 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
makotech222
Expert Cheater
![]() Reputation: 0
Joined: 12 May 2011
Posts: 199
|
 Posted: Mon Dec 21, 2020 4:10 pm Post subject: Any way to AOB on possible values? |
 |
|
I'm working on a cheat table for the yuzu emulator, and sometimes when the Yuzu jits code, it can switch around the registers. For example,
mov [rax+r12],r13
to
mov [r12+rax],r13
This causes the AOB to be slightly different. I know we can use '??' in the AOB for a wildcard case, but for yuzu this ends up giving too many results. Is there a way to only match for possible values, like 00 01 57/56 20, where 57/56 can match both values in that address?
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4705
|
| Posted: Mon Dec 21, 2020 7:06 pm Post subject: |
|
|
Not that I'm aware of. You'd need to implement that yourself.
| Code: | [ENABLE]
{$lua}
local result = AOBScan(...)
assert(result and result.Count > 0)
local address
for i=0,result.Count - 1 do
address = result[i]
if good(address) then -- filter results here
break
end
end
result.destroy()
assert(address)
return ('define(INJECT,%08X)'):format(getAddress(address))
{$asm}
// this should work with define(...) I think
registersymbol(INJECT)
... |
You could also add more bytes to the pattern if it's not unique enough. Wildcards can work on a nibble granularity (e.g. 4? finds 40-4F inclusive).
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
daspamer
Grandmaster Cheater Supreme
 Reputation: 54
Joined: 13 Sep 2011
Posts: 1588
|
| Posted: Mon Dec 21, 2020 7:20 pm Post subject: |
|
|
Let's say I have 2 possible aobs
| Quote: | 89 C9 4C 8B 14 CA 41 8B
89 C9 4C 8B 14 C8 49 8D |
So we can build an OrAob:
| Quote: | | 89 C9 4C 8B 14 41|49 CA|C8 |
In bold are the change bytes, the following script will convert the aob into
| Quote: | | 89 C9 4C 8B 14 C8 ?? ?? |
and will check check each of 'Or Bytes' of the aob.
note that it could return incorrect address as the following aobs are valid
| Quote: | 89 C9 4C 8B 14 CA 41 8B
89 C9 4C 8B 14 CA 41 8D
89 C9 4C 8B 14 C8 49 8D
89 C9 4C 8B 14 C8 49 8B |
Note: the more 'Or Bytes' you include the script is more likely to pick on incorrect aobs, it is possible to add 'strict' option (that would check same n portion of each 'Or Bytes' per address)
You may put how many 'Or Bytes' you want (e.g '00 01 02|03|04|05|6 FF EE DD CC BB AA')
| Code: | -- AOBScanOr('XX XX XX YY|ZZ XX XX XX YY|ZZ');
-- XX XX XX YY XX XX XX YY|ZZ
-- XX XX XX YY XX XX XX YY
-- XX XX XX YY XX XX XX ZZ
-- XX XX XX ZZ XX XX XX YY|ZZ
-- XX XX XX ZZ XX XX XX YY
-- XX XX XX ZZ XX XX XX ZZ
function AOBScanOr(aob) -- only string
if (type(aob) == 'string') then
aob = aob:gsub('[^%x%|%s%?]+',''):gsub('%s+',' '); -- clean up and remove exceesive space
local orOffset,orOffsetSize,byteNum = {},0,0;
for byte in aob:gmatch('%S+') do
byteNum = byteNum+1; -- total bytes
if (byte:match('|')) then
orOffset[byteNum] = {};
orOffsetSize = orOffsetSize + 1;
for orByte in byte:gmatch('%x+[^|]?') do -- incase some genius would want to do xx|yy|??
table.insert(orOffset[byteNum],tonumber(orByte,16));
end
end
end
local aobs = AOBScan(aob:gsub('%x+%|%x+','??')) -- get rid of the 'or' bytes
local targetAddress
if (aobs) then
for i=0,aobs.Count-1 do
local address = aobs.getString(i);
local bytes,matchCount = readBytes(address,byteNum,true); -- better than multiple readBytes;
local matchCount = 0;
for offset,orBytes in pairs(orOffset) do
for _,byte in pairs(orBytes) do
if (byte == bytes[offset]) then
matchCount = matchCount + 1;
break;
end
end
end
if (matchCount == orOffsetSize) then
aobs.destroy();
return address
end
end
aobs.destroy();
end
end
end
registerAutoAssemblerCommand('aobscanOr',function(line)
local name,bytes = line:match('([^,]+),(.+)');
local address = AOBScanOr(bytes);
return ('define(%s,%s)'):format(name,address);
end)
--[[
--lua call
AOBScanOr("89 C9 4C 8B 14 CA|C8 41|49");
-- AA call
aobscanor(myAob,89 C9 4C 8B 14 CA|C8 41|49)
registersymbol(myAob)
--]] |
Placed attached script in autorun to include it always.
| Description: |
|
Download |
| Filename: |
AOBScanOr.lua |
| Filesize: |
1.8 KB |
| Downloaded: |
231 Time(s) |
_________________
I'm rusty and getting older, help me re-learn lua. |
|
| Back to top |
|
|
makotech222
Expert Cheater
![]() Reputation: 0
Joined: 12 May 2011
Posts: 199
|
| Posted: Tue Dec 22, 2020 11:38 pm Post subject: |
|
|
| Very cool, thanks guys! Ill give them a try next time i boot it up.
|
|
| Back to top |
|
|
Arcansel
Cheater
![]() Reputation: 0
Joined: 04 Jun 2022
Posts: 28
|
| Posted: Mon Aug 22, 2022 8:58 am Post subject: |
|
|
I can't seem to make this script work, it keeps giving me nil error on the alloc line, looks like it is conflicting with INJECT for some reason.
| Code: |
aobscanor(INJECT,43 8B 44 25 00 89 C0 66 48 0F 6E C8 * * * * |1 2 3 4 5|F)
alloc(newmem,$1000,INJECT)
|
The rest of the code is okay as it works with the correct aob and it was generated from Aob Injection template, only the aobscanor line is diferent than the rest.
The intention is to have it accept either 1,2,3,4 or 5 before adding F, so it can be, 1F, 2F, 3F , 4F or 5F.
I m also on Yuzu and need this script for the same reasons as op.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
