Cheat Engine

[redhead]

Hi,
I know I can make a dll, use inline asm (c++) to make a jump into an ingame function, for example 0x12341234 and then inject the dll.

But is there a way to do this without any injection?
Something like SendMessage or smth.?
I'm trying to make a bot without any injection..

[Slugsnack]

If you get the address of the function and it takes one or less parameters then you can use CreateRemoteThread to call it externally I guess.

If you are trying to make a bot, you can use PostMessage without the need to use any injection or DLL at all.

[samuri25404]

WriteProcessMemory?

[dnsi0]

um...
If u want the dll to jump to an ingame function u can use: (C++)
asm
{
jmp [whereverthefunctionis]
}

If not a dll. Create A Remote Thread into the process and do that ^

[Symbol]

[jackyyll]

[dnsi0]

CreateRemoteThread???

[redhead]

Never used CreateRemoteThread before, I tried : (but it not worked ofc.)

[hcavolsdsadgadsg]

You have to create the function that acts as your thread.

You obviously want it to call 0x00411109... so...

[redhead]

whoops, I'm an idiot.
I open'd the process without the access to create a thread in it..
create_all_access worked fine.
Thx

[nog_lorp]

The function you want to call may not match the function signature of LPTHREAD_START_ROUTINE, meaning it may fuck the stack when you use CreateRemoteThread on it. You are best off finding a codecave in the target process and writing a stub there that will handle the arguments and stack issues then call the target function. Then CreateRemoteThread that will originate there. You can then place an ExitThread call at the end to handle it nicely.

[jackyyll]

[nog_lorp]

True. I thought ExitThread would lead to nicer cleanup than just letting it return, but I was wrong, threads called with CreateThread return to kernel32.7C80B683 which is immediately followed with a call to ExitThread.

[BanMe]

this method would work much more nicely

psuedo code

[redhead]