Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


help create thread in float Value

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
SigmaWolf-.-...
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 6

PostPosted: Mon Oct 10, 2022 12:27 am    Post subject: help create thread in float Value Reply with quote

hello guys I need some info it has been years last time I scribbled with assembly but recently started again now I have to get all the gears straight again...
what I struggle with in particular is that I saw this video from Mr.Stephen Chapman I like watching his tutorials, now this video
shows how to create a thread on how to make anything regenerate..
I have tried it on this game Vampyr but with no success well at least I got it right but the problem is that the value I have is a float and not 4 bytes now the value is counting up in 4 bytes instead of a float if anybody would be so kind is to take the script i have and show me how to change it so that it recognizes it as a float not 4 byte would be much appreciated
thank you in advance...



BloodRegen.png
 Description:
 Filesize:  705.05 KB
 Viewed:  4687 Time(s)

BloodRegen.png


Back to top
View user's profile Send private message
cooleko
Grandmaster Cheater
Reputation: 11

Joined: 04 May 2016
Posts: 717

PostPosted: Mon Oct 10, 2022 1:52 am    Post subject: Reply with quote

Inc works for integers, not floats.
Use addss instead.

Read this to explain using floats: https://wiki.cheatengine.org/index.php?title=Tutorial:CodeInjection_Floats
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 62

Joined: 01 Oct 2008
Posts: 959

PostPosted: Mon Oct 10, 2022 2:13 am    Post subject: Reply with quote

The pointer address [[BloodBase]+f8] in mov rax,[[BloodBase]+f8] will only evaluated ONCE while the script activated,
which may be error-prone if BloodBase might change; it is better use a register to hold the value, and use as pointer only if the register value is valid <eg. non zero>; then

Code:

label(KFloats)
....
mov   rax,BloodBase
mov   rax,[rax]
test rax,rax
je    wait
movss xmm0,[rax+f8]
addss xmm0,[KFloats]  /// +1.0, compare to integer inc instruction
/// if need to round to integer
  addss xmm0,[KFloats+4]/// +0.5 to round up, or may be +0.4999 ?
  cvtss2si edx,xmm0  /// to integer
  cvtsi2ss xmm0,edx  /// back to float
/// round end
movss [rax+f8],xmm0 /// store current
mov  edx,[rax+100] /// load max first, so we can ready to replace current if current > max
cmp  edx,[rax+f8]
jge   @f
  mov  [rax+f8],edx  /// set current as max
@@:
jmp   wait
KFloats:
dd (float)1,(float)0.5
...

_________________
- Retarded.
Back to top
View user's profile Send private message
SigmaWolf-.-...
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 6

PostPosted: Mon Oct 10, 2022 3:12 am    Post subject: Reply with quote

Thanx for the reply guys...
I have tried your guys' methods but have failed but I will Practice making threads seems like I have to play with it a more to understand it but I have succeeded doing it the old way....

[ENABLE]
define(BloodRegen,"AVGame-Win64-Shipping.exe"+4FE85D)
//aobscanmodule(BloodRegen,AVGame-Win64-Shipping.exe,F3 0F 10 B0 00 01 00 00 0F) // should be unique
alloc(newmem,$1000,BloodRegen)

label(code)
label(originalcode)
label(bloodinc)
label(return)

newmem:

code:
push ebx
mov ebx,[rax+F8] // cap of the blood
cmp [rax+100],ebx ////Here I want to cmp value with cap then jmp
to wait
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
pop ebx
jmp return


originalcode:
movss xmm6,[rax+00000100]
jmp return

bloodinc:
dd (float)1

BloodRegen:
jmp newmem
nop 3
return:
registersymbol(BloodRegen)

[DISABLE]

BloodRegen:
db F3 0F 10 B0 00 01 00 00

unregistersymbol(BloodRegen)
dealloc(newmem)

but now I dont know how to put the timer delay this way...want the blood value to increase by one float every 2 seconds until it reaches the cap value...
I feel I have to let you guys also know that this instruction is where it is constantly reading
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 62

Joined: 01 Oct 2008
Posts: 959

PostPosted: Mon Oct 10, 2022 4:29 am    Post subject: Reply with quote

If your inject point run every frame
Code:

label(fpscnt)
...
inc  dword ptr[fpscnt]
and dword ptr[fpscnt],01f  //// zero flag every 32th execution, 03f for 64 frames, 07f for 128 frames
jne   @f  /// only do inc when zero flag occurs
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
pop ebx   //// should use 64bit reg push rbx
jmp return
fpscnt:
dd 0
...

the fps-cycle is not adjustable tho.


ADDED:
you should use 64-bit register that means to be address in 64-bit target process, here CE might do it for you, but it is better understand how it work/represent.

_________________
- Retarded.
Back to top
View user's profile Send private message
SigmaWolf-.-...
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 6

PostPosted: Mon Oct 10, 2022 4:48 am    Post subject: Reply with quote

Thank you very much im so hype that I have learned something new....struggled with this for days....thanx man apreciate it ....couldn't thank you enough....
Back to top
View user's profile Send private message
Csimbi
I post too much
Reputation: 97

Joined: 14 Jul 2007
Posts: 3338

PostPosted: Mon Oct 10, 2022 12:06 pm    Post subject: Reply with quote

This was my old Blood Drain mod script for Vampyr.
I doubt it still works, and it's not treaded, but it might give you some hints.
Code:
// Game   : AVGame-Win64-Shipping.exe
// Version:
// Date   :
// Author : Cs
[ENABLE]
aobscanmodule(aobBloodDrainCalc,AVGame-Win64-Shipping.exe,48 8B D9 0F 29 7C 24 ?? 0F 57 F6 0F 28 F9 0F 2F FE 76)

alloc(newmemBloodDrainCalc,4096,aobBloodDrainCalc)

label(aobBloodDrainCalc_r)
label(aobBloodDrainCalc_i)
registersymbol(aobBloodDrainCalc_r)
registersymbol(aobBloodDrainCalc_i)

label(lblBloodDrainCalc)
label(lblBloodDrainCalcSkip)
label(lblBloodDrainCalcRet)

label(bEnablePlayerBloodDrainMod)
label(fPlayerBloodDrainMod)
registersymbol(bEnablePlayerBloodDrainMod)
registersymbol(fPlayerBloodDrainMod)

newmemBloodDrainCalc:
bEnablePlayerBloodDrainMod:
dd 1
fPlayerBloodDrainMod:
dd (float)0.2

lblBloodDrainCalc:
cmp qword ptr [pPlayerBlood],rcx
jne short lblBloodDrainCalcSkip
cmp dword ptr [bEnablePlayerBloodDrainMod],1
jne short lblBloodDrainCalcSkip
mulss xmm1,[fPlayerBloodDrainMod]
lblBloodDrainCalcSkip:
//Alt: mov rbx,rcx
//Alt: movaps [rsp+20],xmm7
//db 48 8B D9 0F 29 7C 24 20
readmem(aobBloodDrainCalc,8)
jmp lblBloodDrainCalcRet
aobBloodDrainCalc_i:
readmem(aobBloodDrainCalc,8)

//"AVGame-Win64-Shipping.exe"+3F9A6B:
aobBloodDrainCalc:
aobBloodDrainCalc_r:
jmp lblBloodDrainCalc
nop
nop
nop
lblBloodDrainCalcRet:

[DISABLE]
//"AVGame-Win64-Shipping.exe"+3F9A6B:
//Alt: mov rbx,rcx
//Alt: movaps [rsp+20],xmm7
//db 48 8B D9 0F 29 7C 24 20
aobBloodDrainCalc_r:
readmem(aobBloodDrainCalc_i,8)

unregistersymbol(aobBloodDrainCalc_r)
unregistersymbol(aobBloodDrainCalc_i)

unregistersymbol(bEnableBloodDrainCalc)

dealloc(newmemBloodDrainCalc)

{
// ORIGINAL CODE - INJECTION POINT: "AVGame-Win64-Shipping.exe"+3F9A6B

"AVGame-Win64-Shipping.exe"+3F9A50: 48 8B CB                 -  mov rcx,rbx
"AVGame-Win64-Shipping.exe"+3F9A53: 48 83 C4 20              -  add rsp,20
"AVGame-Win64-Shipping.exe"+3F9A57: 5B                       -  pop rbx
"AVGame-Win64-Shipping.exe"+3F9A58: E9 53 8E 1A 00           -  jmp AVGame-Win64-Shipping.exe+5A28B0
"AVGame-Win64-Shipping.exe"+3F9A5D: CC                       -  int 3
"AVGame-Win64-Shipping.exe"+3F9A5E: CC                       -  int 3
"AVGame-Win64-Shipping.exe"+3F9A5F: CC                       -  int 3
"AVGame-Win64-Shipping.exe"+3F9A60: 40 53                    -  push rbx
"AVGame-Win64-Shipping.exe"+3F9A62: 48 83 EC 40              -  sub rsp,40
"AVGame-Win64-Shipping.exe"+3F9A66: 0F 29 74 24 30           -  movaps [rsp+30],xmm6
// ---------- INJECTING HERE ----------
"AVGame-Win64-Shipping.exe"+3F9A6B: 48 8B D9                 -  mov rbx,rcx
"AVGame-Win64-Shipping.exe"+3F9A6E: 0F 29 7C 24 20           -  movaps [rsp+20],xmm7
// ---------- DONE INJECTING  ----------
"AVGame-Win64-Shipping.exe"+3F9A73: 0F 57 F6                 -  xorps xmm6,xmm6
"AVGame-Win64-Shipping.exe"+3F9A76: 0F 28 F9                 -  movaps xmm7,xmm1
"AVGame-Win64-Shipping.exe"+3F9A79: 0F 2F FE                 -  comiss xmm7,xmm6
"AVGame-Win64-Shipping.exe"+3F9A7C: 76 77                    -  jna AVGame-Win64-Shipping.exe+3F9AF5
"AVGame-Win64-Shipping.exe"+3F9A7E: 48 8B 81 E8 00 00 00     -  mov rax,[rcx+000000E8]
"AVGame-Win64-Shipping.exe"+3F9A85: 48 85 C0                 -  test rax,rax
"AVGame-Win64-Shipping.exe"+3F9A88: 75 05                    -  jne AVGame-Win64-Shipping.exe+3F9A8F
"AVGame-Win64-Shipping.exe"+3F9A8A: E8 D1 E8 7B 01           -  call AVGame-Win64-Shipping.exe+1BB8360
"AVGame-Win64-Shipping.exe"+3F9A8F: F3 0F 10 8B 00 01 00 00  -  movss xmm1,[rbx+00000100]
"AVGame-Win64-Shipping.exe"+3F9A97: F3 0F 10 15 AD 7E C6 02  -  movss xmm2,[AVGame-Win64-Shipping.exe+306194C]
}
Back to top
View user's profile Send private message
SigmaWolf-.-...
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 6

PostPosted: Mon Oct 10, 2022 3:05 pm    Post subject: Reply with quote

last Question guys
it works 100 % only problem I have now is when I compare it it kicks me out of the game I need the script to stop when it reaches its cap my script looks like this now

label(code)
label(fpscnt)
label(originalcode)
label(bloodinc)
label(return)

newmem:

code:
push rbx
mov rbx,[rax+F8] <<<<this is Cap
cmp [rax+100],rbx
//if I place jump in here it kicks me out of game
inc dword ptr [fpscnt]
and dword ptr [fpscnt],01f
jne @f
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
pop rbx
jmp return


originalcode:
movss xmm6,[rax+00000100]
jmp return

fpscnt:
dd 0

bloodinc:
dd (float)1

BloodRegen:
jmp newmem
nop 3
return:
registersymbol(BloodRegen)

thanx again guys
and one last thing where can I read more about this so that i can learn more out of it how it works or represents

inc dword ptr[fpscnt]
and dword ptr[fpscnt],01f //// zero flag every 32th execution, 03f for 64 frames, 07f for 128 frames
jne @f /// only do inc when zero flag occurs
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:
pop ebx //// should use 64bit reg push rbx
jmp return
fpscnt:
dd 0
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 62

Joined: 01 Oct 2008
Posts: 959

PostPosted: Tue Oct 11, 2022 4:52 am    Post subject: Reply with quote

What the script with the problem jump?
btw, you can enclose CODE with [code]<code-text>[/code] to make <code-text> look more like code (not nest-able).
([code] is in unicode to escape from the formating, don't just copy and paste, type it as normal acsii char in the text box editor)

btw the compare to max should make AFTER your INC, else if max is make, the final value may/must be over max.

