 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Sat Dec 20, 2014 9:47 am Post subject: Jump hack problem |
|
|
Alright, so I scanned for 1 (able to jump) and 0 (not able to jump) and got down to a single address. The problem is that when I freeze it, it doesn't actually give me infinite jumps, it sorta does but only if I REALLY mash the jump button a lot. So what I did was I tried some auto assembly scripts, these are what I found when I found what writes to that address:
inc [rdi+08]
if I change this to "nop" then my character falls through the ground when I jump. If I change it to ANYTHING else the game just crashes.
dec [rdi+08]
If I change ANYTHING on this one the game just crashes.
So... how do I "properly" change those instructions so the game doesn't crash? Or am I doing something wrong?
I also tried to "select current function" on dec [rdi+08] (it also includes inc [rdi+08] further below), here it is:
Note: To be more specific, I am refering to:
DragonAgeInquisition.exe+4581D1B - inc [rdi+08]
DragonAgeInquisition.exe+4581C8B - dec [rdi+08]
Code: |
DragonAgeInquisition.exe+4581B80 - mov rax,[rdx+rbx]
DragonAgeInquisition.exe+4581B84 - lea rbx,[rbx+08]
DragonAgeInquisition.exe+4581B88 - mov [rbx-08],rax
DragonAgeInquisition.exe+4581B8C - dec rcx
DragonAgeInquisition.exe+4581B8F - jne DragonAgeInquisition.exe+4581B80
DragonAgeInquisition.exe+4581B91 - mov eax,[rsp+000000C8]
DragonAgeInquisition.exe+4581B98 - mov rbp,[rsp+38]
DragonAgeInquisition.exe+4581B9D - mov ecx,[rsp+20]
DragonAgeInquisition.exe+4581BA1 - mov rdx,[rsp+40]
DragonAgeInquisition.exe+4581BA6 - mov r11,[rsp+30]
DragonAgeInquisition.exe+4581BAB - dec ecx
DragonAgeInquisition.exe+4581BAD - sub rdx,40
DragonAgeInquisition.exe+4581BB1 - sub rbp,40
DragonAgeInquisition.exe+4581BB5 - mov [rsp+20],ecx
DragonAgeInquisition.exe+4581BB9 - mov [rsp+40],rdx
DragonAgeInquisition.exe+4581BBE - mov [rsp+38],rbp
DragonAgeInquisition.exe+4581BC3 - mov r10d,00000000
DragonAgeInquisition.exe+4581BC9 - test ecx,ecx
DragonAgeInquisition.exe+4581BCB - jns DragonAgeInquisition.exe+4581A96
DragonAgeInquisition.exe+4581BD1 - mov r13,[rsp+000000D0]
DragonAgeInquisition.exe+4581BD9 - movaps xmm7,[rsp+60]
DragonAgeInquisition.exe+4581BDE - test eax,eax
DragonAgeInquisition.exe+4581BE0 - jng DragonAgeInquisition.exe+4581D3A
DragonAgeInquisition.exe+4581BE6 - mov r15,r11
DragonAgeInquisition.exe+4581BE9 - lea rsi,[r11+10]
DragonAgeInquisition.exe+4581BED - mov esp,eax
DragonAgeInquisition.exe+4581BF0 - movaps xmm0,[rsi]
DragonAgeInquisition.exe+4581BF3 - shufps xmm0,xmm0,-01
DragonAgeInquisition.exe+4581BF7 - ucomiss xmm0,xmm8
