|
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1587
|
Posted: Thu Jul 12, 2018 9:27 pm Post subject: |
|
|
blitzington wrote: | what i do is find what writes to that address then i go to tools and then auto assemble, cheat table framework code, and then i have tried code injection |
code injection:
replaces the injection point with a jump to the new allocated memory.
if injection point is not a module address, then it will work for once.
instead:
use AOB injection, CE will search for the given byte pattern.
if pattern found, then injection point is initialized and replaced with a jump to the new allocated memory.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1587
|
Posted: Thu Jul 12, 2018 9:37 pm Post subject: |
|
|
note:
if its a mono game, then you can enable mono features and use code injection.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1587
|
Posted: Thu Jul 12, 2018 10:35 pm Post subject: |
|
|
Code: | { Game : knightspp.exe
Version:
Date : 2018-07-12
Author : Evan Mickey
This script does blah blah blah
}
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
aobscan(INJECT,8B 45 08 8B 48 68 8B 55 0C 2B CA) // should be unique
alloc(newmem,$100)
label(code)
label(return)
newmem:
code:
mov eax,[ebp+08] // eax+68 = your address that holds the value
mov ecx,[eax+68] // copy current value to ecx
mov edx,[ebp+0C] // edx contains the value to be subtracted from current value
// sub ecx,edx // subtract edx (value to be subtracted) from ecx (current value) and store result in ecx
// you can change "sub ecx,edx" to "add ecx,edx" so your value will be increased instead of being decreased
mov ecx,#999999999 // will always write 999... to your value which is equal to FREEZE remove this instruction if you decided to use "add ecx,edx"
/* you also can divide the subtracting value by 2 or more by using
shr edx,2
sub ecx,edx
if you decided to use this, then remove " mov ecx,#999999999 "
*/
jmp return
INJECT:
jmp newmem
nop
nop
nop
nop
nop
nop
return:
registersymbol(INJECT)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
INJECT:
db 8B 45 08 8B 48 68 8B 55 0C 2B CA
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 04BC8265
04BC8243: 81 EC B8 00 00 00 - sub esp,000000B8
04BC8249: 8B 45 08 - mov eax,[ebp+08]
04BC824C: 8B 40 68 - mov eax,[eax+68]
04BC824F: 8B 4D 0C - mov ecx,[ebp+0C]
04BC8252: 3B C1 - cmp eax,ecx
04BC8254: 0F 8C 6C 03 00 00 - jl 04BC85C6
04BC825A: 8B 45 08 - mov eax,[ebp+08]
04BC825D: 8B 48 68 - mov ecx,[eax+68]
04BC8260: 8B 55 0C - mov edx,[ebp+0C]
04BC8263: 2B CA - sub ecx,edx
// ---------- INJECTING HERE ----------
04BC8265: 89 48 68 - mov [eax+68],ecx
04BC8268: 8B 05 F0 7D 5A 04 - mov eax,[045A7DF0]
// ---------- DONE INJECTING ----------
04BC826E: 83 EC 08 - sub esp,08
04BC8271: 68 10 D3 F8 12 - push 12F8D310
04BC8276: 50 - push eax
04BC8277: 39 00 - cmp [eax],eax
04BC8279: E8 82 03 00 00 - call 04BC8600
04BC827E: 83 C4 10 - add esp,10
04BC8281: 8B 45 0C - mov eax,[ebp+0C]
04BC8284: 85 C0 - test eax,eax
04BC8286: 0F 84 D4 02 00 00 - je 04BC8560
04BC828C: 8B 45 0C - mov eax,[ebp+0C]
} |
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|