Cheat Engine

[chodness]

Hey guys, I've got an issue I unfortunately don't know nearly enough about assembly to diagnose: (each isolated segment of of bytecode and opcodes are supposed to be interchangeable - it helped me with bug testing )

[ParkourPenguin]

Under what conditions would CE assemble that to a 14-byte jump? Give the virtual address of newmem and the virtual address of the injection point (not module.exe+offset).

Let CE build the basics of the script for you. Highlight the instruction at "ROTTR.exe"+3A76924 and use Template -> AOB Injection.

[Dark Byte]

If your code can somehow generate a 14 byte jmp (e.g you use kernelmode query memory fir some weird reason), then do not use nops/returnhere , but jump to codeinjection+d+possibleoverhead and always use the 14 bytes for the original code (+overhead)

[predprey]

i had asked a similar topic before. you can force the jmp type by adding short/long after.

i.e. jmp (short/long) (label/symbol)

[chodness]

@ParkourPenguin: I'm not sure what the conditions are, with respect to memory or system conditions. All I know is, when the game is in the main menu, it creates near relative jumps just fine, but when I'm actually playing the game, it generates near absolute indirect jumps. And letting CE create my base code IS what I do, you can even see it in the basic formatting and comments on the enable and disable parts of the code. I just delete the parts of the base format that I don't use.

@Dark Byte: I'm pretty sure I'm not using kernelmode query memory. My CE is straight-out-of-the-box settings, except I've switched to the VEH debugger because the Windows debugger crashes everything. Could you explain more about the codeinjection+d+possibleoverhead ? That went way over my understanding. I'll see if Google can teach me something about it, as well.

@predprey: I'm not 100% certain that'll work for me, since both types of jump that are being assembled are nears, but I'll give it a shot.

[ParkourPenguin]

[chodness]

Oh, my mistake, I didn't read the sentence after "under what conditions would...". When it's jumping NAI, it's jumping from (at least under the current conditions) 0143A76937 to 00570000.

Another mistake I made was that I was using the "Code injection" menu option and not the "AoB injection" menu option. As far as I can tell, the only differences are: 1) the former doesn't do an AoB scan, it just injects at that module address, and 2) when it allocates memory, it allocates 2048 bytes, instead of $1000. I'll admit that I don't know the difference between using the $ sign before the number of bytes to be allocated, but beyond that it looks exactly like my original code does, minus my additions to the code post-jump.

Here's the base code after using Code injection:

[ParkourPenguin]

Ignore the short/long recommendation; that's for 8-bit vs 32-bit relative addressing.

Are you doing anything abnormal (e.g. aforementioned kernel query memory region)? If not, it should not be possible for CE to allocate that memory in that region. Try testing an SSCCE that only allocates memory around that region.

The point I was trying to get across by telling you to use CE's template was that those comments and db pseudoinstructions were your fabrications. Notice how the template does not have any comments like db E9 ** ** ** ** (I don't know where you got that from). Because you edited out the mistake of using 4 nops instead of 5 like CE told you to do, I'll assume that has no baring on the cause of your problem.

Side note: I originally used the AoB injection template because it's more stable if a new version comes out. Even if you don't use an AoB scan, at least assert the bytes you're overriding so you don't accidentally mess up stuff you didn't mean to.

[chodness]

I don't believe I'm doing anything abnormal. Like I mentioned before, I'm using standard settings (minus the change to VEH debugger). Assuming I'm wrong, though, how do I check whether or not I'm using kernelmode query memory region? The only thing I can find is Settings->Extras->Query memory region, which is unchecked.

Also, how do I force CE to only allocate memory around that region? I figured putting the location inside the alloc() call (e.g. alloc(newmem,2048,"ROTTR.exe"+3A76924) ) would do it, but it's still alocating memory outside that region.

EDIT: I tried checking the Query memory region box, just to see what would happen. It loaded dbk64.sys, there was no change in the location of the allocated memory region. I tried restarting CE, and got a page fault in nonpaged area when CE tried to attach to the process. (I'm assuming it was because I didn't reboot with unsigned drivers allowed, like the menu tells me to. I'm also assuming that anything that causes me to crash if I'm not paying attention is not the intended use of CE, so I disabled it again)

As for my original post, I edited it because I realized a couple things: 1) I had the wrong number of 90's to coincide with the number of nop's I wanted. That didn't end up mattering, though I took the base injection template and then replaced the nops with db 90s because I was seeing assembly instructions I didn't want in my memory viewer, and the last time that happened, it was solved by using direct byte writes instead of just opcodes (CE was turning short conditional jumps into near relative jumps - I wanted something like 7F 02 and it was giving me something like E9 ** ** ** ** where the stars were the address for 2 bytes ahead of EIP - which was technically correct, but I was an idiot who was micro-optimizing at the time).

Anyway, 2) all the comments were drawing attention away from my actual issue, which was the comment above "jmp newmem" (which was essentially "why is it generating this 14-byte jmp operation, where the asterisks are the memory location of where to jump, instead of this 5-byte one, where the asterisks are the memory location of where to jump?")

[ParkourPenguin]

The 14 byte jmp is being generated because the address you're jumping to is further than 2GB away from the address you're jumping from (i.e. not signed dword encodable = no rel32 jmp).

The third parameter to alloc makes CE allocate memory within 2GB of that region. Unless CE can't understand the symbol "ROTTR.exe"+3A76924 (it should be able to), I can't think of any explanation as to why you can't get this to work. Try removing the quotes and see if it works.

[chodness]

It did not work. This time, it allocated closer than previous attempts (jump to 381A0000 from 0143A76924) but that's still outside the 2GB range.

On a side note, is that why older programs that use a lot of memory have to be made large address aware? Because they don't jump outside of a 2GB region of memory?

[ParkourPenguin]

At this point, I can only suggest the basic troublshooting stuff. Disable any antivirus software and/or reinstall CE. Neither I nor anyone else (to the best of my knowledge) have had any problems with CE allocating memory where it should with the latest official release.

There's a difference between 32-bit applications and 64-bit applications. Use Google for more information.

[Zanzer]

When you use the AOB Injection CE creates and don't change a thing, the game crashes when it's enabled?

[Csimbi]

Hi Guy,
sorry about resurrecting this thread, but I have a problem and I think this thread is the best fit.

So, I have an AA script that injects code into a mono game.
The AA script I generated contains a 5byte jump and a 5byte return jump.

The game is crashing randomly so I started looking around.

What I noticed is that randomly, the jump becomes a 14byte jump.
Not always, say, 40% of the cases.
When this happens, the 14byte jump overwrites tons of code that was supposed to stay there and the return 14byte jump points in the middle of the first jump.

I figured the only way around this sporadic behavior would be forcing the 14byte jump every time.
Question is: how do I force a jump to be a 14byte jump in AA?
Is there a jmp14 command?

Thank you!

[panraven]

The 'long' jump is make by ce, It is just like there is no actual 'nop 8' instruction but ce created for better disassemble display.

The 'long' jump can be make like