DragonAgeInquisition.exe+4581BFB - jne DragonAgeInquisition.exe+4581D29
DragonAgeInquisition.exe+4581C01 - lea rdx,[rsi-10]
DragonAgeInquisition.exe+4581C05 - mov r8,rdi
DragonAgeInquisition.exe+4581C08 - mov rcx,r14
DragonAgeInquisition.exe+4581C0B - call DragonAgeInquisition.exe+4582687
DragonAgeInquisition.exe+4581C10 - test eax,eax
DragonAgeInquisition.exe+4581C12 - js DragonAgeInquisition.exe+4581CCE
DragonAgeInquisition.exe+4581C18 - movsxd rbx,eax
DragonAgeInquisition.exe+4581C1B - shl rbx,06
DragonAgeInquisition.exe+4581C1F - add rbx,[rdi]
DragonAgeInquisition.exe+4581C22 - mov rax,[rbx+30]
DragonAgeInquisition.exe+4581C26 - cmp [rsi+20],rax
DragonAgeInquisition.exe+4581C2A - je DragonAgeInquisition.exe+4581C43
DragonAgeInquisition.exe+4581C2C - mov rdx,rbx
DragonAgeInquisition.exe+4581C2F - mov rcx,r14
DragonAgeInquisition.exe+4581C32 - call DragonAgeInquisition.exe+4582930
DragonAgeInquisition.exe+4581C37 - lea rdx,[rsi-10]
DragonAgeInquisition.exe+4581C3B - mov rcx,r14
DragonAgeInquisition.exe+4581C3E - call DragonAgeInquisition.exe+45828CA
DragonAgeInquisition.exe+4581C43 - movaps xmm0,[rsi-10]
DragonAgeInquisition.exe+4581C47 - movaps [rbx],xmm0
DragonAgeInquisition.exe+4581C4A - movaps xmm1,[rsi]
DragonAgeInquisition.exe+4581C4D - movaps [rbx+10],xmm1
DragonAgeInquisition.exe+4581C51 - mov rax,[rsi+10]
DragonAgeInquisition.exe+4581C55 - mov [rbx+20],rax
DragonAgeInquisition.exe+4581C59 - mov eax,[rsi+18]
DragonAgeInquisition.exe+4581C5C - mov [rbx+28],eax
DragonAgeInquisition.exe+4581C5F - mov rax,[rsi+20]
DragonAgeInquisition.exe+4581C63 - mov [rbx+30],rax
DragonAgeInquisition.exe+4581C67 - mov eax,[rsi+28]
DragonAgeInquisition.exe+4581C6A - mov [rbx+38],eax
DragonAgeInquisition.exe+4581C6D - jmp DragonAgeInquisition.exe+4581D29
DragonAgeInquisition.exe+4581C72 - add [rax-75],cl
DragonAgeInquisition.exe+4581C75 - cmovs ecx,[rbx+4838246C]
DragonAgeInquisition.exe+4581C7C - mov edx,[rsp+40]
DragonAgeInquisition.exe+4581C80 - add rdx,rcx
DragonAgeInquisition.exe+4581C83 - mov rcx,r14
DragonAgeInquisition.exe+4581C86 - call DragonAgeInquisition.exe+4582930
DragonAgeInquisition.exe+4581C8B - dec [rdi+08]
DragonAgeInquisition.exe+4581C8E - movsxd rcx,dword ptr [rdi+08]
DragonAgeInquisition.exe+4581C92 - cmp ecx,[rsp+20]
DragonAgeInquisition.exe+4581C96 - je DragonAgeInquisition.exe+4581CC2
DragonAgeInquisition.exe+4581C98 - mov rax,[rdi]
DragonAgeInquisition.exe+4581C9B - mov r8,rcx
DragonAgeInquisition.exe+4581C9E - mov edx,00000008
DragonAgeInquisition.exe+4581CA3 - shl r8,06
DragonAgeInquisition.exe+4581CA7 - lea rcx,[rax+rbp]
DragonAgeInquisition.exe+4581CAB - add r8,rax
DragonAgeInquisition.exe+4581CAE - sub r8,rcx
DragonAgeInquisition.exe+4581CB1 - mov rax,[r8+rcx]
DragonAgeInquisition.exe+4581CB5 - lea rcx,[rcx+08]
DragonAgeInquisition.exe+4581CB9 - mov [rcx-08],rax
DragonAgeInquisition.exe+4581CBD - dec rdx
DragonAgeInquisition.exe+4581CC0 - jne DragonAgeInquisition.exe+4581CB1
DragonAgeInquisition.exe+4581CC2 - mov eax,[rsp+000000C8]
DragonAgeInquisition.exe+4581CC9 - jmp DragonAgeInquisition.exe+4581B9D
DragonAgeInquisition.exe+4581CCE - mov eax,[rdi+0C]
DragonAgeInquisition.exe+4581CD1 - and eax,3FFFFFFF : [00000000]
DragonAgeInquisition.exe+4581CD6 - cmp [rdi+08],eax
DragonAgeInquisition.exe+4581CD9 - jne DragonAgeInquisition.exe+4581CF0
DragonAgeInquisition.exe+4581CDB - lea rcx,[DragonAgeInquisition.exe+260DAE0]
DragonAgeInquisition.exe+4581CE2 - mov r8d,00000040
DragonAgeInquisition.exe+4581CE8 - mov rdx,rdi
DragonAgeInquisition.exe+4581CEB - call DragonAgeInquisition.exe+443618B
DragonAgeInquisition.exe+4581CF0 - movsxd rax,dword ptr [rdi+08]
DragonAgeInquisition.exe+4581CF4 - shl rax,06
DragonAgeInquisition.exe+4581CF8 - add rax,[rdi]
DragonAgeInquisition.exe+4581CFB - je DragonAgeInquisition.exe+4581D1B
DragonAgeInquisition.exe+4581CFD - movaps xmm0,[rsi-10]
DragonAgeInquisition.exe+4581D01 - movaps [rax],xmm0
DragonAgeInquisition.exe+4581D04 - movaps xmm1,[rsi]
DragonAgeInquisition.exe+4581D07 - movaps [rax+10],xmm1
DragonAgeInquisition.exe+4581D0B - movaps xmm0,[rsi+10]
DragonAgeInquisition.exe+4581D0F - movaps [rax+20],xmm0
DragonAgeInquisition.exe+4581D13 - movaps xmm1,[rsi+20]
DragonAgeInquisition.exe+4581D17 - movaps [rax+30],xmm1
DragonAgeInquisition.exe+4581D1B - inc [rdi+08]
DragonAgeInquisition.exe+4581D1E - mov rdx,r15
DragonAgeInquisition.exe+4581D21 - mov rcx,r14
DragonAgeInquisition.exe+4581D24 - call DragonAgeInquisition.exe+45828CA
DragonAgeInquisition.exe+4581D29 - add r15,40
DragonAgeInquisition.exe+4581D2D - add rsi,40
DragonAgeInquisition.exe+4581D31 - dec rsp
DragonAgeInquisition.exe+4581D34 - jne DragonAgeInquisition.exe+4581BF0
DragonAgeInquisition.exe+4581D3A - cmp dword ptr [r13+18],00
DragonAgeInquisition.exe+4581D3F - movaps xmm8,[rsp+50]
DragonAgeInquisition.exe+4581D45 - jle DragonAgeInquisition.exe+4581DB9
DragonAgeInquisition.exe+4581D47 - mov rbx,[r13+10]
DragonAgeInquisition.exe+4581D4B - mov r8,rdi
DragonAgeInquisition.exe+4581D4E - mov rcx,r14
DragonAgeInquisition.exe+4581D51 - mov rdx,rbx
DragonAgeInquisition.exe+4581D54 - call DragonAgeInquisition.exe+4582687
DragonAgeInquisition.exe+4581D59 - cmp eax,-01
DragonAgeInquisition.exe+4581D5C - jne DragonAgeInquisition.exe+4581DB9
DragonAgeInquisition.exe+4581D5E - mov eax,[rdi+0C]
DragonAgeInquisition.exe+4581D61 - and eax,3FFFFFFF : [00000000]
DragonAgeInquisition.exe+4581D66 - cmp [rdi+08],eax
DragonAgeInquisition.exe+4581D69 - jne DragonAgeInquisition.exe+4581D80
DragonAgeInquisition.exe+4581D6B - lea rcx,[DragonAgeInquisition.exe+260DAE0]
DragonAgeInquisition.exe+4581D72 - mov r8d,00000040
DragonAgeInquisition.exe+4581D78 - mov rdx,rdi
DragonAgeInquisition.exe+4581D7B - call DragonAgeInquisition.exe+443618B
DragonAgeInquisition.exe+4581D80 - movsxd rax,dword ptr [rdi+08]
DragonAgeInquisition.exe+4581D84 - shl rax,06
DragonAgeInquisition.exe+4581D88 - add rax,[rdi]
DragonAgeInquisition.exe+4581D8B - je DragonAgeInquisition.exe+4581DAB
DragonAgeInquisition.exe+4581D8D - movaps xmm0,[rbx]
DragonAgeInquisition.exe+4581D90 - movaps [rax],xmm0
DragonAgeInquisition.exe+4581D93 - movaps xmm1,[rbx+10]
DragonAgeInquisition.exe+4581D97 - movaps [rax+10],xmm1
DragonAgeInquisition.exe+4581D9B - movaps xmm0,[rbx+20]
DragonAgeInquisition.exe+4581D9F - movaps [rax+20],xmm0
DragonAgeInquisition.exe+4581DA3 - movaps xmm1,[rbx+30]
DragonAgeInquisition.exe+4581DA7 - movaps [rax+30],xmm1
DragonAgeInquisition.exe+4581DAB - inc [rdi+08]
DragonAgeInquisition.exe+4581DAE - mov rdx,rbx
DragonAgeInquisition.exe+4581DB1 - mov rcx,r14
DragonAgeInquisition.exe+4581DB4 - call DragonAgeInquisition.exe+45828CA
DragonAgeInquisition.exe+4581DB9 - mov esi,[rdi+08]
DragonAgeInquisition.exe+4581DBC - dec esi
DragonAgeInquisition.exe+4581DBE - movsxd r12,esi
DragonAgeInquisition.exe+4581DC1 - test esi,esi
DragonAgeInquisition.exe+4581DC3 - jng DragonAgeInquisition.exe+4581E68
DragonAgeInquisition.exe+4581DC9 - movss xmm6,[DragonAgeInquisition.exe+1D0BB14]
DragonAgeInquisition.exe+4581DD1 - shl rsp,06
DragonAgeInquisition.exe+4581DD5 - mov r13,r12
DragonAgeInquisition.exe+4581DD8 - lea ebx,[rsi-01]
DragonAgeInquisition.exe+4581DDB - mov [rsp+000000D8],ebx
DragonAgeInquisition.exe+4581DE2 - cmp esi,01
DragonAgeInquisition.exe+4581DE5 - jnge DragonAgeInquisition.exe+4581E51
DragonAgeInquisition.exe+4581DE7 - mov rbp,[rdi]
DragonAgeInquisition.exe+4581DEA - mov r15,r13
DragonAgeInquisition.exe+4581DED - add r15,rbp
DragonAgeInquisition.exe+4581DF0 - movsxd r8,ebx
DragonAgeInquisition.exe+4581DF3 - mov rdx,r15
DragonAgeInquisition.exe+4581DF6 - mov rcx,r14
DragonAgeInquisition.exe+4581DF9 - shl r8,06
DragonAgeInquisition.exe+4581DFD - add r8,rbp
DragonAgeInquisition.exe+4581E00 - call DragonAgeInquisition.exe+4583864
DragonAgeInquisition.exe+4581E05 - comiss xmm0,xmm6
DragonAgeInquisition.exe+4581E08 - jb DragonAgeInquisition.exe+4581E10
DragonAgeInquisition.exe+4581E0A - dec ebx
