View previous topic :: View next topic |
Author |
Message |
Darcon2k Cheater
Reputation: 0
Joined: 13 Feb 2015 Posts: 48
|
Posted: Tue Feb 17, 2015 8:28 am Post subject: Upadting Auto Assembly scripts after game patch. |
|
|
Last edited by Darcon2k on Thu Mar 26, 2015 9:55 am; edited 2 times in total |
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Tue Feb 17, 2015 5:19 pm Post subject: |
|
|
In CE, click the Writable checkbox below the search so that it is filled in (not checked, not unchecked)
Do an Array of byte search for: 0F 85 ?? ?? ?? ?? 8B 47 24 8B 08 85 C9
Find anything?
Maybe just try 8B 47 24 8B 08 85 C9 also?
|
|
Back to top |
|
 |
Darcon2k Cheater
Reputation: 0
Joined: 13 Feb 2015 Posts: 48
|
Posted: Tue Feb 17, 2015 10:15 pm Post subject: |
|
|
Last edited by Darcon2k on Thu Mar 26, 2015 9:55 am; edited 2 times in total |
|
Back to top |
|
 |
Pingo Grandmaster Cheater
Reputation: 8
Joined: 12 Jul 2007 Posts: 571
|
Posted: Wed Feb 18, 2015 2:23 pm Post subject: |
|
|
What about
0F 85 ?? ?? ?? ?? 8B 47 ?? 8B 08
what game?
_________________
|
|
Back to top |
|
 |
SteveAndrew Master Cheater
Reputation: 30
Joined: 02 Sep 2012 Posts: 323
|
Posted: Wed Feb 18, 2015 9:18 pm Post subject: |
|
|
Maybe this: 8b 81 x x x x 83 e0 02 33 c9 0b c1
and if it's found see if your jne is after the or eax,ecx
Yeah or how about going to the old address : Game.exe+27A263
and manually scrolling up or down (depending on which direction it moved) I've had much success with that method in the past. It usually doesn't go too far away.
As your scrolling try and see if you recognize the code at all. Mostly the code thats closest to your jne, it could've changed but there is probably something you'll be able to recognize by your eye, which an aob scanner is trickier to get it to recognize.
Like for example none of the code in that second result looks anything like the first one... And it's way farther ahead in memory. It's possible, but usually it'll be a lot closer than that, if the code still got assembled the same. They could've redesigned the code and the resulting assembler will be different.
Know how to find the address from scratch if you need to? If not I recommend figuring out a way to find it from scratch, then it may be annoying to have to find it again manually, but at least you'll pretty much always be able to find it then
_________________
|
|
Back to top |
|
 |
|