Cheat Engine

[Chris12]

Hello dark byte (or anyone else who feels up to the question)

The game I'm hacking sometimes gets some small patches.
But it seems the compiler used to compile the game is optimizing everything in a new way every time.

This means:
Functions stay the same in what they do, but the assembler codes are new every time.
Registers are changed (ebx instead of eax).
Or sometimes mov and push are swapped(while not changing anything at all in the logic).

Or sometimes stuff like add esp,8 is not folded and will read: add esp,4; add esp 4.
These are only examples. Field offsets stay the same but relative jumps also often change because the code is a little bigger or smaller.


I need a AOB scan that is a bit more abstract and does not Rely on the bytes that are used.
I strongly believe that those changes are not made to prevent hacking. They seem to be completely automated and there is no obfuscation at all.
Does CE provide something to counter that ?

Is there a tool to decompile a region into code that is a bit more abstract?
Is it possible to write this myself?
What should I do?
Every AOB I make is obsolete with every patch.

IDA can decompile it just fine and output the c code which always (almost always ) looks exactly the same.

Any hints or tips? Maybe some library that can decompile it for me?

[atom0s]

The C code generated by IDA is just a best-guess visual of the flow of the code. It is not something you should ever take for face value or assume is 100% correct. HexRays (the plugin that does this) has plenty of bugs, although it is a great plugin, so be weary of assuming what you see is proper / correct.

The most you can do to counter-act something like this is making more generic AOB's to scan with. Mark more things as wildcards. Such as the registers being used in the various mov's. The values / offsets being used in the mov's and pushes, etc. It may land up making your AOB's a lot longer, but they may survive the random patches better then.

If the issue is simply optimization, there is not much to be done since its how the compiler is compiling down the raw code. If it is a compression method or obfuscation of some sort you could take other methods to handle things but from how you are explaining it, it doesn't sound like that is the case.