Cheat Engine

[s3pt3mb3r]

First of all, I apologize for my poor English.
In Cheat Engine, there is a function called "code injection" acting replace particular assembly into 'jmp' instruction, and jump to a new memory region then execute instructions and jump back to the original place.
I'd like to know how to simulate it in x64 archtecture in C++.
I'm tryng to do DLL injection game hacking so all i talk is in dll.

I looked up about it and partially got some basic techniques.
1. I can allocate new memory region by this code below

[BoozeAddict]

1. If you're injecting a .dll, you don't really need to allocate memory, your function will get allocated in your dll anyways. Let's say your hooked function is "void MyFunction() { //somecode }"

2. You patch the jump with a memcpy. 1st parameter is destination (the address you want to patch (jump from), not the actual jump destination), 2nd parameter is the bytes you want to patch (pointer to an array/vector that holds your "jmp <address>" instruction in bytes), and 3rd parameter is size of the array.

3. Probably, yes. Just do it to make sure it's writable, no harm in doing that. first define a dword that will hold old protection information. then do a VrtualProtect(<the address you want to protect>, <how many bytes. it will protect the entire page (or 2) actually, but it doesn't matter.>, PAGE_EXECUTE_READWRITE (so we can do everything with it), &<the address of the variable you created to hold old protection>). After you're done, make sure you swap out the protection again, so instead of PAGE_EXECblahblah use your variable.

4. The opcode for a far absolute jmp is "ff 25 00 00 00 00 <(long long (8 bytes))address, in little endian>" . To reverse a long long (64 bits) to little endian, use "_byteswap_uint64(long long bytes)". (for 32 bits it would be _byteswap_ulong) That function is in "intrin.h". Address to jump back is just the address you jump from + size of instruction, nothing fancy. Short jump would be "E9 <size of jump>", and you get the size by doing a <destination address> - <jump address> + <byes size of instrcution>, but that only works with jumps of 32 bits in size.

Edit : just thought of an untested idea, but you can also probably make a struct with the instructions, then just directly write to the pointer, so you don't need to worry about the little endian.
MyNewStruct* originalAddress = <whatever>;
originalAddress = mystruct;. Still need to protect it, of course.

[s3pt3mb3r]

I really, EXTREMELY appreciate your reply! Thank you.
I didn't know that 1st parameter of "memcpy" is where i wanna jump from!
I found something that i couldn't understand, so I'm gonna write it.

First of all, what I wanna inject is like this. (including stolen bytes)