 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
SigmaWolf-.-... How do I cheat?
Reputation: 0
Joined: 10 Oct 2022 Posts: 6
|
Posted: Mon Oct 10, 2022 12:27 am Post subject: help create thread in float Value |
|
|
hello guys I need some info it has been years last time I scribbled with assembly but recently started again now I have to get all the gears straight again...
what I struggle with in particular is that I saw this video from Mr.Stephen Chapman I like watching his tutorials, now this video
shows how to create a thread on how to make anything regenerate..
I have tried it on this game Vampyr but with no success well at least I got it right but the problem is that the value I have is a float and not 4 bytes now the value is counting up in 4 bytes instead of a float if anybody would be so kind is to take the script i have and show me how to change it so that it recognizes it as a float not 4 byte would be much appreciated
thank you in advance...
| Description: |
|
| Filesize: |
705.05 KB |
| Viewed: |
4687 Time(s) |

|
|
|
| Back to top |
|
 |
cooleko Grandmaster Cheater
Reputation: 11
Joined: 04 May 2016 Posts: 717
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 959
|
Posted: Mon Oct 10, 2022 2:13 am Post subject: |
|
|
The pointer address [[BloodBase]+f8] in mov rax,[[BloodBase]+f8] will only evaluated ONCE while the script activated,
which may be error-prone if BloodBase might change; it is better use a register to hold the value, and use as pointer only if the register value is valid <eg. non zero>; then
| Code: |
label(KFloats)
....
mov rax,BloodBase
mov rax,[rax]
test rax,rax
je wait
movss xmm0,[rax+f8]
addss xmm0,[KFloats] /// +1.0, compare to integer inc instruction
/// if need to round to integer
addss xmm0,[KFloats+4]/// +0.5 to round up, or may be +0.4999 ?
cvtss2si edx,xmm0 /// to integer
cvtsi2ss xmm0,edx /// back to float
/// round end
movss [rax+f8],xmm0 /// store current
mov edx,[rax+100] /// load max first, so we can ready to replace current if current > max
cmp edx,[rax+f8]
jge @f
mov [rax+f8],edx /// set current as max
@@:
jmp wait
KFloats:
dd (float)1,(float)0.5
...
|
_________________
- Retarded. |
|
| Back to top |
|
 |
SigmaWolf-.-... How do I cheat?
Reputation: 0
Joined: 10 Oct 2022 Posts: 6
|
Posted: Mon Oct 10, 2022 3:12 am Post subject: |
|
|
Thanx for the reply guys...
I have tried your guys' methods but have failed but I will Practice making threads seems like I have to play with it a more to understand it but I have succeeded doing it the old way....
[ENABLE]
define(BloodRegen,"AVGame-Win64-Shipping.exe"+4FE85D)
//aobscanmodule(BloodRegen,AVGame-Win64-Shipping.exe,F3 0F 10 B0 00 01 00 00 0F) // should be unique
alloc(newmem,$1000,BloodRegen)
label(code)
label(originalcode)
label(bloodinc)
label(return)
newmem:
code:
push ebx
mov ebx,[rax+F8] // cap of the blood
cmp [rax+100],ebx ////Here I want to cmp value with cap then jmp
to wait
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
pop ebx
jmp return
originalcode:
movss xmm6,[rax+00000100]
jmp return
bloodinc:
dd (float)1
BloodRegen:
jmp newmem
nop 3
return:
registersymbol(BloodRegen)
[DISABLE]
BloodRegen:
db F3 0F 10 B0 00 01 00 00
unregistersymbol(BloodRegen)
dealloc(newmem)
but now I dont know how to put the timer delay this way...want the blood value to increase by one float every 2 seconds until it reaches the cap value...
I feel I have to let you guys also know that this instruction is where it is constantly reading
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 959
|
Posted: Mon Oct 10, 2022 4:29 am Post subject: |
|
|
If your inject point run every frame
| Code: |
label(fpscnt)
...
inc dword ptr[fpscnt]
and dword ptr[fpscnt],01f //// zero flag every 32th execution, 03f for 64 frames, 07f for 128 frames
jne @f /// only do inc when zero flag occurs
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
pop ebx //// should use 64bit reg push rbx
jmp return
fpscnt:
dd 0
...
|
the fps-cycle is not adjustable tho.
ADDED:
you should use 64-bit register that means to be address in 64-bit target process, here CE might do it for you, but it is better understand how it work/represent.
_________________
- Retarded. |
|
| Back to top |
|
 |
SigmaWolf-.-... How do I cheat?
Reputation: 0
Joined: 10 Oct 2022 Posts: 6
|
Posted: Mon Oct 10, 2022 4:48 am Post subject: |
|
|
| Thank you very much im so hype that I have learned something new....struggled with this for days....thanx man apreciate it ....couldn't thank you enough....
|
|
| Back to top |
|
 |
Csimbi I post too much
Reputation: 97
Joined: 14 Jul 2007 Posts: 3338
|
Posted: Mon Oct 10, 2022 12:06 pm Post subject: |
|
|
This was my old Blood Drain mod script for Vampyr.
I doubt it still works, and it's not treaded, but it might give you some hints.
| Code: | // Game : AVGame-Win64-Shipping.exe
// Version:
// Date :
// Author : Cs
[ENABLE]
aobscanmodule(aobBloodDrainCalc,AVGame-Win64-Shipping.exe,48 8B D9 0F 29 7C 24 ?? 0F 57 F6 0F 28 F9 0F 2F FE 76)
alloc(newmemBloodDrainCalc,4096,aobBloodDrainCalc)
label(aobBloodDrainCalc_r)
label(aobBloodDrainCalc_i)
registersymbol(aobBloodDrainCalc_r)
registersymbol(aobBloodDrainCalc_i)
label(lblBloodDrainCalc)
label(lblBloodDrainCalcSkip)
label(lblBloodDrainCalcRet)
label(bEnablePlayerBloodDrainMod)
label(fPlayerBloodDrainMod)
registersymbol(bEnablePlayerBloodDrainMod)
registersymbol(fPlayerBloodDrainMod)
newmemBloodDrainCalc:
bEnablePlayerBloodDrainMod:
dd 1
fPlayerBloodDrainMod:
dd (float)0.2
lblBloodDrainCalc:
cmp qword ptr [pPlayerBlood],rcx
jne short lblBloodDrainCalcSkip
cmp dword ptr [bEnablePlayerBloodDrainMod],1
jne short lblBloodDrainCalcSkip
mulss xmm1,[fPlayerBloodDrainMod]
lblBloodDrainCalcSkip:
//Alt: mov rbx,rcx
//Alt: movaps [rsp+20],xmm7
//db 48 8B D9 0F 29 7C 24 20
readmem(aobBloodDrainCalc,8)
jmp lblBloodDrainCalcRet
aobBloodDrainCalc_i:
readmem(aobBloodDrainCalc,8)
//"AVGame-Win64-Shipping.exe"+3F9A6B:
aobBloodDrainCalc:
aobBloodDrainCalc_r:
jmp lblBloodDrainCalc
nop
nop
nop
lblBloodDrainCalcRet:
[DISABLE]
//"AVGame-Win64-Shipping.exe"+3F9A6B:
//Alt: mov rbx,rcx
//Alt: movaps [rsp+20],xmm7
//db 48 8B D9 0F 29 7C 24 20
aobBloodDrainCalc_r:
readmem(aobBloodDrainCalc_i,8)
unregistersymbol(aobBloodDrainCalc_r)
unregistersymbol(aobBloodDrainCalc_i)
unregistersymbol(bEnableBloodDrainCalc)
dealloc(newmemBloodDrainCalc)
{
// ORIGINAL CODE - INJECTION POINT: "AVGame-Win64-Shipping.exe"+3F9A6B
"AVGame-Win64-Shipping.exe"+3F9A50: 48 8B CB - mov rcx,rbx
"AVGame-Win64-Shipping.exe"+3F9A53: 48 83 C4 20 - add rsp,20
"AVGame-Win64-Shipping.exe"+3F9A57: 5B - pop rbx
"AVGame-Win64-Shipping.exe"+3F9A58: E9 53 8E 1A 00 - jmp AVGame-Win64-Shipping.exe+5A28B0
"AVGame-Win64-Shipping.exe"+3F9A5D: CC - int 3
"AVGame-Win64-Shipping.exe"+3F9A5E: CC - int 3
"AVGame-Win64-Shipping.exe"+3F9A5F: CC - int 3
"AVGame-Win64-Shipping.exe"+3F9A60: 40 53 - push rbx
"AVGame-Win64-Shipping.exe"+3F9A62: 48 83 EC 40 - sub rsp,40
"AVGame-Win64-Shipping.exe"+3F9A66: 0F 29 74 24 30 - movaps [rsp+30],xmm6
// ---------- INJECTING HERE ----------
"AVGame-Win64-Shipping.exe"+3F9A6B: 48 8B D9 - mov rbx,rcx
"AVGame-Win64-Shipping.exe"+3F9A6E: 0F 29 7C 24 20 - movaps [rsp+20],xmm7
// ---------- DONE INJECTING ----------
"AVGame-Win64-Shipping.exe"+3F9A73: 0F 57 F6 - xorps xmm6,xmm6
"AVGame-Win64-Shipping.exe"+3F9A76: 0F 28 F9 - movaps xmm7,xmm1
"AVGame-Win64-Shipping.exe"+3F9A79: 0F 2F FE - comiss xmm7,xmm6
"AVGame-Win64-Shipping.exe"+3F9A7C: 76 77 - jna AVGame-Win64-Shipping.exe+3F9AF5
"AVGame-Win64-Shipping.exe"+3F9A7E: 48 8B 81 E8 00 00 00 - mov rax,[rcx+000000E8]
"AVGame-Win64-Shipping.exe"+3F9A85: 48 85 C0 - test rax,rax
"AVGame-Win64-Shipping.exe"+3F9A88: 75 05 - jne AVGame-Win64-Shipping.exe+3F9A8F
"AVGame-Win64-Shipping.exe"+3F9A8A: E8 D1 E8 7B 01 - call AVGame-Win64-Shipping.exe+1BB8360
"AVGame-Win64-Shipping.exe"+3F9A8F: F3 0F 10 8B 00 01 00 00 - movss xmm1,[rbx+00000100]
"AVGame-Win64-Shipping.exe"+3F9A97: F3 0F 10 15 AD 7E C6 02 - movss xmm2,[AVGame-Win64-Shipping.exe+306194C]
}
|
|
|
| Back to top |
|
 |
SigmaWolf-.-... How do I cheat?
Reputation: 0
Joined: 10 Oct 2022 Posts: 6
|
Posted: Mon Oct 10, 2022 3:05 pm Post subject: |
|
|
last Question guys
it works 100 % only problem I have now is when I compare it it kicks me out of the game I need the script to stop when it reaches its cap my script looks like this now
label(code)
label(fpscnt)
label(originalcode)
label(bloodinc)
label(return)
newmem:
code:
push rbx
mov rbx,[rax+F8] <<<<this is Cap
cmp [rax+100],rbx
//if I place jump in here it kicks me out of game
inc dword ptr [fpscnt]
and dword ptr [fpscnt],01f
jne @f
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
pop rbx
jmp return
originalcode:
movss xmm6,[rax+00000100]
jmp return
fpscnt:
dd 0
bloodinc:
dd (float)1
BloodRegen:
jmp newmem
nop 3
return:
registersymbol(BloodRegen)
thanx again guys
and one last thing where can I read more about this so that i can learn more out of it how it works or represents
inc dword ptr[fpscnt]
and dword ptr[fpscnt],01f //// zero flag every 32th execution, 03f for 64 frames, 07f for 128 frames
jne @f /// only do inc when zero flag occurs
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
pop ebx //// should use 64bit reg push rbx
jmp return
fpscnt:
dd 0
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 959
|
Posted: Tue Oct 11, 2022 4:52 am Post subject: |
|
|
What the script with the problem jump?
btw, you can enclose CODE with [code]<code-text>[/code] to make <code-text> look more like code (not nest-able).
