Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


A few question about this script

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Nemexia55
Expert Cheater
Reputation: 0

Joined: 28 Jan 2014
Posts: 160
PostPosted: Sun Jul 05, 2015 4:51 am    Post subject: A few question about this script Reply with quote
Hi
Sorry for dumb questions im going to ask at the end, but i really want to improve(don't laugh at me please Sad ).

This script is for CE Tutorial step 4, health(float):

i have added parts which have "//*" at their end.

Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
alloc(x,4) //*
label(returnhere)
label(originalcode)
label(exit)

x:  //*
db 00 40 9C 45    //*

newmem: //this is allocated memory, you have read,write,execute access
fld dword ptr [x]  //*

originalcode:

fstp dword ptr [ebx+00000494]

exit:
jmp returnhere

"Tutorial-i386.exe"+25DF0:
jmp newmem
nop
returnhere:



 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
dealloc(x) //*
"Tutorial-i386.exe"+25DF0:
fstp dword ptr [ebx+00000494]
//Alt: db D9 9B 94 04 00 00

{
// ORIGINAL CODE - INJECTION POINT: "Tutorial-i386.exe"+25DF0

"Tutorial-i386.exe"+25DCC: DB 7D C0              -  fstp tword ptr [ebp-40]
"Tutorial-i386.exe"+25DCF: B8 04 00 00 00        -  mov eax,00000004
"Tutorial-i386.exe"+25DD4: E8 87 6F FE FF        -  call Tutorial-i386.exe+CD60
"Tutorial-i386.exe"+25DD9: 89 45 D0              -  mov [ebp-30],eax
"Tutorial-i386.exe"+25DDC: DB 45 D0              -  fild dword ptr [ebp-30]
"Tutorial-i386.exe"+25DDF: DB 6D C0              -  fld tword ptr [ebp-40]
"Tutorial-i386.exe"+25DE2: DE C1                 -  faddp
"Tutorial-i386.exe"+25DE4: D9 5D FC              -  fstp dword ptr [ebp-04]
"Tutorial-i386.exe"+25DE7: D9 45 FC              -  fld dword ptr [ebp-04]
"Tutorial-i386.exe"+25DEA: D8 AB 94 04 00 00     -  fsubr dword ptr [ebx+00000494]
// ---------- INJECTING HERE ----------
"Tutorial-i386.exe"+25DF0: D9 9B 94 04 00 00     -  fstp dword ptr [ebx+00000494]
// ---------- DONE INJECTING  ----------
"Tutorial-i386.exe"+25DF6: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+25DF9: E8 12 DD FD FF        -  call Tutorial-i386.exe+3B10
"Tutorial-i386.exe"+25DFE: C7 45 BC 00 00 00 00  -  mov [ebp-44],00000000
"Tutorial-i386.exe"+25E05: FF B3 94 04 00 00     -  push [ebx+00000494]
"Tutorial-i386.exe"+25E0B: 8D 45 BC              -  lea eax,[ebp-44]
"Tutorial-i386.exe"+25E0E: 50                    -  push eax
"Tutorial-i386.exe"+25E0F: B9 04 00 00 00        -  mov ecx,00000004
"Tutorial-i386.exe"+25E14: BA 04 00 00 00        -  mov edx,00000004
"Tutorial-i386.exe"+25E19: B8 00 00 00 00        -  mov eax,00000000
"Tutorial-i386.exe"+25E1E: E8 6D 97 01 00        -  call Tutorial-i386.exe+3F590
}



Questions:

1-This script works as i wanted but i don't know why after i press hit me button several times, it suddenly gives me an error(or exits the tutorial).WHY?(is it because it slows the function down,or im messing with FPU stack?)

2-in order to push my value which is 5000(float) into the stack,i allocated "x" and db it D9 9B 94 04 00 00, and the added this code: "fld dword ptr [x]", is there another way to do it, or even am i doing it in wrong way?

3-Should "fld dword ptr [x]" have "dword ptr" or it can function without it too?

4-When i used "Break and trace instruction" on this, and then i went to "FPU">"FPURegisters">"float" it didnt show anything, but when i went to "extended" it showed the numbers,(i thought as its float, float tab should show it),WHY?

5-i know i have more questions but at the moment i cannot recall them. i will add them later
_________________
Back to top
View user's profile Send private message
vng21092
Grandmaster Cheater
Reputation: 15

Joined: 05 Apr 2013
Posts: 644
PostPosted: Sun Jul 05, 2015 6:20 am    Post subject: Reply with quote
1) Yes, you messed up the FPU stack, you should know that "fld" and "fstp" comes in pairs, you don't have one without the other. "fld" loads a value (pushes a value on top of FPU stack), and "fstp" stores it (grabs value from top of FPU stack and pops it off), not an exact definition, but basically what they do. So lets have a look here

here we see a "fld" and "fstp" pair highlighted in the red box, but in your code, you inject ANOTHER "fld", now the "fld" you injected is paired up with the "fstp" in the bottom red box, and now there's always gonna be a value in the stack that doesn't belong (because of the first/original "fld").

2) Remember what I said about "fld" and "fstp" always in pairs? Directly beneath your injection point, just push the new value and pop it in so you overwrite it.
Code:
originalcode:
fstp dword ptr [ebx+00000494]  //<--Original Code
fld [x] //<--Push X
fstp [ebx+494] //<--Pop it into [ebx+494] (overwriting it)
jmp returnhere

//-----OR-----

//originalcode:
//fstp dword ptr [ebx+00000494]  //<--Original Code
//mov [ebx+494],x //I think? I don't normally do this
//jmp returnhere

3) I forget what "dword ptr" means, but I usually find it works fine without it. I think "dword ptr" just lets the assembler know its working with a dword (unsigned long). The same way that "byte ptr" lets the assembler know its working with a byte.

4) You probably traced it at the wrong location, I don't use that feature much so I can't really say (though I should look more into it, from what I read it sounds like useful stuff)

5) ok Wink

SIDE NOTES:

1) Initialize "x" with "dd" and not "db", reference here. And just write this, it's easier
Code:
x:
dd (float)5000

2) And here is a reference page that I like tossing around just in case
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278
PostPosted: Sun Jul 05, 2015 7:00 am    Post subject: Reply with quote
The PTR stuff tells the system how large the address is.
byte ptr = 1 byte
word ptr = 2 bytes
dword ptr = 4 bytes / float
qword ptr = 8 bytes / double

A little trick to remove a value from the FPU stack is:
Code:
fstp st(0)


If you want to set your health, the better injection point would be to replace the original FLD:
Code:
"Tutorial-i386.exe"+25DE7: D9 45 FC              -  fld dword ptr [ebp-04]


If you only wanted unlimited health, you could simply NOP the FSUBR instruction:
Code:
"Tutorial-i386.exe"+25DEA: D8 AB 94 04 00 00     -  fsubr dword ptr [ebx+00000494]
Back to top
View user's profile Send private message
Nemexia55
Expert Cheater
Reputation: 0

Joined: 28 Jan 2014
Posts: 160
PostPosted: Sun Jul 05, 2015 7:53 am    Post subject: Reply with quote
1-(vng21092) i thought it must be something about being pair,too. but i couldn't change my script so it becomes ok,the first code you gave worked without anything wrong, the second code didn't work properly:

Code:

originalcode:
fstp dword ptr [ebx+00000494]  //<--Original Code
mov [ebx+494],x //I think? I don't normally do this
jmp returnhere


it gave 5.604835125E-39 instead of 5000 probably your code moves x's address instead of its value.(not sure, because im noob)
Thanks for help


2-(vng21092) well this is the answer that i expected, you added this after an edit, Thanks!:
Quote:
1) Initialize "x" with "dd" and not "db", reference here. And just write this, it's easier
Code:
x:
dd (float)5000


3-(Zanzer) Thanks for explanation!

4-(vng21092) im sure i have traced it at right position,i have tried this several times and it just shows values in extended not float part.

thanks (Zanzer) for information you gave,Really helpful.
_________________
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278
PostPosted: Sun Jul 05, 2015 9:22 am    Post subject: Reply with quote
Explanation of:
Code:
mov [ebx+494],x

This is moving the address (not value) of 'x' into your health value.
That is why you are receiving some strange number.
If you want to use MOV instead of FLD, you'll need to use:
Code:
mov eax,[x]
mov [ebx+494],eax

Note that I can use EAX in this case because the code that follows overwrites it anyway.
Code:
lea eax,[ebp-44]

If that were not the case, you would need to use PUSH and POP to preserve the value.
Back to top
View user's profile Send private message
Nemexia55
Expert Cheater
Reputation: 0

Joined: 28 Jan 2014
Posts: 160
PostPosted: Sun Jul 05, 2015 9:34 am    Post subject: Reply with quote
And if there was nothing after it, i had to use push and pop, true?

6-If i toggle a script and dont turn it off, and i close tutorial, will the effect remain when i relunch tutorial?
_________________
Back to top
View user's profile Send private message
Zanzer
I post too much
Reputation: 126

Joined: 09 Jun 2013
Posts: 3278
PostPosted: Sun Jul 05, 2015 9:42 am    Post subject: Reply with quote
Correct.

6 - Once the game is closed, all of your changes are lost. They do not overwrite the EXE, only what's in memory.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites