Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Injection to opcode that changes

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Frim
How do I cheat?
Reputation: 0

Joined: 27 Feb 2016
Posts: 7
PostPosted: Wed Jul 26, 2017 2:25 pm    Post subject: Injection to opcode that changes Reply with quote
Hello, I am trying to make a mouseover cheat, so i need a value stored in ecx, but part of code changes every time i restart the game:

Code:
[ENABLE]

aobscan(INJECT,8B 41 1C 35 * * * * 35) // should be unique
alloc(newmem,$1000)
globalalloc(myvar4,4)

label(code)
label(return)

newmem:
  mov [myvar],ecx

code:
  mov eax,[ecx+1C]
  xor eax,16211150 // this changes every time i restart game
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 8B 41 1C 35 50 11 21 16 // can't restore 50 11 21 16 after restart

unregistersymbol(INJECT)
dealloc(newmem)
dealloc(myvar)

{
// ORIGINAL CODE - INJECTION POINT: 05F280CB

""+5F280A8: 89 4D F4              -  mov [ebp-0C],ecx
""+5F280AB: 89 5D F0              -  mov [ebp-10],ebx
""+5F280AE: 89 15 54 A0 22 05     -  mov [0522A054],edx
""+5F280B4: 8B 1D 44 A0 22 05     -  mov ebx,[0522A044]
""+5F280BA: 3B D3                 -  cmp edx,ebx
""+5F280BC: 8B 5D FC              -  mov ebx,[ebp-04]
""+5F280BF: 73 08                 -  jae 05F280C9
""+5F280C1: E8 46 F9 E2 4C        -  call "Adobe AIR.dll"+4E7A0C
""+5F280C6: 8B 45 10              -  mov eax,[ebp+10]
""+5F280C9: 8B 08                 -  mov ecx,[eax]
// ---------- INJECTING HERE ----------
""+5F280CB: 8B 41 1C              -  mov eax,[ecx+1C]
""+5F280CE: 35 50 11 21 16        -  xor eax,16211150
// ---------- DONE INJECTING  ----------
""+5F280D3: 35 AF 11 21 16        -  xor eax,162111AF
""+5F280D8: 8B 4D F0              -  mov ecx,[ebp-10]
""+5F280DB: 89 0D 54 A0 22 05     -  mov [0522A054],ecx
""+5F280E1: 8B E5                 -  mov esp,ebp
""+5F280E3: 5D                    -  pop ebp
""+5F280E4: C3                    -  ret
""+5F280E5: CC                    -  int 3
""+5F280E6: CC                    -  int 3
""+5F280E7: CC                    -  int 3
""+5F280E8: CC                    -  int 3
}


how can I make my injection only to this part
Code:
""+5F280CB: 8B 41 1C              -  mov eax,[ecx+1C]

or how to make my script remember original code somewhere and restore it after disabling?

Sorry for my bad English.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4196
PostPosted: Wed Jul 26, 2017 3:11 pm    Post subject: Reply with quote
Use readmem or simply inject above that injection point so that particular instruction is not included.
Back to top
View user's profile Send private message
Frim
How do I cheat?
Reputation: 0

Joined: 27 Feb 2016
Posts: 7
PostPosted: Wed Jul 26, 2017 3:54 pm    Post subject: Reply with quote
If i inject above - script activation crashes the game, I suppose that happens because of jae:
Code:
""+5F280BF: 73 08                 -  jae 05F280C9
""+5F280C9: 8B 08                 -  mov ecx,[eax]


Okay, readmem doesn't work for me.

If I make with static addresses like:
Code:
[ENABLE]

aobscan(INJECT,8B 41 1C 35 BA A9 B2 52) // should be unique
alloc(newmem,$1000)
globalalloc(myvar4,4)

label(code)
label(return)

newmem:
  mov [myvar4],ecx
code:
  mov eax,[ecx+1C]
  xor eax,"Adobe AIR.dll"+2BA9BA
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 8B 41 1C 35 BA A9 B2 52

unregistersymbol(INJECT)
dealloc(newmem)
dealloc(myvar4)

