 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Nakor
Newbie cheater
![]() Reputation: 0
Joined: 23 Dec 2009
Posts: 22
|
 Posted: Wed Oct 14, 2015 7:29 am Post subject: Question: AOB in C# (educated failure) |
 |
|
I feel like an idiot asking this. I have googled the crap out of this for about a week now every time I get a chance to work on this and I keep coming up empty. This question has been asked at least 30 times that I have found (here and other places) and yet nowhere have I seen it both resolved and fully explained (if it was resolved).
I am having trouble figuring out the base address I believe, although it is possible I am simply misusing pointers altogether. It has been well over a decade since I have even touched code involving pointers. I have cleaned up my horrible spaghetti code that I made while trying to figure this out and hopefully it has everything you will need to see:
| Code: | private void tmpButton_Click(object sender, EventArgs e)
{
ProcUtils pUtils = new ProcUtils(myProcess[0], WinAPI.ProcessAccessFlags.VirtualMemoryRead | WinAPI.ProcessAccessFlags.VirtualMemoryWrite | WinAPI.ProcessAccessFlags.VirtualMemoryOperation);
MemUtils mUtils = new MemUtils();
mUtils.Handle = pUtils.Handle;
IntPtr myBaseAddress = pUtils.Process.MainModule.BaseAddress;
Console.WriteLine("MainModule.BaseAddress: " + myBaseAddress.ToString("X"));
byte[] anotherSig = new byte[]
{
0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x2C, 0x01, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
string autoMask = mUtils.MaskFromPattern(anotherSig, 0xFF);
ScanResult result = mUtils.PerformSignatureScan(anotherSig, autoMask, (IntPtr)0x1A1A4000, 0xD7000);
//ScanResult result = mUtils.PerformSignatureScan(anotherSig, autoMask, myBaseAddress, pUtils.Process.MainModule.ModuleMemorySize);
Console.WriteLine("Success? " + result.Success);
Console.WriteLine("Result base: " + result.Base.ToString("X"));
Console.WriteLine("Result address: " + result.Address.ToString("X"));
Console.WriteLine("Result offset: " + result.Offset.ToString("X"));
byte[] resultData;
mUtils.Read(result.Address, out resultData, 4);
Console.WriteLine("Result data: " + BitConverter.ToInt32(resultData, 0));
} |
You'll notice there are two ScanResult lines. One of them is commented out, and the other is not. The one in use in the code (not commented out) doesn't crash the program but it also doesn't seem to work properly. The pointer address it uses is the address I pull out of the memory view in CE (Base=xxxxxx). The module size was obtained the same way. The code that is commented out consistently crashes the program, but is the way I would expect it to work.
The output of this is:
| Quote: | MainModule.BaseAddress: 1390000
Success? True
Result base: 1A1A4000
Result address: 1A1A4984
Result offset: 984
Result data: 740 |
Ultimately my question is what am I doing wrong here, and could you please provide a clear example of how it should be done? An example of how to correctly read the address would be great. From that I can figure out how to write to the address.
I have written to a multilevel pointer before but that was using data from a pointer scan (in CE) and it worked perfectly. Unfortunately my goal here is to avoid the pointer scan altogether so all that experience gives me is the knowledge that I am not a complete moron.
I am extremely tired right now. I am sitting in an airport and have been sitting here for about 10 hours now, awake for around 18 hours now with another 10 or so to go lol. If I have missed anything please let me know.
Edit:
The following AOB script works in CE:
| Code: | [ENABLE]
aobscan(fuel, ?? ?? 00 00 00 00 00 00 0E 00 00 00 04 00 00 00 00 00 00 00 2C 01 00 00 ?? 00 00 00 00 00 00 00)
label(_fuel)
registersymbol(_fuel)
fuel:
_fuel:
[DISABLE]
unregistersymbol(_nodamage) |
Edit 2:
I was accidentally converting my final read to hex. I have fixed this. 740 was the correct value that I was looking for (on that run anyway). The problem of the BaseAddress still remains however. Attempting to use the base at all causes a great deal of grief.
_________________
---
Too bad my life doesn't have a hex address for suck... |
|
| Back to top |
|
 |
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Fri Oct 16, 2015 4:32 pm Post subject: Re: Question: AOB in C# (educated failure) |
|
|
| Nakor wrote: | | The code that is commented out consistently crashes the program, but is the way I would expect it to work. |
A-At what line does your program crash when you use the commented PerformSignatureScan?
B-Open up the memory viewer in CE, and go to view->memory regions (ctrl+R) then scroll down until you see the path to the target's exe in the extra column. Normally the first should have 1390000 in the address column, or whatever is the equivalent on that run. Immediately under this, you will have other memory regions mapped to the exe (one of them being (the equivalent of) 1A1A4000 of size D7000), does one or several of them have protect=no access?
If yes: you're trying to read memory that is not readable.
If not: hardcode in your scanner the base and size of each one and see which cases the crash, then report its properties.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