([code] is in unicode to escape from the formating, don't just copy and paste, type it as normal acsii char in the text box editor)
btw the compare to max should make AFTER your INC, else if max is make, the final value may/must be over max.
For individual x86 assembler instruction (what each instuction do), may be this https://www.felixcloutier.com/x86/ , it's more like a convenient online manual.
For AA script usage as assembler, may read other active cheat maker's uploaded ct file from fearlessrevolution.com
_________________
- Retarded. |
|
| Back to top |
|
 |
Csimbi I post too much
Reputation: 97
Joined: 14 Jul 2007 Posts: 3338
|
Posted: Tue Oct 11, 2022 7:32 am Post subject: |
|
|
I don't get it.
What's the point of adding some value?
Why not just use the cap directly?
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 959
|
Posted: Tue Oct 11, 2022 8:12 am Post subject: |
|
|
| Csimbi wrote: | I don't get it.
What's the point of adding some value?
Why not just use the cap directly? |
User option?
With adjustable increment value, the user can choose between a mild regen and almost-god-mode.
_________________
- Retarded. |
|
| Back to top |
|
 |
Csimbi I post too much
Reputation: 97
Joined: 14 Jul 2007 Posts: 3338
|
Posted: Tue Oct 11, 2022 8:25 am Post subject: |
|
|
| panraven wrote: | User option?
With adjustable increment value, the user can choose between a mild regen and almost-god-mode. |
That does make sense, thanks!
|
|
| Back to top |
|
 |
SigmaWolf-.-... How do I cheat?
Reputation: 0
Joined: 10 Oct 2022 Posts: 6
|
Posted: Tue Oct 11, 2022 10:51 pm Post subject: |
|
|
btw, you can enclose CODE with [code]<code-text>[/code] to make <code-text> look more like code (not nest-able).
([code] is in unicode to escape from the formating, don't just copy and paste, type it as normal acsii char in the text box editor)
btw the compare to max should make AFTER your INC, else if max is make, the final value may/must be over max
Sorry i dont understand this concept...how would you add this into my script ???Sorry im kinda new to this new ways
I geuss i cant jump because i think this script is made where the code. is constantly reading not wtiting i think that might be the problem ....
To awnser your qeustion why i dont want cap to write in my normal blood value is the same Panraven gave you but also I do the aseembly for the fun and to learn sometimes i dont even use the cheat I just like doing it....thank you guys for your tremendous help coulnt have done this without your help...
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 959
|
Posted: Wed Oct 12, 2022 2:04 am Post subject: |
|
|
I mean MOVE the cmp code after inc code.
| Code: |
code:
push rbx
inc dword ptr [fpscnt]
and dword ptr [fpscnt],01f
jne @f
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
mov ebx,[rax+F8] /// ebx is use as 4 byte data
cmp [rax+100],ebx /// otherwise, rbx is 64 bit, the cmp will include more data
jle @f /// skip if current less/equal max
mov [rax+100],ebx
@@:
pop rbx
jmp return
fpscnt:
dd 0
|
NOTE:
@@:
^ this is anonymous label, which is a convenient way to make a label in place, ie.
don't need to declared label(...) in strict mode and invent a name,
however it not necessary match a previous @f or next @b,
where @f/@b means the first forward/backward label <named or anonymous>.
eg.
| Code: |
jmp @f --> this will jump to NamedLabel: / mov ebx,... not @@:
mov eax,...
NamedLabel:
mov ebx,...
@@:
mov ecx,...
|
It may have different behavior in other assembler.
_________________
- Retarded. |
|
| Back to top |
|
 |
SigmaWolf-.-... How do I cheat?
Reputation: 0
Joined: 10 Oct 2022 Posts: 6
|
Posted: Mon Oct 17, 2022 9:09 am Post subject: |
|
|
Thank you very much guys I appreciate it it works now 100%
you have taught me much with this...just shows me no matter how much you think you know there is always more to learn...thank you Panraven and Csimbi
I will use this technique much more now...Thanx again for your help
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|