Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Trying to call a function to attack in a specific way

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
LongBeardedLion
Expert Cheater
Reputation: 0

Joined: 10 Apr 2020
Posts: 172

PostPosted: Tue May 26, 2020 10:48 am    Post subject: Trying to call a function to attack in a specific way Reply with quote

Hi. Im modding a rts to make units attack in a different way depending on the situation.

I found the function and then the address in the stack with the value with OllyDbg and Ida Pro.

The function address is 4174A0. The attack stance type is in the stack at 12D5D4.

So far this is great. I learned how to call functions with Guided Hacking tutorials. But i still dont know how am i going to change that value in the stack. Or if that is even possible? What should i do?

Changing that value in the stack will change the Attack stance. But also it seems that the value in the stack corresponds to the argument in the function.

Should i call the function and somehow change the argument? Should i call the function and change the function inside to change the argument inside? Or is there a way to change that value in the stack when the function is called?

Pls help. Thank you



2.png
 Description:
The function selected in Cheat Engine.
 Filesize:  510.56 KB
 Viewed:  1131 Time(s)

2.png



change stance function.jpg
 Description:
This is the function that change the stance. a2 corresponds to the argument that will change the attack stance. That seems to have a relation with the value in the stack.
 Filesize:  265.53 KB
 Viewed:  1131 Time(s)

change stance function.jpg



Found the stance in the stack.jpg
 Description:
As you can see here the value pointed at in the stack, will change the Attack stance value. So if i write 12CB0900 it will attack in a certain way and 12CB0901 in another.
 Filesize:  428.17 KB
 Viewed:  1131 Time(s)

Found the stance in the stack.jpg


Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4299

PostPosted: Tue May 26, 2020 11:55 am    Post subject: Reply with quote

You can make a code injection at the start of the function if you want.
e.g. basic example:
Code:
[ENABLE]
aobscanmodule(ChangeStanceInject,empires2.exe,56 8B F1 8a 4c 24 08)  // should be unique
alloc(newmem,1024)
alloc(moveStance,4)

label(return)
registersymbol(ChangeStanceInject)
registersymbol(moveStance)

newmem:
  mov esi,ecx
  mov cl,[moveStance]
  jmp return

ChangeStanceInject+1:
  jmp newmem
  nop
return:

[DISABLE]

ChangeStanceInject+1:
    db 8B F1 8A 4C 24 08

unregistersymbol(moveStance)
unregistersymbol(ChangeStanceInject)
dealloc(moveStance)
dealloc(newmem)

Alternatively, find calls to the function and change the argument(s) there. In CE you'd use Tools -> Dissect Code on the exe, then look at Empires2.exe+174A0 and see what calls it.
You could also set a breakpoint and look at the return address the call left on the stack.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
LongBeardedLion
Expert Cheater
Reputation: 0

Joined: 10 Apr 2020
Posts: 172

PostPosted: Wed May 27, 2020 3:27 am    Post subject: Reply with quote

Thank you ParkourPenguin.

So you are basically overwritting CL? Or you are just adding in code to the function?

Your example seems simple and effective i will test with it first. But i have little experience with injection in cheat engine.

I want it to make a c++ injection, which i more familiarized with. But thats too much for now.


>Alternatively, find calls to the function and change the argument(s) there. In CE you'd use Tools -> Dissect Code on the exe, then look at Empires2.exe+174A0 and see what calls it.
You could also set a breakpoint and look at the return address the call left on the stack.


I have that already. I have all the functions that lead to this function. But i dont understand how can i get the arguments out of it:

That address in the image below is what calls our function 4174A0.

How do i check the argument that is being passed? I feel like a monkey looking at it.



function that calls stance function.jpg
 Description:
 Filesize:  429.6 KB
 Viewed:  1091 Time(s)

function that calls stance function.jpg


Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4299

PostPosted: Wed May 27, 2020 10:49 am    Post subject: Reply with quote

LongBeardedLion wrote:
So you are basically overwritting CL? Or you are just adding in code to the function?
  1. Find the injection point (aobscan)
  2. Allocate some memory in the target process (alloc)
  3. Write come code in that allocated memory (newmem: ...)
  4. Modify code at the injection point to either jump or call the new code (ChangeStanceInject+1: ...)

LongBeardedLion wrote:
But i dont understand how can i get the arguments out of it:
In the callee, the argument is stored at [esp+8].
[esp] is a backup of esi, [esp+4] is the return address of the call instruction that called this function, and [esi+8] must be a parameter assigned by the caller prior to the call.
If I had to guess, I'd say the push eax instruction does that, but I'm not sure. That might be for the previous call a couple instructions above the call you're interested in.
You should look at that caller function in more detail- particularly inside that loop the call is in. It looks like it could be looping over a collection of units (perhaps selected units) and changing their stance, but that image doesn't show enough to give that statement any more significance than a wild guess.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites