create a cheat that first adds/fills the focus/instinct bar then freezes it, sounds simple but has been proving a bit difficult.
Its one thing to freeze the focus, but on harder difficulties you start with zero and on hardest you cant even acquire it, so that's why i wanted to add focus then freeze.
With some help earlier in the thread the possible instructions to change where narrowed down, but no matter what i changed it never worked how i wanted it to, for instance one occasion i thought i had it, the focus filled but then point shooting would drain it, then focus would refill, this was a working script, and would do fine, but still not quite what i wanted to do.
Edit -wanted to make this part a bit clearer, after working my way down the list of "what accesses this address" a pattern started to emerge, the cheat would work and then crash when the level was finished, or the cheat would work but decrease when point shooting was activated.
So i used the script below that worked and decreased when point shooting was activated, and then tried a few different things, one of them was to just move the below table up one line and overwrite which worked.
i think the line means that it's checking if the address is greater than (unsigned) the instruction above it, and wanted to ask is the below script OK, or will that function maybe impact something i haven't tested yet.
The area of the instruction - | Code: | "HMA.exe"+600027: E8 64 0D BE FF - call HMA.exe+1E0D90
"HMA.exe"+60002C: DD 5D E0 - fstp qword ptr [ebp-20]
"HMA.exe"+60002F: B9 70 96 15 01 - mov ecx,HMA.exe+D59670
"HMA.exe"+600034: E8 B7 9B B3 FF - call HMA.exe+139BF0
"HMA.exe"+600039: DC 4D E0 - fmul qword ptr [ebp-20]
"HMA.exe"+60003C: D8 4E 04 - fmul dword ptr [esi+04]
"HMA.exe"+60003F: D9 5D E4 - fstp dword ptr [ebp-1C]
"HMA.exe"+600042: D9 45 E4 - fld dword ptr [ebp-1C]
"HMA.exe"+600045: D8 46 10 - fadd dword ptr [esi+10]
"HMA.exe"+600048: D9 5E 10 - fstp dword ptr [esi+10]
// ---------- INJECTING HERE ----------
"HMA.exe"+60004B: 8B 4E 20 - mov ecx,[esi+20]
"HMA.exe"+60004E: F6 81 EC 06 00 00 04 - test byte ptr [ecx+000006EC],04
// ---------- DONE INJECTING ----------
"HMA.exe"+600055: 76 4C - jna HMA.exe+6000A3
"HMA.exe"+600057: 39 1D 94 13 22 01 - cmp [HMA.exe+E21394],ebx
"HMA.exe"+60005D: 75 29 - jne HMA.exe+600088
"HMA.exe"+60005F: B9 80 15 22 01 - mov ecx,HMA.exe+E21580
"HMA.exe"+600064: E8 A7 3C F8 FF - call HMA.exe+583D10
"HMA.exe"+600069: 83 F8 04 - cmp eax,04
"HMA.exe"+60006C: 75 1A - jne HMA.exe+600088
"HMA.exe"+60006E: 8B 56 0C - mov edx,[esi+0C]
"HMA.exe"+600071: 8B 02 - mov eax,[edx]
"HMA.exe"+600073: 89 45 E4 - mov [ebp-1C],eax |
And here is the working script | Code: | [ENABLE]
alloc(newmem_focus,64)
label(return_focus)
newmem_focus:
mov edx,[esi+0C]
mov [edx],(float)1000
mov eax,[edx]
jmp return_focus
"HMA.exe"+600000:
jmp newmem_focus
return_focus:
[DISABLE]
"HMA.exe"+600000:
db 77 49 8B 56 0C 8B 02
dealloc(newmem_focus)
{
// ORIGINAL CODE - INJECTION POINT: "HMA.exe"+600005
"HMA.exe"+5FFFDE: D9 5D E4 - fstp dword ptr [ebp-1C]
"HMA.exe"+5FFFE1: D9 45 E4 - fld dword ptr [ebp-1C]
"HMA.exe"+5FFFE4: D8 46 10 - fadd dword ptr [esi+10]
"HMA.exe"+5FFFE7: D9 5E 10 - fstp dword ptr [esi+10]
"HMA.exe"+5FFFEA: F6 05 A0 10 22 01 08 - test byte ptr [HMA.exe+E210A0],08
"HMA.exe"+5FFFF1: 75 58 - jne HMA.exe+60004B
"HMA.exe"+5FFFF3: 8B 4E 20 - mov ecx,[esi+20]
"HMA.exe"+5FFFF6: F7 81 EC 06 00 00 00 00 00 10 - test [ecx+000006EC],10000000
"HMA.exe"+600000: 77 49 - ja HMA.exe+60004B
"HMA.exe"+600002: 8B 56 0C - mov edx,[esi+0C]
// ---------- INJECTING HERE ----------
"HMA.exe"+600005: 8B 02 - mov eax,[edx]
"HMA.exe"+600007: 89 45 E4 - mov [ebp-1C],eax
// ---------- DONE INJECTING ----------
"HMA.exe"+60000A: D9 45 E4 - fld dword ptr [ebp-1C]
"HMA.exe"+60000D: B9 70 96 15 01 - mov ecx,HMA.exe+D59670
"HMA.exe"+600012: DD 5D E0 - fstp qword ptr [ebp-20]
"HMA.exe"+600015: E8 26 16 C9 FF - call HMA.exe+291640
"HMA.exe"+60001A: DC 5D E0 - fcomp qword ptr [ebp-20]
"HMA.exe"+60001D: DF E0 - fnstsw ax
"HMA.exe"+60001F: F6 C4 41 - test ah,41
"HMA.exe"+600022: 75 27 - jne HMA.exe+60004B
"HMA.exe"+600024: 8B 4E 20 - mov ecx,[esi+20]
"HMA.exe"+600027: E8 64 0D BE FF - call HMA.exe+1E0D90
} |
Any help is appreciated thank you.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
