Cheat Engine

[bismult]

How would you stop an instruction from writing to one address out of many listed under the "Find out what addresses this instruction accesses" menu?

For further clarity: This instruction (movdqu [rcx],xmm0) is constantly writing to hundreds of addresses, so I want it to stop writing to one out of those hundreds.

[Dark Byte]

check if rcx is the specific address (cmp rcx,[addressthatholdstheaddresstoskip] ) and if so skip the write (je after)

[bismult]

[ParkourPenguin]

Edit: removing the square brackets won't work- I forgot there is no `cmp r/m64,imm64` instruction
If 7FF8D4014700 is the actual address you're checking and not a pointer to the address to check, remove the square brackets.
Such a script probably won't work the next time you launch the game- memory is randomly allocated.

And I'd use `je exit` instead of `je returnhere`, but either works.

[Dark Byte]

cmp reg,imm64 doesn't exist he has to alloc some memory first

so

[bismult]

[icebox616]

Sorry to bump this
I'm having the same issue.
I have this code: mov [eax+08],ecx at libIGMath.dll+231A3
that keeps writing to 008C7764. I also can't nop it out because the same code writes to many other addresses.


This is the code I came up with while following this and many other threads and tutorials and trying to pierce this together but without success. It just keeps on writing but through my newly allocated address.
It's been driving me nuts for the past few days. Any help would be immensely appreciated.

[ParkourPenguin]

`eax+08` is an address. `[eax+08]` is the value at that address.
Likewise, `addresstoskip` is the address of some memory CE allocated (i.e. not 008C7764). `[addresstoskip]` is the value at that address- in this case, that value is the address of something else (i.e. 008C7764).

`je exit` - there is no exit label in that script

`ret 0004` - this instruction is a little weird to have in an injection point, but you can make it work

You don't need the third parameter to alloc in 32-bit processes

If you don't want to do an aobscan, use the "Full Injection" template instead. Also don't remove the comment at the bottom of that template- that information is important

Given that's 32-bit code, you can compare `eax` against a 32-bit value directly

[icebox616]

[ParkourPenguin]

That might be a little dangerous- e.g. if a value is written to every frame even if it doesn't change.

In the instruction `mov [eax+08],ecx`, is the value being moved a float?
If so, this is fine:

[icebox616]

[ParkourPenguin]

[icebox616]

[ParkourPenguin]

`jne trueexit` - `jne` means "jump if not equal"- i.e. jump if [eax+08] is not equal to ecx. That code adds 30 to the value if they are equal: that's the opposite of what I suggested. Since you're also skipping the write if they're different, the game won't be able to set any new value even if it wanted to.
You could try `je exit` instead (it doesn't matter whether or not the write is executed if they're already the same), but something is weird. If that code you just posted only adds 30 to the value once, then that means [eax+08] was equal to ecx only once too. Changing it also changed the value being written to it- some kind of recurrence relation perhaps.

What are the semantics of that value? Is it money? Health? Position / velocity? How does the game change it if you change it manually in the address list? What are you trying to do to it?

You could go to newmem (follow the jmp at libIGMath.dll+231A3) and set a breakpoint on the instruction after `cmp eax,008C775C` / `jne exit` to see what's going on.

[icebox616]