Cheat Engine

[vergilganesh]

I have a doubt. What does these codes do? At what structure the codes are arranged. I noped the fsub instruction which activates one hit kill mode.

[mgr.inz.Player]

FSUB - Subtract Value from ST(0) and store result in ST(0)
FSUBR - Subtract ST(0) from Value and store result in ST(0)

[vergilganesh]

why does hero dies when noping the instruction?

It subtract and store the same pointer.

[mgr.inz.Player]

Here we go:


fld dword ptr [esp+1C]        // load damage base value
(...)
fmul dword ptr [esp+B4]     // multiply damage by multiplier
(...)
fst qword ptr [esp+28]        // store total damage for other calculations
fsubr dword ptr [ebp+A0]    // subtract "total damage" from currentHP (result, newHP, in ST(0) )
fstp dword ptr [ebp+A0]      // store and pop, (overwrite currentHP with new HP)


Lets start analyzing

Our stack:
_____________________
| ST(0) empty0              |
| ST(1) empty1              |
| ST(2) empty2              |
| ...                              |
| ...                              |



After first instruction, our stack looks like this:
 ____________________
| ST(0) damageBase     |
| ST(1) empty0             |
|                                  |
|                                  |



After second, like this (multiplied)
 ____________________
| ST(0) totalDamage      |
| ST(1) empty0             |
|                                  |
|                                  |



After third, like this (not changed, because we stored value only)
 ____________________
| ST(0) totalDamage     |
| ST(1) empty0             |
|                                  |
|                                  |


After fourth, like this (  "currentHP-totalDamage"  )
 ____________________
| ST(0) newHP              |
| ST(1) empty0             |
|                                  |
|                                  |


After fifth, like this (we stored and pop from the stack)
_____________________
| ST(0) empty0             |
| ST(1) empty1             |
| ST(2) empty2             |
| ...                              |
| ...                              |







I you just nop this instruction "fsubr"

Our stack:
_____________________
| ST(0) empty0             |
| ST(1) empty1             |
| ST(2) empty2             |
| ...                              |
| ...                              |



After first instruction, our stack looks like this:
 ____________________
| ST(0) damageBase     |
| ST(1) empty0             |
|                                  |
|                                  |



After second, like this (multiplied)
 ____________________
| ST(0) totalDamage      |
| ST(1) empty0             |
|                                  |
|                                  |



After third, like this (not changed, because we stored value only)
 ____________________
| ST(0) totalDamage     |
| ST(1) empty0             |
|                                  |
|                                  |


We nopped so:
 ____________________
| ST(0) totalDamage     |
| ST(1) empty0             |
|                                  |
|                                  |


After fifth, like this (we stored ST(0) and poped from the stack)
_____________________
| ST(0) empty0             |
| ST(1) empty1             |
| ST(2) empty2             |
| ...                              |
| ...                              |





Never NOP any FPU instruction if it cause unbalanced FPU stack.
Especially F____P (like fstp, faddp, fsubp,...)   or   F____R (like fsubr,...).





If you want NOP this instruction: fstp dword ptr [xxxxxxx]
You must use this: fstp ST(0)






In this case, you don't want substraction:
fsubr dword ptr [XXXXXX]
fstp dword ptr [XXXXXX] 

Just change it to
fsubr dword ptr [XXXXXX]
fstp ST(0)

[vergilganesh]

Yes, you are absolutely correct. I just multiply with 0.0 after fld [esp+1c] then it activates god mode. but by dissecting data/structure i m unable to find the difference between enemy and player. however the player's health only is accessed by one instruction continuously. but both the healths are write by the above instruction only. Is there anyway to make one hit kill?

[Dark Byte]

find the code that reads ONLY your health. Then do a code injection there and store the address it last read out to a known location.

Then in the code that writes check if the current address being changed is that stored address or not. And if so, it's the player, else enemy

[daspamer]

[vergilganesh]

[vergilganesh]

how to do that

[vergilganesh]

I have done it. Because it is a multiplayer game.,, i grab only two addresses and used cmp cmd. IF any one is correct i activated the code. Beacuse it is continously accesses both the players address. when enemy attacks me, any one of the player lost its health. so only i have done my code like below.