 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Dooh
Newbie cheater
![]() Reputation: 0
Joined: 03 Apr 2011
Posts: 13
|
 Posted: Sun Apr 03, 2011 2:57 pm Post subject: I need a little help with a C# bot, problem with pointers. |
 |
|
Hello everyone.
I dont know if i posted in the right section, so feel free to change location of the post.
Im working on a little bot for a game, i want it to change target when the mob is dead. However every mob have a uniqe memory address which store the mob hp value.
In CE i solved this by doing:
| Code: |
[ENABLE]
registersymbol(mobAddress)
alloc(newmem,2048) //2kb should be enough
alloc(mobAddress,4)
label(returnhere)
label(originalcode)
label(exit)
004FCB32:
jmp newmem
nop
returnhere:
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov [mobAddress],edi
originalcode:
mov eax,[edi+58]
mov edi,[edi+54]
exit:
jmp returnhere
[DISABLE]
unregistersymbol(mobAddress)
dealloc(newmem)
dealloc(mobAddress)
004FB6CD:
mov eax,[edi+58]
mov edi,[edi+54] |
Then i just made two pointers to "mobAddress", one with the offset 54 and 58. One to the current Hp, and one to the max amount of Hp.
The address before i activate the script, the address looks like:
mov eax,[edi+58]
Now to the problem, i want to use C#.
And i want to get to the edi part on that address, since it is the edi part which contains the address to the current mob i have on target. Or have i misunderstod that part?
Does anyone know how i can access the edi part in C#?
I use the regular:
public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);
public static extern Int32 CloseHandle(IntPtr hObject);
public static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);
public static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesWritten);
To read and write to the proccess.
If something is unclear or you need more info, feel free to point it out and i will provide the information.
I would greatly appreciate your help.
Thanks in advance.
Dooh.
|
|
| Back to top |
|
 |
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Sun Apr 03, 2011 3:17 pm Post subject: |
|
|
Some stuff to note since you are using a managed language. You don't need to use OpenProcess or CloseHandle. You can obtain a valid handle from the Process namespace functions:
http://msdn.microsoft.com/en-us/library/system.diagnostics.process.aspx
For example:
| Code: | Process proc = (from procs in Process.GetProcessesByName("winmine.exe")
select procs).SingleOrDefault(); |
Your new variable proc has a property 'Handle' which you can use without needing to open or close anything manually. The system will clean the handle up automatically for you when the garbage collection is ran in C#.
As for your actual question you can inject the script similar to how CE does it or you could see if EDI is set above the line you are showing us. See if you have any lines similar to something like:
mov edi, dword ptr [12345678]
Not the same address but something similar to that above the:
mov eax,[edi+58]
If you have something like that you can find the pointer by reading the address from that instruction instead. If not you can inject the bytes of the script manually. (I'm not going to get into detail on the 2nd method, search the forums I'm sure there are tuts on how to do it.)
_________________
- Retired. |
|
| Back to top |
|
|
Dooh
Newbie cheater
![]() Reputation: 0
Joined: 03 Apr 2011
Posts: 13
|
| Posted: Sun Apr 03, 2011 4:45 pm Post subject: |
|
|
Thanks for pointing that out, i was not aware of it.
The only place where edi is changed are about 60 lines above my address.
It is:
MOV EDI,EAX
So i followed where EAX is specifyed, turns out it was:
MOV EAX,DWORD PTR SS:[ESP+4]
The ESP seem to be the same value even if i target other mobs (Which is a good thing. If im right)
However EAX changes once again after that:
MOV EAX,DWORD PTR DS:[EAX+10]
Then it returns the value, which becomes EDI's value.
So the one im after is:
MOV EAX,DWORD PTR SS:[ESP+4]
The ESP was always "00129024", so "00129028", then we have the line:
MOV EAX,DWORD PTR DS:[EAX+10]
which adds 10 to EAX current value.
I have no idea what "DWORD PTR DS" nor "DWORD PTR SS:" means. Guess im going to google some stuff in a bit.
The second method seem interesting.
Given this infromation, which method do you think would be the easiest way to make this work?
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Sun Apr 03, 2011 5:15 pm Post subject: |
|
|
ESP is the stack, so that means its being passed as a parameter to which ever function are you currently inside. You could try tracing further back to see if you can find a static location, but option two is starting to look like the easier route if you know how to do it.
CS, DS, ES, FS, GS, SS, etc. are segment registers.
DS = Data segment
SS = Stack segment
_________________
- Retired. |
|
| Back to top |
|
|
Dooh
Newbie cheater
![]() Reputation: 0
Joined: 03 Apr 2011
Posts: 13
|
| Posted: Sun Apr 03, 2011 7:41 pm Post subject: |
|
|
Method number two it is, i have never been good at backtracing in olly nor CE ^^
To be honest, i have no idea what im doing ^^ So i will try to find a good tutorial which i can understand ^^
Anyhow, thanks for your help 
I really appreciate it.
|
|
| Back to top |
|
|
ej52
Cheater
![]() Reputation: 0
Joined: 29 Mar 2011
Posts: 39
Location: Mother City
|
| Posted: Sun Apr 03, 2011 7:55 pm Post subject: |
|
|
Hi Dooh
I am currently working on a Opcode/Asm library for C# which will hopefully
be released end of this week, so keep an eye out for it
It will allow you to basically re-write your AA script above into C# without
you having to mess with the Resgisters yourself.
Regards
Ej52
_________________
Hitler dNt HiDe WaT mOtHa NaTurE pRoViDe ...  |
|
| Back to top |
|
|
Dooh
Newbie cheater
![]() Reputation: 0
Joined: 03 Apr 2011
Posts: 13
|
| Posted: Mon Apr 04, 2011 4:35 am Post subject: |
|
|
Okey, now i have been searching for a while, and i can't find a single tutorial/guide or anything which covers "registersymbol". Here on CEF nor on google.
My registered symbol are vital in my solution since i make two pointers to that symbol.
And i find it hard to belive you can make a symbol or pointer in the AA part of my bot and use that symbol/pointer outside the AA part.
Anyone got an idea?
Would appreciate the help.
|
|
| Back to top |
|
|
Dooh
Newbie cheater
![]() Reputation: 0
Joined: 03 Apr 2011
Posts: 13
|
| Posted: Thu Apr 07, 2011 3:44 pm Post subject: |
|
|
Im doing a shameless bump :/
Im totally lost, can anyone point me to a tutorial how to inject my AA-script in C#.
I can't find a tutorial which cover all the parts in the script.
Or can anyone tell me how to get to the EDI part if the address?
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
