 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Corruptor Advanced Cheater
Reputation: 3
Joined: 10 Aug 2011 Posts: 84
|
Posted: Sun Aug 05, 2012 8:33 am Post subject: Dissassembled code changing? |
|
|
Hi there,
im currently failing at some conditional breakpoint which is only ment to fire when the parameter string does not contain certain substrings, and since i dont know how to work with the break conditions and manual assembler code seems to throw random exceptions at random cmp operations, i tried to do it on a weird way, which is writing the comparision in c++ and copying the compiled code into ce. (guess what, it doesnt work either )
Now, trying to find where expection is thrown (some random jump it seems), i noted something pretty awkward:
when i go to the called function using the space button at the call, it will display this code (which is what i injected):
| Code: | 03040FFE - 00 00 - add [eax],al
03041000 - 83 EC 0C - sub esp,0C //<--- entry point
03041003 - 53 - push ebx
03041004 - 55 - push ebp
03041005 - 56 - push esi
03041006 - 31 C9 - xor ecx,ecx |
Now, i can scroll down till i dont see this code in the dissassembler, and scroll up again, and the code suddenly changed to this one:
| Code: | 03040FFF - 00 83 EC0C5355 - add [ebx+55530CEC],al
03041005 - 56 - push esi
03041006 - 31 C9 - xor ecx,ecx
|
He seemingly summed up one of the 00 from the not reached code and a few pushes to a new instruction. I asume due to the call at the right position the correct code will be executed, but still this seems kinda weird to me. Does that mean that Assembler code is NOT unique and that the dissassembled code i see may no be the one that is actually executed?
|
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6300
|
Posted: Sun Aug 05, 2012 8:45 am Post subject: |
|
|
It is still there mate. Look at your bytes on address 304FFF 00 83 ECOC5355
I think your in just part of the assembly instruction when you find your entry.
|
|
| Back to top |
|
 |
Corruptor Advanced Cheater
Reputation: 3
Joined: 10 Aug 2011 Posts: 84
|
Posted: Sun Aug 05, 2012 9:03 am Post subject: |
|
|
I know it seems to be a summed up version of a few instructions and that my original instructions are still in there, i also asume that its executed correctly. It's just, the second code i gave is what you would see if you normally scroll through the code (mousewheel up, it works correctly if you scroll down to it), which is the normal way you iterate through the code. Still, its definitely not the code that is actually executed. It kinda gives me a feeling that the code the dissassembler shows might not always be correct, because that is exactly what happens to be the case in this example: the code that the dissassembler shows me is not correct.
| Quote: | | I think your in just part of the assembly instruction when you find your entry. |
Thats the problem, the "part" of the instruction is the correct code, while the big instruction is definitely wrong
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|