Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Dissassembled code changing?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Corruptor
Advanced Cheater
Reputation: 3

Joined: 10 Aug 2011
Posts: 84

PostPosted: Sun Aug 05, 2012 8:33 am    Post subject: Dissassembled code changing? Reply with quote

Hi there,
im currently failing at some conditional breakpoint which is only ment to fire when the parameter string does not contain certain substrings, and since i dont know how to work with the break conditions and manual assembler code seems to throw random exceptions at random cmp operations, i tried to do it on a weird way, which is writing the comparision in c++ and copying the compiled code into ce. (guess what, it doesnt work either Very Happy)

Now, trying to find where expection is thrown (some random jump it seems), i noted something pretty awkward:

when i go to the called function using the space button at the call, it will display this code (which is what i injected):
Code:
03040FFE - 00 00                 - add [eax],al
03041000 - 83 EC 0C              - sub esp,0C //<--- entry point
03041003 - 53                    - push ebx
03041004 - 55                    - push ebp
03041005 - 56                    - push esi
03041006 - 31 C9                 - xor ecx,ecx


Now, i can scroll down till i dont see this code in the dissassembler, and scroll up again, and the code suddenly changed to this one:
Code:
03040FFF - 00 83 EC0C5355        - add [ebx+55530CEC],al
03041005 - 56                    - push esi
03041006 - 31 C9                 - xor ecx,ecx


He seemingly summed up one of the 00 from the not reached code and a few pushes to a new instruction. I asume due to the call at the right position the correct code will be executed, but still this seems kinda weird to me. Does that mean that Assembler code is NOT unique and that the dissassembled code i see may no be the one that is actually executed?
Back to top
View user's profile Send private message
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6300

PostPosted: Sun Aug 05, 2012 8:45 am    Post subject: Reply with quote

It is still there mate. Look at your bytes on address 304FFF 00 83 ECOC5355

I think your in just part of the assembly instruction when you find your entry.
Back to top
View user's profile Send private message
Corruptor
Advanced Cheater
Reputation: 3

Joined: 10 Aug 2011
Posts: 84

PostPosted: Sun Aug 05, 2012 9:03 am    Post subject: Reply with quote

I know it seems to be a summed up version of a few instructions and that my original instructions are still in there, i also asume that its executed correctly. It's just, the second code i gave is what you would see if you normally scroll through the code (mousewheel up, it works correctly if you scroll down to it), which is the normal way you iterate through the code. Still, its definitely not the code that is actually executed. It kinda gives me a feeling that the code the dissassembler shows might not always be correct, because that is exactly what happens to be the case in this example: the code that the dissassembler shows me is not correct.

Quote:
I think your in just part of the assembly instruction when you find your entry.

Thats the problem, the "part" of the instruction is the correct code, while the big instruction is definitely wrong Sad
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites