 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
BirchTree How do I cheat?
Reputation: 0
Joined: 30 Oct 2023 Posts: 3
|
Posted: Mon Oct 30, 2023 8:49 am Post subject: Struggling with calling a function using the Auto Assembler |
|
|
I'm pretty much a noob at this, but I'm trying to call a function on a game using the Auto Assembler.
In the memory viewer, I can see that the function is called like this:
| Code: | mov edx,fs:[0000002C]
mov eax,[Game.exe+D50500]
mov eax,[edx+eax*4]
mov edx,[esp+0C]
push 0F
push 00008000
add eax,00012B50
push eax
mov eax,[esp+14]
push edx
mov edx,[esp+14]
push eax
push 00
push edx
add ecx,04
call Game.exe+42A210
ret 000C |
I've set a breakpoint on this caller function and I've taken note of the values assigned to the registers when they are pushed so I can do the same on the Auto Assembler.
So I'm trying to call the function like this:
| Code: | [ENABLE]
alloc(thread, 256)
createthread(thread)
thread:
push 0000000F
push 00008000
push 01A578F0
push 00000005
push 000102CC
push 00000000
push 00000036
call Game.exe+42A210
ret
[DISABLE] |
However, that does nothing. If I set a breakpoint to Game.exe+42A210 before I execute this, it doesn't get triggered. I figured even if there was something wrong with the values, the breakpoint should trigger anyway, right?
Could somebody help me figure out what I'm doing wrong and maybe point me in the right direction?
|
|
| Back to top |
|
 |
Famine Cheater
Reputation: 0
Joined: 23 Oct 2023 Posts: 27 Location: A club where people wee on each other.
|
Posted: Mon Oct 30, 2023 9:28 am Post subject: |
|
|
Your goal is to call a function within the game's code by replicating the assembly instructions. However, there are a few issues with your script that could be preventing it from working correctly.
Here are some things to check and correct:
Memory Addresses: Verify that the addresses you are using in your script (Game.exe+42A210, 01A578F0, 000102CC, etc.) are still valid. Game updates or changes in memory allocation can lead to these addresses becoming outdated.
Register Values: Ensure that the values you push onto the stack (push 0000000F, push 00008000, etc.) match the values the game expects at those points in the function. If you've copied the assembly code correctly, this should be fine.
Calling Convention: Confirm that the function Game.exe+42A210 uses the same calling convention as your script. The calling convention determines how function parameters are passed and how the stack is cleaned up after the call. If it's not a standard calling convention, you may need to adapt your script.
Code Flow: Check if there are any conditional branches or other code that could prevent the function from being called. The original assembly code might be part of a larger context that you're not replicating in your script.
Memory Permissions: Make sure that the memory areas you're trying to modify or execute code in have the necessary read, write, and execute permissions. Some parts of the game's memory may be protected, and you might need to use additional techniques to modify them.
Debugger State: Ensure that the game is running and the debugger in Cheat Engine is attached to the game process. It's important to have the debugger running for breakpoints to work.
Thread Handling: Your script creates a new thread to execute the code. Make sure this is the intended behavior in the game. Some games may not support or allow external threads to interact with their code.
Error Handling: Check for any error messages or issues in the Cheat Engine log. It might provide insights into what's going wrong.
Debugging: You can try single-stepping through your script in Cheat Engine's debugger to see if the code execution proceeds as expected and identify any issues.
Game Updates: Keep in mind that game updates or anti-cheat measures can break your cheats. You may need to update your script to match the latest version of the game. If you've checked all these points and the script still doesn't work, you may need to delve deeper into reverse engineering and debugging to understand the game's code better.
_________________
| LeFiXER wrote: | You probably should read the replies to make sure someone else hasn't already mentioned what you are about to say. It gives the impression that you are ignorant of other members in this community.
|
|
|
| Back to top |
|
 |
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4711
|
Posted: Mon Oct 30, 2023 9:55 am Post subject: |
|
|
Are you using the VEH debugger? The thread probably finishes executing the code before the VEH debugger notices the thread exists. The windows debugger doesn't have this problem.
Do you know what calling convention the function uses? e.g. stdcall, cdecl...
`add ecx,04` is weird to have just before the call. ecx is typically a volatile register- there's no point to modify it before a call unless it's a parameter. Could be thiscall or fastcall.
I'd look at the function itself and see what it uses. Maybe check for globals too. You can't get the full story by just looking at a call to the function.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
 |
BirchTree How do I cheat?
Reputation: 0
Joined: 30 Oct 2023 Posts: 3
|
Posted: Mon Oct 30, 2023 10:53 am Post subject: |
|
|
| ParkourPenguin wrote: |
Are you using the VEH debugger? The thread probably finishes executing the code before the VEH debugger notices the thread exists. The windows debugger doesn't have this problem.
|
Yes, unfortunately the game detects the windows debugger. Is there any way I can make the breakpoint work with the VEH debugger?
| Famine wrote: |
Calling Convention: Confirm that the function Game.exe+42A210 uses the same calling convention as your script. The calling convention determines how function parameters are passed and how the stack is cleaned up after the call. If it's not a standard calling convention, you may need to adapt your script.
|
| ParkourPenguin wrote: |
Do you know what calling convention the function uses? e.g. stdcall, cdecl...
|
I have no idea.
This is the function that I want to call:
| Code: | push ebx
push esi
mov esi,ecx
cmp dword ptr [esi+00008134],00
push edi
setne bl
test bl,bl
je Game.exe+42A230
lea eax,[esi+00008138]
push eax
call dword ptr [Game.exe+9AA234]
mov ecx,[esp+28]
mov edx,[esp+24]
mov edi,[esp+20]
mov eax,[esp+1C]
push ecx
mov ecx,[esp+1C]
push edx
mov edx,[esp+1C]
push edi
push eax
mov eax,[esp+20]
push ecx
push edx
push eax
lea ecx,[esi+08]
call Game.exe+411FF0
push eax
push edi
mov ecx,esi
call Game.exe+429E10
mov [esp+28],al
test bl,bl
je Game.exe+42A27D
add esi,00008138
push esi
call dword ptr [Game.exe+9AA238]
mov al,[esp+28]
pop edi
pop esi
pop ebx
ret 001C |
Does this have any hints on what are its calling conventions?
| Famine wrote: |
Code Flow: Check if there are any conditional branches or other code that could prevent the function from being called. The original assembly code might be part of a larger context that you're not replicating in your script.
|
You mean from previous functions?
The caller function I pasted in the OP is called by other functions, could something from them be required to call this function?
| Famine wrote: |
Memory Permissions: Make sure that the memory areas you're trying to modify or execute code in have the necessary read, write, and execute permissions. Some parts of the game's memory may be protected, and you might need to use additional techniques to modify them.
Thread Handling: Your script creates a new thread to execute the code. Make sure this is the intended behavior in the game. Some games may not support or allow external threads to interact with their code.
|
If I try some simple instructions like just moving a value to an address in the auto assembler, it works. So I assume this is not the issue.
If I was using the Windows debugger, would it have at least triggered the breakpoint even if the calling was wrong? Because if so, I believe fixing this would make any further problem solving a lot easier.
|
|
| Back to top |
|
 |
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4711
|
Posted: Mon Oct 30, 2023 11:22 am Post subject: |
|
|
| BirchTree wrote: | | Is there any way I can make the breakpoint work with the VEH debugger? | I don't know enough about the VEH debugger to answer that properly. Maybe sleeping for a second at the beginning of the thread would work?
| Code: | push #1000
call kernel32.Sleep
... |
| BirchTree wrote: | | Code: | ...
mov esi,ecx // ecx is definitely a parameter
...
ret 001C // callee clean up
|
| Probably thiscall
Anyway ecx is a parameter and you have to set it properly before calling the function
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
 |
BirchTree How do I cheat?
Reputation: 0
Joined: 30 Oct 2023 Posts: 3
|
Posted: Mon Oct 30, 2023 6:05 pm Post subject: |
|
|
| ParkourPenguin wrote: | | BirchTree wrote: | | Is there any way I can make the breakpoint work with the VEH debugger? | I don't know enough about the VEH debugger to answer that properly. Maybe sleeping for a second at the beginning of the thread would work?
| Code: | push #1000
call kernel32.Sleep
... |
| BirchTree wrote: | | Code: | ...
mov esi,ecx // ecx is definitely a parameter
...
ret 001C // callee clean up
|
| Probably thiscall
Anyway ecx is a parameter and you have to set it properly before calling the function |
Sorry it took so long for me to respond, I just got around to trying your suggestions now. But thank you very much for your help (yours too, Famine), it really was something as simple as setting up ecx.
Unfortunately I could not make the breakpoint work by sleeping which would've been useful for debugging but I can work with that.
|
|
| Back to top |
|
 |
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4711
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|