 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
vng21092 Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013 Posts: 644
|
Posted: Fri Feb 21, 2014 9:07 am Post subject: Strider 2014 |
|
|
[Enable]
alloc(newmem_1,512,"StriderX64_r.exe"+A40BB)
label(returnhere_1)
label(unlimitedhealth_1)
label(originalcode)
newmem_1:
cmp [rsi+308],2F
je unlimitedhealth_1
jmp originalcode
unlimitedhealth_1:
push [rsi+0C]
pop [rsi+08]
jmp returnhere_1
originalcode:
movss [rsi+08],xmm5
jmp returnhere_1
"StriderX64_r.exe"+A40BB:
jmp newmem_1
returnhere_1:
[Disable]
"StriderX64_r.exe"+A40BB:
movss [rsi+08],xmm5
dealloc(newmem_1)
___________________________________________
I'm playing Strider 2014 and that's the code I had written for unlimited health, it works, but for some reason when I hit an enemy they don't really die... they just disappear, like poof, doesn't jump back to original code like its suppose to. I tried both of these as well:
cmp [rsi+308],2F
jne originalcode
cmp [rsi+308],27 //Enemy ID
je originalcode
still doesn't work, now it wouldn't be a problem with enemies disappearing but when I hit certain objects that trigger events, the events don't happen since the object poofs and I'd have to restart the level, can someone explain whats happening/ what to do?
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Feb 21, 2014 12:07 pm Post subject: |
|
|
Instead of this:
Code: | unlimitedhealth_1:
push [rsi+0C]
pop [rsi+08]
jmp returnhere_1 |
You could try this:
Code: | unlimitedhealth_1:
jmp returnhere_1 |
Also, you're sure the compare is this:
The data type is correct and equals 2F?
|
|
Back to top |
|
 |
vng21092 Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013 Posts: 644
|
Posted: Fri Feb 21, 2014 2:06 pm Post subject: |
|
|
If I write that then wouldn't unlimitedhealth_1 do nothing? Since it just jumps to returnhere_1? And data type was 4 Bytes with a value of 47, which in hex = 2F, I also tried
cmp [rsi+308],(int)47
got same result
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Feb 21, 2014 3:12 pm Post subject: |
|
|
Yes. But for testing purposes...what does it do?
The instruction that you are using for your injection point...what does it do?
Did you try comparing 8 byte value?
It seems...
possible problem 1: Compare is wrong or incomplete
possible problem 2: Other addresses are getting through (other than enemy/player health addresses), and need to be filtered out
possible problem 3: You 'health manipulation code' needs to change
Need more information.
|
|
Back to top |
|
 |
vng21092 Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013 Posts: 644
|
Posted: Fri Feb 21, 2014 5:04 pm Post subject: |
|
|
well changing it to jump to returnhere_1 didn't change anything, enemies and objects still disappeared, the instruction controls value of health for player, enemies, and objects (doors, switches, etc... yea... they have health ), in the data structure it said those values were 4 byte so that's just what I went by, but how would you compare 8 bytes? I didn't know that was an option, I always assumed numbers were the same in 2,4,8 byte and just used (int)#. I did however fixed the objects kind of, turns out they had a separate ID from the enemies, and I just added another compare and that ended up fixing one problem, I'm just confused as to why
cmp [rsi+308],2F
jne originalcode
doesn't work, if [rsi+308]!= (2F(playerID)) it should just jump back to the original code, isn't that how it works?
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Feb 21, 2014 5:49 pm Post subject: |
|
|
vng21092 wrote: | well changing it to jump to returnhere_1 didn't change anything, enemies and objects still disappeared, the instruction controls value of health for player, enemies, and objects (doors, switches, etc... yea... they have health ) | -Hmm...maybe you can try a different instruction? It sounds like the instruction that you are targeting handles other data besides health. If no other instruction is available, you will have to filter more.
Quote: | in the data structure it said those values were 4 byte so that's just what I went by, but how would you compare 8 bytes? I didn't know that was an option, I always assumed numbers were the same in 2,4,8 byte and just used (int)# | -The data structure is just CE's 'best guess'. Just because a value is noted as 4 byte, does not mean that it actually is. You can click on it and change the element...change it to whatever value type you want. Comparing a 4 byte value is not the same as comparing an 8 byte value...otherwise, why would we need different value types? Obviously, an 8 byte value contains more data than a byte value. The registers are x64.
Quote: | I'm just confused as to why
cmp [rsi+308],2F
jne originalcode
doesn't work, if [rsi+308]!= (2F(playerID)) it should just jump back to the original code, isn't that how it works? | Because [rsi+308] does not equal 2F...change the value type in your data structure to 8 byte and see what it really is.
|
|
Back to top |
|
 |
ThatLingon Expert Cheater
Reputation: 4
Joined: 03 Sep 2013 Posts: 125 Location: Sweden
|
Posted: Fri Feb 21, 2014 6:16 pm Post subject: |
|
|
Try That for health
Code: | [ENABLE]
alloc(newmem,256,"StriderX64_r.exe"+3118DA)
label(returnhere)
label(originalcode)
label(exit)
newmem:
cmp [rdi+20],79616C50
db 75 1C
cmp [rdi+1c0],00000000
db 74 10
movss xmm0,[rdi+000001C4]
movss [rdi+000001C0],xmm0
originalcode:
mov [rsp+00000080],rax
exit:
jmp returnhere
"StriderX64_r.exe"+3118DA:
jmp newmem
nop
nop
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"StriderX64_r.exe"+3118DA:
mov [rsp+00000080],rax |
|
|
Back to top |
|
 |
vng21092 Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013 Posts: 644
|
Posted: Sat Feb 22, 2014 12:02 pm Post subject: |
|
|
@ThatLingon that code actually works really well so far, can you tell me how you found that instruction? Since when I try to find out what addresses it accesses I get nothing back except one address, which doesn't represent health. Also, what does this mean?
cmp [rdi+20],79616C50
db 75 1C
I get the compare, but whats "db"?
|
|
Back to top |
|
 |
ThatLingon Expert Cheater
Reputation: 4
Joined: 03 Sep 2013 Posts: 125 Location: Sweden
|
Posted: Sat Feb 22, 2014 12:51 pm Post subject: |
|
|
Hi, well the instruction handles health, which i got from debugging health, and the damage to player, 1C0 Offset to current health 1C4 offset to max health.
I mov max health into current player health.
The DB 's i use is the equivlient to e.g. JNE / JE just using bytes insted here, used there to check if its player it then skips if not player and if player health is 0 it skips aswell.
or continues as normal.
|
|
Back to top |
|
 |
vng21092 Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013 Posts: 644
|
Posted: Sat Feb 22, 2014 1:24 pm Post subject: |
|
|
hmm thats strange, when I find out what writes to health I only get
"StriderX64_r.exe"+A40BB
I tried access but your instruction doesn't seem to be on that list either... =\
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|