View previous topic :: View next topic |
Author |
Message |
SunBeam I post too much
Reputation: 65
Joined: 25 Feb 2005 Posts: 4023 Location: Romania
|
Posted: Wed Feb 08, 2017 11:02 pm Post subject: |
|
|
Be it as it may, you still don't know how base values are obtained (the starting point; a XOR b -> how are 'a' and 'b' generated?) You only know the XOR gets you the result. Still good to being with
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Wed Feb 08, 2017 11:36 pm Post subject: |
|
|
Right-click the Value Type dropdown and select Define new custom type (Auto Assembler)
Paste the following and try using the new type to search for your gold.
Code: | alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(UsesFloat,1)
alloc(CallMethod,1)
TypeName:
db 'Encrypted',0
ByteSize:
dd 8
UsesFloat:
db 0
CallMethod:
db 1
ConvertRoutine:
[64-bit]
mov rax,[rcx]
mov rdx,rax
shr rdx,#32
and rax,FFFFFFFF
xor eax,edx
ret
[/64-bit]
[32-bit]
push ebp
mov ebp,esp
mov eax,[ebp+8]
mov eax,[eax]
pop ebp
ret
[/32-bit]
ConvertBackRoutine:
[64-bit]
mov rdx,rcx
shr rdx,#32
and rcx,FFFFFFFF
xor ecx,edx
mov [r8],ecx
ret
[/64-bit]
[32-bit]
push ebp
mov ebp,esp
push eax
push ebx
mov eax,[ebp+8]
mov ebx,[ebp+10]
mov [ebx],eax
pop ebx
pop eax
pop ebp
ret
[/32-bit] |
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Thu Feb 09, 2017 2:16 am Post subject: |
|
|
Zanzer wrote: | Paste the following and try using the new type to search for your gold. | -I never knew about this feature. How do you set this up? For example, what items do I need to change to make this work with other targets?
Thanks.
|
|
Back to top |
|
 |
SunBeam I post too much
Reputation: 65
Joined: 25 Feb 2005 Posts: 4023 Location: Romania
|
Posted: Thu Feb 09, 2017 4:31 am Post subject: |
|
|
Ah, logic tells me the script acts as a scan hook, where whenever you scan for a known value, it's passed through the x32/x64 functions for conversion, then looked-up?
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Feb 09, 2017 8:50 pm Post subject: |
|
|
Yep, when you scan for a value or display it within a memory record CE first runs the value through your ConvertRoutine. When you try to set the value in your memory record, CE will run your set value through ConvertBackRoutine so the game has what it's expecting. You guys have never done a custom type before?! When you create a new custom type, it gives you some useful comments to explain everything.
In my code above, I only implemented the 64-bit ConvertRoutine to do that XOR logic.
It seemed that the money value was XOR encrypted by the 4-byte value immediately following it.
Not sure if the custom type actually supports a size of 8, but it did seem to populate RAX with the full 8 bytes.
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25792 Location: The netherlands
|
Posted: Thu Feb 09, 2017 9:29 pm Post subject: |
|
|
Quote: | Not sure if the custom type actually supports a size of 8 |
custom types can support sizes between 1byte and several megabytes
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
 |
bachou Expert Cheater
Reputation: 0
Joined: 02 Feb 2015 Posts: 136
|
Posted: Thu Feb 09, 2017 10:17 pm Post subject: |
|
|
Zanzer wrote: | Right-click the Value Type dropdown and select Define new custom type (Auto Assembler)
Paste the following and try using the new type to search for your gold. |
my CE don't have custom type option
Description: |
|
Filesize: |
5.36 KB |
Viewed: |
11487 Time(s) |

|
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Feb 09, 2017 10:29 pm Post subject: |
|
|
bachou wrote: | my CE don't have custom type option |
Your other right.
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Thu Feb 09, 2017 11:55 pm Post subject: |
|
|
Thanks, Zanzer. No, I've not used the custom type before. I vaguely recall reading about it somewhere on this forum but had since forgotten about it.
I looked through the comments on the default script and couldn't make sense of it. Maybe I am too stupid right now to figure out how to set this up in order to work properly. I've tested it on a few projects so far and have failed to yield any viable results.
How would this need to be set up for a 32-bit target?
Thanks.
|
|
Back to top |
|
 |
SunBeam I post too much
Reputation: 65
Joined: 25 Feb 2005 Posts: 4023 Location: Romania
|
Posted: Fri Feb 10, 2017 1:55 am Post subject: |
|
|
Zanzer, based on your example, I can easily write a resources script for StarCraft 2
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Feb 10, 2017 3:41 am Post subject: |
|
|
Show off.
|
|
Back to top |
|
 |
bachou Expert Cheater
Reputation: 0
Joined: 02 Feb 2015 Posts: 136
|
Posted: Fri Feb 10, 2017 4:06 am Post subject: |
|
|
Zanzer wrote: | bachou wrote: | my CE don't have custom type option |
Your other right. |
do you mean the "not" checkbox ? sorry im so clueless when it comes to this stuff...
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Feb 10, 2017 5:08 am Post subject: |
|
|
Zanzer wrote: | Right-click the Value Type dropdown and select Define new custom type (Auto Assembler) |
|
|
Back to top |
|
 |
bachou Expert Cheater
Reputation: 0
Joined: 02 Feb 2015 Posts: 136
|
Posted: Sat Feb 11, 2017 4:20 am Post subject: |
|
|
i will try that at home
and you mentioned cheatengine will create a script for me, how to do a simple script for money scan (not on this game but other simple game) ?
|
|
Back to top |
|
 |
sasatefa2009 Cheater
Reputation: 0
Joined: 10 Dec 2014 Posts: 29 Location: Home
|
Posted: Fri Feb 24, 2017 2:40 pm Post subject: |
|
|
Zanzer wrote: | Right-click the Value Type dropdown and select Define new custom type (Auto Assembler)
|
i'm using cheat engine since version 5.5 and never knew there is such a feature exist.
Dark Byte adds invisible things that he don't need us to know about.
_________________
لا اله الا الله محمد رسول الله |
|
Back to top |
|
 |
|