 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
kgbfbi
Newbie cheater
![]() Reputation: 0
Joined: 07 Dec 2016
Posts: 10
|
 Posted: Sun Jul 19, 2026 11:57 pm Post subject: A bug occurred when calling the Windows API (VirtualQueryEx) |
 |
|
I'm not sure if there's a problem with my program or a bug in the TCC compiler.
The program is as follows: | Code: |
resultEx = VirtualQueryEx(handle,ptr,&mbi,sizeof(mbi)); |
The results are all wrong. The debugged assembly code is as follows:
| Code: |
resultEx = VirtualQueryEx(handle,ptr,&mbi,sizeof(mbi));
- mov eax,0000001C { 28 }
- push eax
- lea eax,[ebp-1C]
- push eax
- mov eax,[001B08B0] { (001B000F) }
- mov eax,[eax]
- push eax
- mov eax,[ebp-20]
//This should have been the value of `handle`, but it wasn't.
- push eax //If I manually changed `EAX` to the value of `handle`,
// the program ran successfully.
- call 001B0860 { ->->KERNEL32.VirtualQueryEx }
- add esp,10 { 16 }
- mov ecx,[001B08B8] { (001B0017) }
- mov [ecx],eax
- leave
- ret
|
The entire program is demonstrated using the 32-bit program that comes with CE7.6: Tutorial-i386.exe. The complete code is as follows:
| Code: |
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
{$c}
typedef struct {
void* BaseAddress;
void* AllocationBase;
unsigned long AllocationProtect;
unsigned long RegionSize;
unsigned long State;
unsigned long Protect;
unsigned long Type;
}MEMORY_BASIC_INFORMATION;
{$asm}
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
{$ccode}
extern int ptr;
extern int PID;
extern int resultEx;
MEMORY_BASIC_INFORMATION mbi;
void* handle = OpenProcess(0xFFFF,0,PID);
resultEx = VirtualQueryEx(handle,ptr,&mbi,sizeof(mbi));
{$asm}
originalcode:
nop
mov esp,ebp
pop ebp
ret
exit:
jmp returnhere
ptr:
dd 01752E0C//Normal memory address
PID:
dd #3660 //The program's PID can be obtained through the Task Manager program.
resultEx:
dd 00
"Tutorial-i386.exe"+7320F:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Tutorial-i386.exe"+7320F:
db 90 89 EC 5D C3
//nop
//mov esp,ebp
//pop ebp
//ret
|
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 474
Joined: 09 May 2003
Posts: 25973
Location: The netherlands
|
| Posted: Mon Jul 20, 2026 1:41 am Post subject: |
|
|
try defining ReadProcessMemory and OpenProcess as stdcall. I think your whole stack is getting corrupted by using the wrong calling convention
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
kgbfbi
Newbie cheater
![]() Reputation: 0
Joined: 07 Dec 2016
Posts: 10
|
| Posted: Mon Jul 20, 2026 2:32 am Post subject: |
|
|
| Dark Byte wrote: | | try defining ReadProcessMemory and OpenProcess as stdcall. I think your whole stack is getting corrupted by using the wrong calling convention |
Following your suggestion, I redefined the `OpendProcess` function using stdcall according to the information provided on the Microsoft website, adding just this line of code: | Code: |
void* __stdcall OpenProcess(
unsigned long dwDesiredAccess,
int bInheritHandle,
unsigned long dwProcessId
); |
Then the problem was solved. I don't understand. My Cheat Engine is the original version downloaded from the official website, and I haven't modified any of the internal definition files. Why do I need to re-define stdcall?
Mr. Dark Byte, please tell me the reason, I don't understand.
Last edited by kgbfbi on Mon Jul 20, 2026 3:35 am; edited 1 time in total |
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 474
Joined: 09 May 2003
Posts: 25973
Location: The netherlands
|
| Posted: Mon Jul 20, 2026 3:21 am Post subject: |
|
|
You didn't define the function definitions for openProcess and ReadProcessMemory or include a header file they defines these functions (maybe windows.h does but that's generally too big to use)
when a function isn't defined, then according to C-standard, it will be assumed it's cdecl instead of stdcall
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
kgbfbi
Newbie cheater
![]() Reputation: 0
Joined: 07 Dec 2016
Posts: 10
|
| Posted: Mon Jul 20, 2026 3:35 am Post subject: |
|
|
| Dark Byte wrote: | You didn't define the function definitions for openProcess and ReadProcessMemory or include a header file they defines these functions (maybe windows.h does but that's generally too big to use)
when a function isn't defined, then according to C-standard, it will be assumed it's cdecl instead of stdcall |
Thank you so much for your help.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