For individual x86 assembler instruction (what each instuction do), may be this https://www.felixcloutier.com/x86/ , it's more like a convenient online manual.
For AA script usage as assembler, may read other active cheat maker's uploaded ct file from fearlessrevolution.com

_________________
- Retarded.
Back to top
View user's profile Send private message
Csimbi
I post too much
Reputation: 97

Joined: 14 Jul 2007
Posts: 3338

PostPosted: Tue Oct 11, 2022 7:32 am    Post subject: Reply with quote

I don't get it.
What's the point of adding some value?
Why not just use the cap directly?
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 62

Joined: 01 Oct 2008
Posts: 959

PostPosted: Tue Oct 11, 2022 8:12 am    Post subject: Reply with quote

Csimbi wrote:
I don't get it.
What's the point of adding some value?
Why not just use the cap directly?


User option?
With adjustable increment value, the user can choose between a mild regen and almost-god-mode.

_________________
- Retarded.
Back to top
View user's profile Send private message
Csimbi
I post too much
Reputation: 97

Joined: 14 Jul 2007
Posts: 3338

PostPosted: Tue Oct 11, 2022 8:25 am    Post subject: Reply with quote

panraven wrote:
User option?
With adjustable increment value, the user can choose between a mild regen and almost-god-mode.

That does make sense, thanks!
Back to top
View user's profile Send private message
SigmaWolf-.-...
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 6

PostPosted: Tue Oct 11, 2022 10:51 pm    Post subject: Reply with quote

btw, you can enclose CODE with [code]<code-text>[/code] to make <code-text> look more like code (not nest-able).
([code] is in unicode to escape from the formating, don't just copy and paste, type it as normal acsii char in the text box editor)

btw the compare to max should make AFTER your INC, else if max is make, the final value may/must be over max

Sorry i dont understand this concept...how would you add this into my script ???Sorry im kinda new to this new ways

I geuss i cant jump because i think this script is made where the code. is constantly reading not wtiting i think that might be the problem ....

To awnser your qeustion why i dont want cap to write in my normal blood value is the same Panraven gave you but also I do the aseembly for the fun and to learn sometimes i dont even use the cheat I just like doing it....thank you guys for your tremendous help coulnt have done this without your help...
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 62

Joined: 01 Oct 2008
Posts: 959

PostPosted: Wed Oct 12, 2022 2:04 am    Post subject: Reply with quote

I mean MOVE the cmp code after inc code.
Code:

code:
push rbx
inc dword ptr [fpscnt]
and dword ptr [fpscnt],01f
jne @f
fld dword ptr [rax+100]
fadd dword ptr [bloodinc]
fstp dword ptr [rax+100]
@@:

mov ebx,[rax+F8]      /// ebx is use as 4 byte data
cmp [rax+100],ebx    /// otherwise, rbx is 64 bit, the cmp will include more data
jle   @f  /// skip if current less/equal max
  mov [rax+100],ebx 
@@:
pop rbx
jmp return
fpscnt:
dd 0



NOTE:
@@:
^ this is anonymous label, which is a convenient way to make a label in place, ie.
don't need to declared label(...) in strict mode and invent a name,
however it not necessary match a previous @f or next @b,
where @f/@b means the first forward/backward label <named or anonymous>.
eg.
Code:

jmp   @f   --> this will jump to NamedLabel: / mov ebx,... not @@:
mov   eax,...
NamedLabel:
mov   ebx,...
@@:
mov   ecx,...

It may have different behavior in other assembler.

_________________
- Retarded.
Back to top
View user's profile Send private message
SigmaWolf-.-...
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 6

PostPosted: Mon Oct 17, 2022 9:09 am    Post subject: Reply with quote

Thank you very much guys I appreciate it it works now 100%
you have taught me much with this...just shows me no matter how much you think you know there is always more to learn...thank you Panraven and Csimbi
I will use this technique much more now...Thanx again for your help
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites