Cheat Engine :: View topic - Aob Injection crashes the code

Cheat Engine Forum Index

Cheat Engine
The Official Site of Cheat Engine

FAQ

Usergroups

Register

Log in to check your private messages

Aob Injection crashes the code

Cheat Engine Forum Index -> Cheat Engine

View previous topic :: View next topic

Author

Message

FrankyGoes
How do I cheat?

Reputation: 0

Joined: 01 Jun 2026
Posts: 2

Posted: Mon Jun 01, 2026 10:23 am Post subject: Aob Injection crashes the code

Reply with quote

Hi,

this is the first time I've encountered this problem:

Initial code:

Code:

ACOrigins.exe+1960D56 - 48 83 EC 20 - sub rsp,20
ACOrigins.exe+1960D5A - 80 B9 72010000 00 - cmp byte ptr [rcx+00000172],00
ACOrigins.exe+1960D61 - 48 8B F9 - mov rdi,rcx

I try an aob injection :

Code:

aobscanmodule(getHealth,$process,80 B9 72 01 00 00 00) // should be unique
alloc(newmem,$1000,getHealth)

label(code)
label(return)

newmem:

code:
cmp byte ptr [rcx+00000172],00
jmp return

getHealth:
jmp newmem
nop 2
return:
registersymbol(getHealth)

[DISABLE]

getHealth:
db 80 B9 72 01 00 00 00

unregistersymbol(getHealth)
dealloc(newmem)

Everything seems to be ok but when I activate the script the code crashes:

Code:

ACOrigins.exe+1960D56 - 48 83 EC 20 - sub rsp,20
getHealth - FF25 00000000 00008C0000000000 - jmp 008C0000
ACOrigins.exe+1960D68 - 66 90 - nop 2
ACOrigins.exe+1960D6A - 0C E8 - or al,-18
ACOrigins.exe+1960D6C - 50 - push rax

Can anyone help me?

Edit: to be more clear, why the return address is ACOrigins.exe+1960D6A instead of ACOrigins.exe+1960D61

Send private message

ParkourPenguin
I post too much

Reputation: 155

Joined: 06 Jul 2014
Posts: 4770

Posted: Mon Jun 01, 2026 10:48 am Post subject:

CE assembled a 14-byte jmp instead of a 5-byte jmp. The third parameter to alloc should've made CE allocate `newmem` near the injection point, allowing CE to use the 5-byte jmp. I don't know why CE didn't- looks like a bug to me. _________________ I don't know where I'm going, but I'll figure it out when I get there.

Send private message

FrankyGoes
How do I cheat?

Reputation: 0

Joined: 01 Jun 2026
Posts: 2

Posted: Mon Jun 01, 2026 11:22 am Post subject:

Reply with quote

ParkourPenguin wrote:

CE assembled a 14-byte jmp instead of a 5-byte jmp.

That's it!

Then even though I don't understand why I need at least 14-byte in my code.

I tried this one and it's ok now :

Code:

aobscanmodule(getHealth,$process,80 B9 72 01 00 00 00) // should be unique
alloc(newmem,$1000,getHealth)

label(code)
label(return)

newmem:

code:
cmp byte ptr [rcx+00000172],00
mov rdi,rcx
mov [rsp+38],rsi
jmp return

getHealth:
jmp newmem
nop
return:
registersymbol(getHealth)

[DISABLE]

getHealth:
db 80 B9 72 01 00 00 00 48 8B F9 48 89 74 24 38

unregistersymbol(getHealth)
dealloc(newmem)

Thanks for your help! Wink

Wink

Send private message

Display posts from previous:

	Cheat Engine Forum Index -> Cheat Engine	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum

Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki IRC (#CEF) Twitter
Third party websites