| View previous topic :: View next topic |
| Author |
Message |
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
 Posted: Sun Sep 27, 2015 4:17 am Post subject: CMP crashes the game |
 |
|
I am trying to cmp [eax + 0000095C] with #50000
But the game crashes when the script run.
Here's the script: | Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
cmp [eax+0000095C],#50000
jnl exit
mov eax,[ecx+00000964]
exit:
jmp returnhere
"HeavyWeapon.exe"+1B734:
jmp newmem
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"HeavyWeapon.exe"+1B734:
mov eax,[ecx+00000964]
//Alt: db 8B 81 64 09 00 00 |
what am i doing wrong?
|
|
| Back to top |
|
 |
STN
I post too much
 Reputation: 43
Joined: 09 Nov 2005
Posts: 2676
|
| Posted: Sun Sep 27, 2015 5:08 am Post subject: |
|
|
Recreate the original code
mov eax,[ecx+00000964]
Write your injection under newmem: or code:(new ce template), makes it easier to jump to original code.
If recreating code still crashes game, post the full code around "HeavyWeapon.exe"+1B734:
_________________
|
|
| Back to top |
|
|
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
| Posted: Sun Sep 27, 2015 7:27 am Post subject: |
|
|
What do you mean by "makes it easier to jump to original code"
I didn't put instruction to jump to the original code in my script
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sun Sep 27, 2015 8:25 am Post subject: |
|
|
The original code is using register ECX. Your code is using EAX.
Are you sure this is what you want?
Also, why are you skipping over the original code at all?
The game is setting the EAX register to use it later.
If you skip over it now, it will be some random value when it's later used.
According to your custom instruction, EAX will contain a pointer address.
So whatever value the game expects, it will be some huge value instead.
|
|
| Back to top |
|
|
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
| Posted: Sun Sep 27, 2015 9:03 am Post subject: |
|
|
The original code is mov eax,[ecx+00000964]
And I want to skip it if [Eax+0000095C] larger than #50000
|
|
| Back to top |
|
|
STN
I post too much
Reputation: 43
Joined: 09 Nov 2005
Posts: 2676
|
| Posted: Sun Sep 27, 2015 10:13 am Post subject: |
|
|
| danpuz wrote: | The original code is mov eax,[ecx+00000964]
And I want to skip it if [Eax+0000095C] larger than #50000 |
Which option are you trying to create ? I think i may still have the notes for this game when i trained it a decade ago and i don't think it involved any complicated injections at all.
The reason it probably is crashing is because eax maybe supposed to get an address from [ecx+00000964] and used further down but when you skip it, eax contains invalid address making it invalid pointer.
We can't know unless you post the full code or tell us what exactly are you trying to do here.
_________________
|
|
| Back to top |
|
|
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
| Posted: Sun Sep 27, 2015 11:22 am Post subject: |
|
|
The game has a life that have the value of 2.
when you die, you lose one life and you get the Message "get ready".
but when you die and don't have any life you get the Message "game over"
and lose the game.
the code mov eax,[ecx+00000964] triggers the "game over" message.
when i use this script: | Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
//mov eax,[ecx+00000964]
exit:
jmp returnhere
"HeavyWeapon.exe"+1B734:
jmp newmem
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"HeavyWeapon.exe"+1B734:
mov eax,[ecx+00000964]
//Alt: db 8B 81 64 09 00 00 |
the message "game over" will not be triggered when you die and don't have any life, but instead you get the message "get ready".
But when I tried to add the CMP to the script , the game crashed. Even if I did not add the JNL The game crashed
|
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
 Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Sun Sep 27, 2015 12:40 pm Post subject: |
|
|
| Code: | newmem:
push eax
mov eax,[eax+0000095C]
cmp eax,#50000
pop eax
jnl exit
mov eax,[ecx+00000964]
jmp returnhere |
maybe? idk.
|
|
| Back to top |
|
|
panraven
Grandmaster Cheater
![]() Reputation: 62
Joined: 01 Oct 2008
Posts: 958
|
| Posted: Sun Sep 27, 2015 1:01 pm Post subject: |
|
|
I happened has this game installed, this the aob injection ce template code at the position, STN said the full code, probably means this.
Also include a sample code about [..+95c], which is not near +1b734.
| Code: | { Game : HeavyWeapon.exe
Version:
Date : 2015-09-28
Author : user
This script does blah blah blah
}
[ENABLE]
aobscanmodule(whatever,HeavyWeapon.exe,8B 81 64 09 00 00) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov eax,[ecx+00000964]
jmp return
whatever:
jmp code
nop
return:
registersymbol(whatever)
[DISABLE]
whatever:
db 8B 81 64 09 00 00
unregistersymbol(whatever)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "HeavyWeapon.exe"+1B734
"HeavyWeapon.exe"+1B706: E8 E5 06 03 00 - call HeavyWeapon.exe+4BDF0
"HeavyWeapon.exe"+1B70B: 8B 86 80 00 00 00 - mov eax,[esi+00000080]
"HeavyWeapon.exe"+1B711: 3B C3 - cmp eax,ebx
"HeavyWeapon.exe"+1B713: 0F 8E 56 01 00 00 - jng HeavyWeapon.exe+1B86F
"HeavyWeapon.exe"+1B719: 3D 2C 01 00 00 - cmp eax,0000012C
"HeavyWeapon.exe"+1B71E: 0F 85 A4 00 00 00 - jne HeavyWeapon.exe+1B7C8
"HeavyWeapon.exe"+1B724: 38 9E 26 03 00 00 - cmp [esi+00000326],bl
"HeavyWeapon.exe"+1B72A: 0F 84 98 00 00 00 - je HeavyWeapon.exe+1B7C8
"HeavyWeapon.exe"+1B730: 8B 4E 5C - mov ecx,[esi+5C]
"HeavyWeapon.exe"+1B733: 53 - push ebx
// ---------- INJECTING HERE ----------
"HeavyWeapon.exe"+1B734: 8B 81 64 09 00 00 - mov eax,[ecx+00000964]
// ---------- DONE INJECTING ----------
"HeavyWeapon.exe"+1B73A: 3B C3 - cmp eax,ebx
"HeavyWeapon.exe"+1B73C: 8B 01 - mov eax,[ecx]
"HeavyWeapon.exe"+1B73E: 7E 34 - jle HeavyWeapon.exe+1B774
"HeavyWeapon.exe"+1B740: 6A 39 - push 39
"HeavyWeapon.exe"+1B742: FF 90 B8 00 00 00 - call dword ptr [eax+000000B8]
"HeavyWeapon.exe"+1B748: 6A 78 - push 78
"HeavyWeapon.exe"+1B74A: E8 41 02 0D 00 - call HeavyWeapon.exe+EB990
"HeavyWeapon.exe"+1B74F: 8B F8 - mov edi,eax
"HeavyWeapon.exe"+1B751: 83 C4 04 - add esp,04
"HeavyWeapon.exe"+1B754: 89 7D F0 - mov [ebp-10],edi
} |
[..+95c]
| Code: | HeavyWeapon.exe+1724B - A1 5C9F5600 - mov eax,[HeavyWeapon.exe+169F5C]
HeavyWeapon.exe+17250 - 53 - push ebx
HeavyWeapon.exe+17251 - 33 45 04 - xor eax,[ebp+04]
HeavyWeapon.exe+17254 - 33 DB - xor ebx,ebx
HeavyWeapon.exe+17256 - 56 - push esi
HeavyWeapon.exe+17257 - 57 - push edi
HeavyWeapon.exe+17258 - 89 5D EC - mov [ebp-14],ebx
HeavyWeapon.exe+1725B - 8B 7D 08 - mov edi,[ebp+08]
HeavyWeapon.exe+1725E - 3B FB - cmp edi,ebx
HeavyWeapon.exe+17260 - 89 45 F0 - mov [ebp-10],eax
HeavyWeapon.exe+17263 - 8B F1 - mov esi,ecx
HeavyWeapon.exe+17265 - 0F84 FE000000 - je HeavyWeapon.exe+17369
HeavyWeapon.exe+1726B - 8A 86 27030000 - mov al,[esi+00000327]
HeavyWeapon.exe+17271 - 84 C0 - test al,al
HeavyWeapon.exe+17273 - 0F85 F0000000 - jne HeavyWeapon.exe+17369
HeavyWeapon.exe+17279 - 8B 46 5C - mov eax,[esi+5C]
HeavyWeapon.exe+1727C - 8B 90 5C090000 - mov edx,[eax+0000095C]
HeavyWeapon.exe+17282 - 03 D7 - add edx,edi
HeavyWeapon.exe+17284 - 89 90 5C090000 - mov [eax+0000095C],edx
HeavyWeapon.exe+1728A - 8B 46 5C - mov eax,[esi+5C]
HeavyWeapon.exe+1728D - 39 98 5C090000 - cmp [eax+0000095C],ebx
HeavyWeapon.exe+17293 - 7D 06 - jnl HeavyWeapon.exe+1729B
HeavyWeapon.exe+17295 - 89 98 5C090000 - mov [eax+0000095C],ebx
HeavyWeapon.exe+1729B - 57 - push edi
HeavyWeapon.exe+1729C - 8D 45 B8 - lea eax,[ebp-48]
HeavyWeapon.exe+1729F - 68 CCC75200 - push HeavyWeapon.exe+12C7CC
HeavyWeapon.exe+172A4 - 50 - push eax
HeavyWeapon.exe+172A5 - E8 B5460E00 - call HeavyWeapon.exe+FB95F
|
_________________
- Retarded. |
|
| Back to top |
|
|
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
| Posted: Sun Sep 27, 2015 1:10 pm Post subject: |
|
|
vng21092 its Not working
Perhaps the error message will help find the problem:
Exception: Access Violation (code 0xc0000005) at address 05210000 in thread 1A08
Module: Exception: Access Violation (code 0xc0000005) at address 05210000 in thread 1A08
Logical Address: 130E32C:00000000
0012FCA8 05210000 0000:00000000
Params: 0056B1A0 0044BED5 0056B1A0 004AF708
StackWalk failed (error 299)
EAX:0000012C EBX:00000000 ECX:0056B1A0 EDX:775771B4 ESI:0519BF20 EDI:00000026
EIP:05210000 ESP:0012FC84 EBP:0012FCA8
CS:001B SS:0023 DS:0023 ES:0023 FS:003B GS:0000
Flags:00010202
Windows Ver: NT 6.1 Service Pack 1 Build 7601
DDraw Ver: 6.1.7600.16385
DSound Ver: 6.1.7600.16385
Product: HeavyWeapon
Version: 1.0
Time Loaded: 00:00:31
Fullscreen: No
Primary ThreadId: 1A08
Times Played: 276
|
|
| Back to top |
|
|
panraven
Grandmaster Cheater
![]() Reputation: 62
Joined: 01 Oct 2008
Posts: 958
|
| Posted: Sun Sep 27, 2015 1:19 pm Post subject: |
|
|
change
| Code: | | cmp [eax+0000095C],#50000 |
to
| Code: | | cmp dword ptr [ecx+0000095C],#50000 |
? (eax is changed to ecx)
_________________
- Retarded. |
|
| Back to top |
|
|
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
| Posted: Sun Sep 27, 2015 1:30 pm Post subject: |
|
|
omg IT WORKED .
i don't know how but it worked.
If you can explain to me why it works that way, I'd love to know
|
|
| Back to top |
|
|
panraven
Grandmaster Cheater
![]() Reputation: 62
Joined: 01 Oct 2008
Posts: 958
|
| Posted: Sun Sep 27, 2015 2:06 pm Post subject: |
|
|
I guess you think EAX is some CONSTANT that not change across different code part, and expect that the expression [eax+95c] your used in this code part (part A) is the same as what you encounter in some other code part (part B), but they are not the same.
Probably in part B, eax is used as some base of a struct, which is the same as ecx in part A (the part you modify here). So, you 'copy' that expression into part A. But eax in part A now is a total different thing, so the crash.
_________________
- Retarded. |
|
| Back to top |
|
|
STN
I post too much
Reputation: 43
Joined: 09 Nov 2005
Posts: 2676
|
| Posted: Sun Sep 27, 2015 2:16 pm Post subject: |
|
|
Because this
| STN wrote: |
The reason it probably is crashing is because eax maybe supposed to get an address from [ecx+00000964] and used further down but when you skip it, eax contains invalid address making it invalid pointer.
|
EDIT: nvm panraven beat me to it
_________________
|
|
| Back to top |
|
|
danpuz
Newbie cheater
![]() Reputation: 0
Joined: 29 Mar 2015
Posts: 18
|
| Posted: Sun Sep 27, 2015 2:21 pm Post subject: |
|
|
| so how did you know that dword ptr is the right register?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
