 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
M-Z
Advanced Cheater
![]() Reputation: 1
Joined: 08 Nov 2014
Posts: 77
Location: Poland
|
 Posted: Sat Apr 04, 2020 9:57 am Post subject: Complex addresses and 16-bit values |
 |
|
I'm cheating in DOSBox and I find it useful to use addressing like this:
base+48700
with base being defined as [DOSBox.exe+3786D0]
Now I need to use address like this:
BASE + 3a960 + [BASE +46620+b2ba]
but the problem is that [BASE +46620+b2ba] is loaded as 32-bit value, while I only need to use 2 bytes here.
[BASE +46620+b2ba] points to memory which has this value: d8 06 96 3a
Proper address I am looking for is: BASE + 3a960 + 06d8, but CE takes all four bytes and I get BASE + 3a960 + 3a9606d8.
Is there a way to force CE to take only 16 bit here?
|
|
| Back to top |
|
 |
panraven
Grandmaster Cheater
![]() Reputation: 62
Joined: 01 Oct 2008
Posts: 958
|
| Posted: Sat Apr 04, 2020 10:16 am Post subject: |
|
|
Will this Lua embed address work?
Address:
BASE + 3a960 + $(readSmallInteger[=[BASE +46620+b2ba]=])
or
BASE + 3a960 + $(readSmallInteger([=[BASE +46620+b2ba]=],true))
^ signed version, just in case.
Future CE version may not need lua.
_________________
- Retarded. |
|
| Back to top |
|
|
mgr.inz.Player
I post too much
 Reputation: 222
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
| Posted: Sat Apr 04, 2020 10:19 am Post subject: |
|
|
if you want memory records to behave like that, you can try with registerSymbolLookupCallback
| Code: | registerSymbolLookupCallback(function(string):integer, location): ID 6.4+
Registers a function to be called when a a symbol is parsed
Location determines at what part of the symbol lookup the function is called
slStart: The very start of a symbol lookup. Before tokenization
slNotInt: Called when it has been determined it's not a hexadecimal only string. Before tokenization
--The following locations can be called multiple times for one string as they are called for each token and appended token
slNotModule: Called when it has been determined the current token is not a modulename
slNotUserdefinedSymbol: Called when it has been determined it's not a userdefined symbol
slNotSymbol: Called when it has been determined it's not a symbol in the symbollist
slFailure: Called when it has no clue what the given string is
Note: slNotSymbol and slFailure are similar, but failure comes only if there's no token after the current token that can be concatenated. Else slNotSymbol will loop several times till all tokens make up the full string
Return an Integer with the corresponding address if you found it. Nil or 0 if you didn't. |
You have to create function yourself. I would suggest using your own keywords.
EDIT2
I created SymbolLookupCallback which handles additional instructions:
8,8s,16,16s,32,32s
example:
| Code: | symbol1+[symbol2+symbol3] - treated normally
symbol1+[8:symbol2+symbol3] - will read 8byte unsigned value from symbol2+symbol3 and add it to symbol1
symbol1+[8s:symbol2+symbol3] - will read 8byte signed value from symbol2+symbol3 and add it to symbol1 |
you could use this notation BASE + 3a960 + [16:BASE +46620+b2ba]
Lua script you can add to CT file as "Cheat Table Lua Script" or copy paste it to AutoAssemble MainMemoryRecord with {$Lua} block.
| Code: | function extendedBracketsSLC(s)
if extendedBracketsSLC_SKIP then return end
if s=='' then return end
local address,value,insideBracket_escaped
local insideBracket=s:match('%b[]')
while insideBracket do
if insideBracket:sub(1,3)=='[8:' then -- byte unsigned
address = getAddressSafe(insideBracket:sub(4,-2))
value = readBytes(address)
elseif insideBracket:sub(1,4)=='[8s:' then -- byte signed
address = getAddressSafe(insideBracket:sub(5,-2))
value = readBytes(address) or 0
if value > 127 then value = value - 256 end
elseif insideBracket:sub(1,4)=='[16:' then
value = readSmallInteger(insideBracket:sub(5,-2)) -- word unsigned
elseif insideBracket:sub(1,5)=='[16s:' then
value = readSmallInteger(insideBracket:sub(6,-2),true) -- word signed
elseif insideBracket:sub(1,4)=='[32:' then
value = readInteger(insideBracket:sub(5,-2)) -- dword unsigned
elseif insideBracket:sub(1,5)=='[32s:' then
value = readInteger(insideBracket:sub(6,-2),true) -- dword signed
else
value = readPointer(insideBracket:sub(2,-2)) -- normal behavior
end
value = string.format('%X',value or 0) -- convert to hexstring
insideBracket_escaped = insideBracket:gsub('[.*+%%%[%]-]','%%%1') -- escape magic characters
s = s:gsub(insideBracket_escaped,value)
insideBracket = s:match('%b[]')
end
extendedBracketsSLC_SKIP = true
address = getAddressSafe(s)
extendedBracketsSLC_SKIP = false
return address
end
if extendedBracketsSLC__ID~=nil then unregisterSymbolLookupCallback(extendedBracketsSLC__ID) end
extendedBracketsSLC__ID = registerSymbolLookupCallback(extendedBracketsSLC, slNotInt)
extendedBracketsSLC_SKIP = false |
_________________
|
|
| Back to top |
|
|
M-Z
Advanced Cheater
![]() Reputation: 1
Joined: 08 Nov 2014
Posts: 77
Location: Poland
|
| Posted: Sun Apr 05, 2020 6:58 am Post subject: |
|
|
| panraven wrote: | Will this Lua embed address work?
Address:
BASE + 3a960 + $(readSmallInteger[=[BASE +46620+b2ba]=])
or
BASE + 3a960 + $(readSmallInteger([=[BASE +46620+b2ba]=],true))
^ signed version, just in case.
Future CE version may not need lua. |
Big THX. I find LUA most troublesome, but I have managed to write AA script using this and DarkByte's hack:
| Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
{$lua}
writeBytes(getAddress("[DOSBox.exe+3786D0] + 3a960")+readSmallInteger("[DOSBox.exe+3786D0] +46620+b2ba")+7,40)
{$asm}
0000000:
nop
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
|
@MGR-INŻ: I must look into it; at every corner I realize how absolutely amazing CE is.
|
|
| Back to top |
|
|
mgr.inz.Player
I post too much
Reputation: 222
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
| Posted: Sun Apr 05, 2020 9:18 am Post subject: |
|
|
@M-Z, you can also use timers combined with user symbols, then multilevel pointer with special offsets.
There are dozen ways to achieve what you want.
example: dosbox_example.zip
PS: jeśli masz możliwość napisz do mnie PW. Sam jestem ciekaw, która metoda będzie lepiej działać, już mam DOSBOX w wersji 0.74-3.
Gorzej może być z grą/programem, jest to jakiś shareware? Sam lubię pograć w retro gierki, ale najczęściej na nowych silnikach (eduke32 czy gzdoom)
_________________
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
