Cheat Engine

Kajih · Cheater Reputation: 1 Joined: 08 Feb 2021 Posts: 32

Hi,
I've been playing around with mono instead of using AOBs and for some reason one injection always makes my game crash. I'm using the same method in multiple locations so I don't know why this instance is making it crash. Furthermore, when I use an AOB instead at the same location it works fine.

Here is my script for the Mono injection (I have another script that activates mono so that's ok):

Dark Byte · Posted: Fri Mar 05, 2021 9:48 am Post subject:

look at the alloc. You're not passing it the allocation region preference, so there is a (big) chance the allocated memory will be further then 2GB away from the jmp

therefore the jmp is 14 bytes, but your script doesn't seem to take into account that it's 14 bytes long

Kajih · Cheater Reputation: 1 Joined: 08 Feb 2021 Posts: 32

I believe I am not understanding how alloc works then, I was assuming that the allocation was at the injection point which now I understand is false.

so I know how to assign it with an AOB, however I am not familiar on how to assign the location in my alloc when using mono, how do I accomplish this?

Also you mention my jump is 14 bytes, I'm not quite sure how you've come to this number, and I do apologize for the newb questions, but how did you know that the jump is 14 bytes?

ParkourPenguin · Posted: Fri Mar 05, 2021 1:12 pm Post subject:

There are several instructions that use the "jmp" mnemonic. One jumps to a rel32 displacement- i.e. it can jump to any location within +-2GiB of the next instruction (RIP-relative). This takes up 5 bytes: one for the opcode and 4 bytes for the rel32 displacement.

Another jumps to an address stored in a register or at a memory location (r/m64). What CE does is store the address to jump to immediately after the jump instruction and use that as the target. This takes up a byte for the opcode, 5 bytes for the r/m64, and 8 bytes for the destination address - 14 bytes in total.

Kajih · Cheater Reputation: 1 Joined: 08 Feb 2021 Posts: 32

Ok... I don't quite understand yet, but I think I am getting there.

I am allocating memory with alloc(newmem,$1000). This memory is "somewhere" and I am using jmp newmem to get to it. However as I am not specifying where this memory is, my jmp instruction assumes that I mean a rel32 displacement where in fact I am likely further away than the 2GB range. So in a way I'm not reaching the correct location and probably causing an access violation?

so I think I understand the problem, but unfortunately I don't quite understand the solution with the code you provided. I do apologize again as I think I'm going to need a bit more clarification on the code part as to how I can fix what I currently have. Embarassed

sbryzl · Posted: Fri Mar 05, 2021 2:47 pm Post subject:

Kajih · Cheater Reputation: 1 Joined: 08 Feb 2021 Posts: 32

ah yeah that's what I thought as well but unfortunately the game still crashes when I add GameTime:Update to alloc:

sbryzl · Posted: Fri Mar 05, 2021 3:43 pm Post subject:

I don't know why it's crashing when enabled but when disabling there are only 3 bytes inserted which isn't enough to cover for even a 5 byte jump.

Usually when I get I crash I have an error message and I just leave that open and push it to the side then go to the location of the injection to see what happened. Press space on the jump to see where it goes. And if you have enough time before the crash put a trace on it to get some better details of what happened or set a breakpoint then inject then trace.

Did you need to include this in your mono script?
mov [rbp-24],00000000

ParkourPenguin · Posted: Fri Mar 05, 2021 4:17 pm Post subject:

Kajih · Cheater Reputation: 1 Joined: 08 Feb 2021 Posts: 32

The code works now that I included those 5 extra bytes.

I am still a bit unclear why I am including those in at all, I'm assuming I can't add the injection code on just those 3 bytes, from what I can gather, CE will add a 5 byte instruction there, so If I don't include at least 5 bytes, the jump instruction won't work correctly. I had removed the nop 5 padding as you mentioned because I thought I was just writing at the initial 3 bytes I didn't have to nop the remaining 5... so I was also misunderstanding what that line was doing as well I guess.

lol I think I need to take a step back and re-read everything you guys have explained so I can get my head around this a bit more because right now I think I'm more confused than I started :p

However I do appreciate you guys taking the time to explain this, very much appreciated. Very Happy

Kajih · Cheater Reputation: 1 Joined: 08 Feb 2021 Posts: 32

yeah I get it now lol (slow learner I guess). It just so happens that every single injection I have created thus far coincidently happened on instructions that already had five bytes so my approach wasn't causing any issues.

I was trying to inject at two different locations in my tests, one had 3 bytes (example provided) and one had 8 bytes, I thought that they were crashing for the same reason (in a way it was, just different amount of bytes to take into account). So naturally both of these were making the game crash because I wasn't compensating properly.

I want to thank you guys again for taking the time to respond. Mr. Green