Cheat Engine

IchigoBankai · Posted: Wed Oct 22, 2008 8:23 pm Post subject: ASM Question

Say i have a adress, I want put the value FF in edx.
Problem is , well I'll show it (not real address , an example)

Dark Byte · Posted: Wed Oct 22, 2008 8:30 pm Post subject:

if mov edx,ff wasn't bigger than mov edx,[ebx+0c] you could just replace it like that. Problem is, it is...

To get by that :
go to that addres and use template->code injection

now at the newmem part write:
mov edx,ff

and comment out the mov edx,[ebx+0c] line in the originalcode part (put // in front of it)

that can be injected.

(and if you want it in a cheat table add a [enable] [disable] to it, and optionally a dealloc(code) in the disable part)

Labyrnth · Moderator Reputation: 10 Joined: 28 Nov 2006 Posts: 6301

What DB is saying.

Dark Byte · Posted: Thu Oct 23, 2008 7:43 am Post subject:

kinda, but to prevent confusion I didn't give an example because that would show up different than on his system

e.g:
originalcode:
//mov edx,[ebx+0c]

will have some additional instructions after it, which he should not comment out

Labyrnth · Moderator Reputation: 10 Joined: 28 Nov 2006 Posts: 6301

I see what you mean, it does have more in most cases with it.

Psy · Posted: Thu Oct 23, 2008 12:25 pm Post subject:

If the line directly above what he posted contains another move into [ebx+0c], then he could overwrite at that point, and NOP out any remainer, avoiding a code-cave that way... Maybe... maybe not Razz

Recifense · Posted: Fri Oct 24, 2008 5:29 am Post subject:

In this example, I can see a problem. IchigoBankai should take care with instruction size:

The following instruction is 3 bytes long: