Cheat Engine

Roogue · Newbie cheater Reputation: 0 Joined: 31 May 2019 Posts: 14

Hello guys, I got inside of my game a function called DoAttackMelee() who takes 3 parameters, so I use the following code :

alloc(create, 2000)
CREATETHREAD(create)

create:
push 0 (param 1)
push 1C (param 2)
push 008CD243 (pointer parameter 3)
call 04002345 (call func)
ret

i'm not doing ret 0C because it's already done in the function (at the end)

anyone have an idea ?

thanks

Dark Byte · Posted: Tue Jun 04, 2019 8:07 am Post subject:

How do you know that the functionname is DoAttackMelee? Is it a mono target?

If so, you need to attach the thread to the mono system first so that it's thread local storage can be configured properly

If not, and you got it from a pdb or something, then make sure the parameters are correct.
First thing I see is that you name the parameters wrong. You've got them in the wrong order(last parameter pushed is the first parameter). But assuming that's just a typo, then make sure that 008CD243 is the correct address.
Usually it'd be a class instance address that you have to scan for or get from a code injection somewhere else.

Roogue · Newbie cheater Reputation: 0 Joined: 31 May 2019 Posts: 14

sbryzl · Posted: Wed Jun 05, 2019 7:47 am Post subject:

A return leads somewhere unless your stack is not aligned. It usually leads back to the beginning of the thread. If that's what you want then just ignore the stack and use a jmp create. Then you can trace it to see what the stack is doing. You should probably include a sleep too so it's not overbearing the processor.

ParkourPenguin · Posted: Wed Jun 05, 2019 9:09 am Post subject:

64-bit and 32-bit code have completely different calling conventions. Which is this?