DragonAgeInquisition.exe+4581E0C - jns DragonAgeInquisition.exe+4581DF0
DragonAgeInquisition.exe+4581E0E - jmp DragonAgeInquisition.exe+4581E51
DragonAgeInquisition.exe+4581E10 - mov rdx,r15
DragonAgeInquisition.exe+4581E13 - mov rcx,r14
DragonAgeInquisition.exe+4581E16 - call DragonAgeInquisition.exe+4582930
DragonAgeInquisition.exe+4581E1B - dec [rdi+08]
DragonAgeInquisition.exe+4581E1E - movsxd rcx,dword ptr [rdi+08]
DragonAgeInquisition.exe+4581E22 - cmp ecx,esi
DragonAgeInquisition.exe+4581E24 - je DragonAgeInquisition.exe+4581E51
DragonAgeInquisition.exe+4581E26 - mov rax,[rdi]
DragonAgeInquisition.exe+4581E29 - mov r8,rcx
DragonAgeInquisition.exe+4581E2C - mov edx,00000008
DragonAgeInquisition.exe+4581E31 - shl r8,06
DragonAgeInquisition.exe+4581E35 - lea rcx,[r12+rax]
DragonAgeInquisition.exe+4581E39 - add r8,rax
DragonAgeInquisition.exe+4581E3C - sub r8,rcx
DragonAgeInquisition.exe+4581E3F - nop
DragonAgeInquisition.exe+4581E40 - mov rax,[r8+rcx]
DragonAgeInquisition.exe+4581E44 - lea rcx,[rcx+08]
DragonAgeInquisition.exe+4581E48 - mov [rcx-08],rax
DragonAgeInquisition.exe+4581E4C - dec rdx
DragonAgeInquisition.exe+4581E4F - jne DragonAgeInquisition.exe+4581E40
DragonAgeInquisition.exe+4581E51 - mov esi,[rsp+000000D8]
DragonAgeInquisition.exe+4581E58 - sub r13,40
DragonAgeInquisition.exe+4581E5C - sub rsp,40
DragonAgeInquisition.exe+4581E60 - test esi,esi
DragonAgeInquisition.exe+4581E62 - jg DragonAgeInquisition.exe+4581DD8
DragonAgeInquisition.exe+4581E68 - cmp byte ptr [rsp+000000F0],00
DragonAgeInquisition.exe+4581E70 - movaps xmm6,[rsp+70]
DragonAgeInquisition.exe+4581E75 - mov r13,[rsp+00000090]
DragonAgeInquisition.exe+4581E7D - mov r12,[rsp+00000098]
DragonAgeInquisition.exe+4581E85 - jne DragonAgeInquisition.exe+4581EC2
DragonAgeInquisition.exe+4581E87 - cmp dword ptr [rdi+08],00
DragonAgeInquisition.exe+4581E8B - jle DragonAgeInquisition.exe+4581EC2
DragonAgeInquisition.exe+4581E8D - mov r15,[rsp+000000E0]
DragonAgeInquisition.exe+4581E95 - mov rbp,[rsp+000000E8]
DragonAgeInquisition.exe+4581E9D - xor esi,esi
DragonAgeInquisition.exe+4581E9F - mov ebx,esi
DragonAgeInquisition.exe+4581EA1 - mov rdx,[rdi]
DragonAgeInquisition.exe+4581EA4 - mov r9,rbp
DragonAgeInquisition.exe+4581EA7 - mov r8,r15
DragonAgeInquisition.exe+4581EAA - mov rdx,[rdx+rbx+30]
DragonAgeInquisition.exe+4581EAF - mov rcx,r14
DragonAgeInquisition.exe+4581EB2 - call DragonAgeInquisition.exe+4583690
DragonAgeInquisition.exe+4581EB7 - inc esi
DragonAgeInquisition.exe+4581EB9 - lea rbx,[rbx+40]
DragonAgeInquisition.exe+4581EBD - cmp esi,[rdi+08]
DragonAgeInquisition.exe+4581EC0 - jnge DragonAgeInquisition.exe+4581EA1
DragonAgeInquisition.exe+4581EC2 - mov ebx,[rsp+24]
DragonAgeInquisition.exe+4581EC6 - mov ecx,[DragonAgeInquisition.exe+2A6EF98]
DragonAgeInquisition.exe+4581ECC - shl ebx,06
DragonAgeInquisition.exe+4581ECF - add ebx,7F
DragonAgeInquisition.exe+4581ED2 - and ebx,-80
DragonAgeInquisition.exe+4581ED5 - push r8
DragonAgeInquisition.exe+4581ED7 - mov r8,gs:[00000030]
DragonAgeInquisition.exe+4581EE0 - mov r8d,[r8+40]
DragonAgeInquisition.exe+4581EE4 - mov rax,[DragonAgeInquisition.exe+4E6C40F]
DragonAgeInquisition.exe+4581EEB - sub rax,r8
DragonAgeInquisition.exe+4581EEE - pop r8
DragonAgeInquisition.exe+4581EF0 - call eax
DragonAgeInquisition.exe+4581EF2 - mov r15,[rsp+00000080]
DragonAgeInquisition.exe+4581EFA - mov r14,[rsp+00000088]
DragonAgeInquisition.exe+4581F02 - mov rdi,[rsp+000000A0]
DragonAgeInquisition.exe+4581F0A - mov rbp,[rsp+000000A8]
DragonAgeInquisition.exe+4581F12 - mov rsi,[rsp+30]
DragonAgeInquisition.exe+4581F17 - lea r8d,[rbx+0F]
DragonAgeInquisition.exe+4581F1B - and r8d,-10
DragonAgeInquisition.exe+4581F1F - cmp ebx,[rax+10]
DragonAgeInquisition.exe+4581F22 - mov rbx,[rsp+000000C0]
DragonAgeInquisition.exe+4581F2A - jg DragonAgeInquisition.exe+4581F44
DragonAgeInquisition.exe+4581F2C - movsxd rcx,r8d
DragonAgeInquisition.exe+4581F2F - add rcx,rsi
DragonAgeInquisition.exe+4581F32 - cmp rcx,[rax+18]
DragonAgeInquisition.exe+4581F36 - jne DragonAgeInquisition.exe+4581F44
DragonAgeInquisition.exe+4581F38 - cmp [rax+28],rsi
DragonAgeInquisition.exe+4581F3C - je DragonAgeInquisition.exe+4581F44
DragonAgeInquisition.exe+4581F3E - mov [rax+18],rsi
DragonAgeInquisition.exe+4581F42 - jmp DragonAgeInquisition.exe+4581F4F
DragonAgeInquisition.exe+4581F44 - mov rdx,rsi
DragonAgeInquisition.exe+4581F47 - mov rcx,rax
DragonAgeInquisition.exe+4581F4A - call DragonAgeInquisition.exe+44350BB
DragonAgeInquisition.exe+4581F4F - mov eax,[rsp+28]
DragonAgeInquisition.exe+4581F53 - test eax,eax
DragonAgeInquisition.exe+4581F55 - js DragonAgeInquisition.exe+4581F76
DragonAgeInquisition.exe+4581F57 - and eax,3FFFFFFF : [00000000]
DragonAgeInquisition.exe+4581F5C - lea rcx,[DragonAgeInquisition.exe+260DAE0]
DragonAgeInquisition.exe+4581F63 - mov rdx,rsi
DragonAgeInquisition.exe+4581F66 - shl eax,06
DragonAgeInquisition.exe+4581F69 - mov r8d,eax
DragonAgeInquisition.exe+4581F6C - mov rax,[DragonAgeInquisition.exe+260DAE0]
DragonAgeInquisition.exe+4581F73 - call qword ptr [rax+20]
DragonAgeInquisition.exe+4581F76 - add rsp,000000B0
DragonAgeInquisition.exe+4581F7D - pop rsi
DragonAgeInquisition.exe+4581F7E - ret |
Yeah, I'm trying to hack the jump in dragon age... hehe.
Pretty much, I want the ability to keep jumping however many times I want to, or increase my jump height; and I can't figure out how to do that cause the game keeps crashing...
|
|
Back to top |
|
 |
indianachones Cheater
Reputation: 0
Joined: 23 Nov 2014 Posts: 27
|
Posted: Mon Dec 22, 2014 6:35 pm Post subject: |
|
|
mmmm lets see.
could it be the same if you just teleport at a high height and then you fall down with gravity as usual?
if is that the case you may want to do this:
1- look for the address that stores the Y position of you character (assuming Y is height). Probably it will be a float or double number. just jump and use increse decrese method as always.
2- find what writes that address when you press the jump key
3- make an script that sets Y position address to the desired height
|
|
Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Mon Dec 22, 2014 7:38 pm Post subject: |
|
|
indianachones wrote: | mmmm lets see.
could it be the same if you just teleport at a high height and then you fall down with gravity as usual?
if is that the case you may want to do this:
1- look for the address that stores the Y position of you character (assuming Y is height). Probably it will be a float or double number. just jump and use increse decrese method as always.
2- find what writes that address when you press the jump key
3- make an script that sets Y position address to the desired height |
Yeah but then my character will just "teleport"; I want him to actually jump, with the animations and stuff.
|
|
Back to top |
|
 |
indianachones Cheater
Reputation: 0
Joined: 23 Nov 2014 Posts: 27
|
Posted: Mon Dec 22, 2014 8:01 pm Post subject: |
|
|
ok. lets say that you found the Y position address.
i belive that there is 2 posible codes
1st code: 1 code when you go up and another code when you go down
2nd code: it sets height going up or down with the same opcode
well. the first 1 its easy you just nop the code that sends you down.
the second code its the problem and its really common to find. you have to check the previous value and if current value it is lower just nop it
|
|
Back to top |
|
 |
Demolish Cheater
Reputation: 0
Joined: 27 Dec 2010 Posts: 32
|
Posted: Mon Dec 22, 2014 9:02 pm Post subject: |
|
|
I think these values are not made for finding if you can jump or not, these values are for finding that if you are still rising/falling or You are in the sky/or on ground, that may be your problem. You have to set [rdi+08] to 1 for a while after pressing jump key and set it back to 0 so it will recognize that you are on ground and jump then and after while it will detect that you are in the sky rising up.
|
|
Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Mon Dec 22, 2014 11:36 pm Post subject: |
|
|
Demolish wrote: | I think these values are not made for finding if you can jump or not, these values are for finding that if you are still rising/falling or You are in the sky/or on ground, that may be your problem. You have to set [rdi+08] to 1 for a while after pressing jump key and set it back to 0 so it will recognize that you are on ground and jump then and after while it will detect that you are in the sky rising up. |
Yeah, well, if I change those values to anything other than what they are now, the game just crashes.
indianachones wrote: | ok. lets say that you found the Y position address.
i belive that there is 2 posible codes
1st code: 1 code when you go up and another code when you go down
2nd code: it sets height going up or down with the same opcode
well. the first 1 its easy you just nop the code that sends you down.
the second code its the problem and its really common to find. you have to check the previous value and if current value it is lower just nop it |
That could work... I'll try it later
PS: Do any of you guys know how to make a timer in assembly? Say I want a thread to wait a second or so before continuing on?
|
|
Back to top |
|
 |
zm0d Master Cheater
Reputation: 7
Joined: 06 Nov 2013 Posts: 423
|
Posted: Tue Dec 23, 2014 6:02 am Post subject: |
|
|
What do you mean with infinite jumps?
A) Jumping 1 time and then flying to the universe?
B) Being able to jump again if you are still in air?
If A) then slightly increase the Y value.
If B) then get your value again, that indicates if you're in air or not. There you attach the Debugger with "Find out what accesses this address". Jump then ingame and check the result list of the breakpoint. I bet my ass there will be some CMP or TEST after the value got loaded to a register. And right after the CMP will come a JUMP and a CALL to the games jump function. Your job is now to let the game always execute the jump function regardless if the value indicating that you're in air is 0 or 1. (Probably by removing the CMP/TEST with NOPs)
Code: | Pseudocode:
public void PressedJumpKey() {
If (player.isInAir)
return;
player.jump ();
} |
|
|
Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Tue Dec 23, 2014 11:06 am Post subject: |
|
|
zm0d wrote: | What do you mean with infinite jumps?
A) Jumping 1 time and then flying to the universe?
B) Being able to jump again if you are still in air?
If A) then slightly increase the Y value.
If B) then get your value again, that indicates if you're in air or not. There you attach the Debugger with "Find out what accesses this address". Jump then ingame and check the result list of the breakpoint. I bet my ass there will be some CMP or TEST after the value got loaded to a register. And right after the CMP will come a JUMP and a CALL to the games jump function. Your job is now to let the game always execute the jump function regardless if the value indicating that you're in air is 0 or 1. (Probably by removing the CMP/TEST with NOPs)
Code: | Pseudocode:
public void PressedJumpKey() {
If (player.isInAir)
return;
player.jump ();
} |
|
I found the cmp opcode and turned it into a nop; though it didn't do anything...
here's what I get from the debugger:
Code: |
34 144581C8B - FF 4F 08 - dec [rdi+08]
34 144581C8E - 48 63 4F 08 - movsxd rcx,dword ptr [rdi+08]
54 14458268F - 45 8B 58 08 - mov r11d,[r8+08]
15 144581CD6 - 39 47 08 - cmp [rdi+08],eax
34 144581CF0 - 48 63 47 08 - movsxd rax,dword ptr [rdi+08]
34 144581D1B - FF 47 08 - inc [rdi+08]
22 143E75F97 - 83 78 08 01 - cmp dword ptr [rax+08],01
6 143E8BD1C - 41 39 77 08 - cmp [r15+08],esi |
I tried to replace all the CMPs with NOPs, but nothing; and after a minute or two, the game crashed. I think I jumped like 12 times or so.
|
|
Back to top |
|
 |
Demolish Cheater
Reputation: 0
Joined: 27 Dec 2010 Posts: 32
|
Posted: Tue Dec 23, 2014 4:02 pm Post subject: |
|
|
Never try to nop inc or dec when it comes to bool value(because value will go to infinite or else to -infinite over time, and that value is to recognize true/false). Try to do something like this:
Code: |
globalalloc(memory,2000)
createthread(memory)
memory:
push ' ' //space button
call GetAsyncKeyState
cmp eax,0
jge memory
mov "POINTER TO THIS VALUE->[rdi+08]",0
push #100
call Sleep
mov "POINTER TO THIS VALUE->[rdi+08]",1
jmp memory
|
|
|
Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Tue Dec 23, 2014 5:45 pm Post subject: |
|
|
Demolish wrote: | Never try to nop inc or dec when it comes to bool value(because value will go to infinite or else to -infinite over time, and that value is to recognize true/false). Try to do something like this:
Code: |
globalalloc(memory,2000)
createthread(memory)
memory:
push ' ' //space button
call GetAsyncKeyState
cmp eax,0
jge memory
mov "POINTER TO THIS VALUE->[rdi+08]",0
push #100
call Sleep
mov "POINTER TO THIS VALUE->[rdi+08]",1
jmp memory
|
|
Uhh, I'm new to assembly...
"push ' ' // space button" - nice, didn't know that...
"mov "POINTER TO THIS VALUE->[rdi+08]",0" - what?
"mov "POINTER TO THIS VALUE->[rdi+08]",1" - again, what?
Where do I put this in? Do I remove those inc/dec opcodes and put this code in?
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|