| View previous topic :: View next topic |
| Author |
Message |
redleouf Advanced Cheater
Reputation: 0
Joined: 13 Feb 2013 Posts: 76
|
Posted: Sat May 31, 2014 1:33 pm Post subject: AoB Scan - Address only allocating when dying |
|
|
Hello,
I've got a problem with my AoB scan again, I don't think this one can be resolved but I prefer to ask anyway.
I made a script with an AoB Scan to "mov" a value, the thing is, when the game start, the address is not directly allocated to the memory, it only get allocated when the instruction execute itself for the first time.
The problem is, when this instruction execute itself, the player die. And if the address is not allocated I can't execute my script to avoid the death of the player so the only way to execute it is by dying once, respawning (which in this game mean restarting from the begining of the game) and only then I can execute my script because the AoB scan will be able to find the address.
So I wonder if there is any way possible to execute my script without having to execute the instruction once before.
Also, I can't trick this by changing the life of the player or anything, this is an insta death condition (when the player falls from a high place), if you want to learn more about it and if it can help you, here is the link of the thread where I explain it in detail in the last post : http://forum.cheatengine.org/viewtopic.php?p=5535412#5535412
And here is my script :
| Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
label(fall)
registersymbol(fall)
aobscan(fallscan,D9 18 D9 86 8C 01 00 00 8B 45)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov [esi+0000018C],(float)100
originalcode:
fld dword ptr [esi+0000018C]
exit:
jmp returnhere
fallscan+2:
fall:
jmp newmem
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
fall:
db D9 86 8C 01 00 00
unregistersymbol(fall)
//Alt: db D9 86 8C 01 00 00 |
|
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Sat May 31, 2014 2:56 pm Post subject: |
|
|
The game was made in Unity... if it uses Mono, which is likely, the next version of CE will allow you to do a lot of cool stuff very easily, such as replace your aobscans with symbols and automatically JIT the code you're scanning for presently prior to your guy falling to death.
_________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
 |
redleouf Advanced Cheater
Reputation: 0
Joined: 13 Feb 2013 Posts: 76
|
Posted: Sat May 31, 2014 3:02 pm Post subject: |
|
|
Thank you for your answer!
So I guess I've come to a dead end and I must wait for the next CE version?
|
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Sat May 31, 2014 3:06 pm Post subject: |
|
|
It depends on what the fall() function actually does. It may be that you can write a script to bypass it entirely. Or you can look at hacking the MSIL directly. Or you can use something like Cecil to modify the whole assembly.
_________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
 |
redleouf Advanced Cheater
Reputation: 0
Joined: 13 Feb 2013 Posts: 76
|
Posted: Sat May 31, 2014 3:52 pm Post subject: |
|
|
Well, I am going to see again if I can bypass it but I doubt it with my knowledge. I also have no idea how could I hack the MSIL and modifying the whole assembly would be too much I guess. I am just trying to do a basic Cheat Table ^^
(Do you know when the new version of CE should come out?)
And thank you again for your help.
|
|
| Back to top |
|
 |
|