^ it working fine.
But if I use readmem:
Code:
aobscan(INJECT,8B 41 1C 35 * * * * 35 * * * * 8B 4D F0) // should be unique
alloc(newmem,$1000)
alloc(originalbytes,8)
globalalloc(myvar4,4)
label(originalcode)
label(return)
registersymbol(originalbytes)
registersymbol(INJECT)

originalbytes:
  readmem(INJECT,8)

newmem:
  mov [myvar],ecx

originalcode:
  //reassemble(INJECT)
  readmem(INJECT,8)
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop

return:

[DISABLE]

INJECT:
readmem(originalbytes,8)

unregistersymbol(INJECT)
unregistersymbol(originalbytes)
dealloc(newmem)
dealloc(originalbytes)
dealloc(myvar4)

^ game just crashes and I don't understand why - in memory view there is no any difference from above script.

Also tried to use reassemble, but it loses opcode after mov eax,[ecx+1C] and game crashes.

Any tips? Thank you!

Last edited by Frim on Thu Jul 27, 2017 1:10 am; edited 1 time in total
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4196
PostPosted: Wed Jul 26, 2017 6:52 pm    Post subject: Reply with quote
Sorry, didn't notice the jump. That being the case, you would want to include it in your script and write it out in byte form.

That said, however, there is nothing wrong with using module addressing, assuming that the target and the conditions allow for that.
Back to top
View user's profile Send private message
Frim
How do I cheat?
Reputation: 0

Joined: 27 Feb 2016
Posts: 7
PostPosted: Thu Jul 27, 2017 2:57 am    Post subject: Reply with quote
Quote:
That being the case, you would want to include it in your script and write it out in byte form.

Sorry, how I would do that? Would you make an example for my situation?

Quote:
there is nothing wrong with using module addressing

module adressing means my mov [myvar4],ecx ?

And still, why my readmem version crashes the game?
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4196
PostPosted: Thu Jul 27, 2017 1:23 pm    Post subject: Reply with quote
Regarding the jump, this is your code:

Code:
""+5F280BF: 73 08                 -  jae 05F280C9
""+5F280C1: E8 46 F9 E2 4C        -  call "Adobe AIR.dll"+4E7A0C
""+5F280C6: 8B 45 10              -  mov eax,[ebp+10]
""+5F280C9: 8B 08                 -  mov ecx,[eax]
// ---------- INJECTING HERE ----------
""+5F280CB: 8B 41 1C              -  mov eax,[ecx+1C]
""+5F280CE: 35 50 11 21 16        -  xor eax,16211150


Set your injection point at the jump, at "whatever.exe"+5F280BF above. In your script, include the necessary amount of NOP's and include the necessary bytes in your [Disable] section.

So your script would include something like this:

Code:
newmem:
db 73 08 E8 46 F9 E2 4C 8B 45 10 8B 08
mov [myvar],ecx
jmp return


This would allow you to do what you need without even touching the problem instruction. There are many ways to accomplish the same thing.

Example of module address is "Adobe AIR.dll"+2BA9BA -- which should be static if written out like that.

Regarding readmem, try organizing your code correctly. Check examples on forum.
Back to top
View user's profile Send private message
Frim
How do I cheat?
Reputation: 0

Joined: 27 Feb 2016
Posts: 7
PostPosted: Thu Jul 27, 2017 5:24 pm    Post subject: Reply with quote
++METHOS, thanks a lot, I made what I wanted
used readmem without proper understanding, but still it works:
Code:
[ENABLE]

aobscan(INJECT,8B 41 1C 35 * * * * 35 * * * * 8B 4D F0) // should be unique
alloc(newmem,$1000)
alloc(originalbytes,8)
globalalloc(myvar4,4)
registersymbol(originalbytes)

label(code)
label(return)

originalbytes:
  readmem(INJECT,8)

newmem:
  mov [myvar4],ecx

code:
  readmem(INJECT,8)
  jmp return

INJECT:
  jmp newmem
  nop
  nop
  nop

return:
registersymbol(INJECT)

[DISABLE]
INJECT:
readmem(originalbytes,8)

unregistersymbol(INJECT)
unregistersymbol(originalbytes)
dealloc(newmem)
dealloc(originalbytes)
dealloc(myvar4)
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites