 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
mouser
Advanced Cheater
![]() Reputation: 0
Joined: 08 Mar 2015
Posts: 50
|
 Posted: Sun Oct 09, 2016 5:31 am Post subject: Need to change 3 out of 5 adresses -same instruction for all |
 |
|
I want to make a hud toggle.
What I have figured out is the that when I go into the main menu, the hud gets turned off.
I found one instruction, breakpoint on access and 5 addresses pop up, it writes only to one address and the other 4 are checking the value, used changed/unchanged to find it.
The adresses:
One turns the menu overlay on/off using the values 31 and 1.
Another I'm not sure what it does exactly, uses 1 and 0.
The rest (3) of em change from 1 to 0 when going in and out of the menu and when I freeze the value inside the games menu (all three of em 0) and go back out into regular gameplay again then the hud will not be activated. With those 3 adresses frozen I can play without hud and go in and out the menu normally, hud stays off as long as those 3 values are frozen.
Problem is that I can't think of a way to use said instruction in such a way that only the 3 addresses are directly changed, writing zero into them and leaving the other 2 addresses alone:
| Code: | | "conviction_game.exe"+4701F4: 89 41 30 - mov [ecx+30],eax |
Complete snapshot of code area:
| Code: | "conviction_game.exe"+4701E6: C2 04 00 - ret 0004
"conviction_game.exe"+4701E9: 8B 44 24 04 - mov eax,[esp+04]
"conviction_game.exe"+4701ED: 39 41 30 - cmp [ecx+30],eax
"conviction_game.exe"+4701F0: 74 0C - je conviction_game.exe+4701FE
"conviction_game.exe"+4701F2: 85 C0 - test eax,eax
// ---------- INJECTING HERE ----------
"conviction_game.exe"+4701F4: 89 41 30 - mov [ecx+30],eax
"conviction_game.exe"+4701F7: 75 05 - jne conviction_game.exe+4701FE
// ---------- DONE INJECTING ----------
"conviction_game.exe"+4701F9: 8B 01 - mov eax,[ecx]
"conviction_game.exe"+4701FB: FF 50 10 - call dword ptr [eax+10]
"conviction_game.exe"+4701FE: C2 04 00 - ret 0004
"conviction_game.exe"+470201: 56 - push esi
"conviction_game.exe"+470202: 6A 06 - push 06 |
Someone can give me a hint where to go from here?
Pointerscanning for those adresses was not successful. Everytime I try and inject at that instruction the game crashes on me.
|
|
| Back to top |
|
 |
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Sun Oct 09, 2016 10:56 am Post subject: |
|
|
| Complete the last step of the CE tutorial that covers data structure dissection. You'll need to filter out the unwanted addresses.
|
|
| Back to top |
|
|
mouser
Advanced Cheater
![]() Reputation: 0
Joined: 08 Mar 2015
Posts: 50
|
| Posted: Mon Oct 17, 2016 1:01 am Post subject: |
|
|
Hi Methos, sorry for the late reply.
I was / am trying to go about this the way health player/enemy comparisons are done.
Finding the offsets of the 5 addresses in ecx by highlighting them all in the little debugger window (Find out what addresses this instruction accesses), highlighting all addresses, right click, dissecting datastructures. Then I put 2 of them in another group so I can find a group difference between the 3 I want to change and leave the other 2 alone. Then create comparisons in a script.
This would be one of the ways to filter them out, right?
I first have to solve a problem before this though and that is that I can't create a jump (code injection, AOB etc) inside the instruction
| Code: | | "conviction_game.exe"+4701F4: 89 41 30 - mov [ecx+30],eax |
or around it without having the game crashing down on me. Any idea why that might happen? There are comparisons above this instruction and I thought about that I maybe messing up the stack somehow but the game crashes even when I don't change the original code inside the script?
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Mon Oct 17, 2016 1:22 am Post subject: |
|
|
| mouser wrote: | | This would be one of the ways to filter them out, right? |
-Yes. Other methods may include:
| ++METHOS wrote: | - You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
- You can use pointer trees inside of the data structure to find something viable.
- You can shift the data structure (+ or -) and/or expand its size to find something useful.
- You can use the structure spider to find workable strings and/or for comparative analysis.
- You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
- You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
- Et al.
|
| mouser wrote: | | I can't create a jump (code injection, AOB etc) inside the instruction... ...or around it without having the game crashing down on me. Any idea why that might happen? |
-Hard to say without analyzing the target myself. Could be memory integrity check. Could be a broken jump or script error or something else. Try injecting without changing anything at all to see if it crashes. You can also try injecting just above that instruction, for example, here:
| Code: | | "conviction_game.exe"+4701F2: 85 C0 - test eax,eax |
...assuming you haven't already done so.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
