Cheat Engine

[fuguipingan]

I used VirtualAllocEx to allocate for a memory with size 0x100, at a random address. it returned me back with address at Address=1E0E8B0000

My game (witcher3.exe) address is something like 0x7FF73B44D3CB.

The problem is: I dissembled some code in the allocated memory space (1E0E8B0000) and can jump from game code (0x7FF73B44D3CB) to it. But, I could NOT jump BACK from the allocated memory space to game code.

What could be the cause?

[Dark Byte]

what jump code do you use?

simple 0xe9 is not going to work with that distance

and if you do a proper jump, do you jump back to the correct location? e.g hookplace+14 and NOT hookplace+5

[fuguipingan]

I didn't remember the hex code for jmp....

Frankly, I was using x64dbg. I wrote "jmp <address>" and it was encoded by x64dbg automatically to hex. If distance was the cause, what confuses me is why forward jump works but the backward jump didn't: error message reads "could not resolve address".

It could not be reproduced either because the "alloc" method I uses gives random address, now most of the time the forward jump could not resolve.

--
In cheat engine I encountered similar issues with auto assemble/code injection template: forward jump works, but backward jump fails (throws exception saying memory access violation)

--
For the jump-back address, I copied the next instruction of hookplace. It should be correct. (I compared the hookplace_original_instruction and hookplace_replacement_instruction, same length and no overflow of bytes.)

--
Or, may be I used "alloc" incorrectly? (either x64dbg or the cheatengine alloc)
I am trying to practise a common scenario of code-cave, here is my understanding:
1. I alloc some memory.
a. is there tips for using alloc: is 0x1000 too big a size?,
b. shall I use game.exe as start address? alloc(0x1000, "game.exe")?
c. Is it normal that alloc fails often and I shall experiment with different size and start address, also need to verify it is not TOO FAR distance?
d. does "call" covers further distance than "jmp"?

2. I jmp to the allocated memory and write my code. then jmp/ ret back to next code.

[Dark Byte]

Do you save enough of the original instructions?
you need at least 14 bytes (and makebsure they are full instructions, and if they are rip relative adjust them)

0x1000 is the minimum you csn allocate

alloc needs 3 parameters: name, size, prefered range

[fuguipingan]

Thanks for the pointers about rip relative offsets). I searched for some articles about rip relative addressing. Now I am able to jump back and forth by putting the abs address into register first, then jmp rax, like that.