 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Kronogenics
Advanced Cheater
 Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
 Posted: Thu Dec 08, 2016 9:40 pm Post subject: Narrowing down address |
 |
|
| I am having an issue where I have one instruction that is writing to many different places in memory, yet the issue is I need to find the single address I am looking for, considering that there is nothing around the address that I can use as a comparison to make sure I am in the right place, I don't know what I should do.
|
|
| Back to top |
|
 |
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Thu Dec 08, 2016 11:37 pm Post subject: |
|
|
Have you completed the the last step of the CE tutorial the covers data structure dissection?
Some methods for finding a unique identifier for filtering purposes:
| ++METHOS wrote: | - You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
- You can use pointer trees inside of the data structure to find something viable.
- You can shift the data structure (+ or -) and/or expand its size to find something useful.
- You can use the structure spider to find workable strings and/or for comparative analysis.
- You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
- You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
- Et al.
|
|
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 11:42 am Post subject: |
|
|
| I have been looking through the data structure and found something that appears to be non changing, It's a string. I have no idea how to compare one string to another.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Fri Dec 09, 2016 2:28 pm Post subject: |
|
|
Strings are just data; like anything else, they have a hexadecimal representation. If you change the element to 4 byte hex, for example, you can compare against that value, and it's the same thing as comparing against the first 2 letters.
Let's say, for example, your instruction is this:
Inside that data structure, at offset +0, there is a pointer tree. Inside that pointer tree, at offset +8, there is another pointer tree, and inside that pointer tree, at offset +28, there is a string that can be used for your unique identifier, for your filter. Let's say that the string is Bean, you could do something like this:
| Code: | push edi
mov edi,[r15+0]
mov edi,[edi+8]
mov edi,[edi+28]
cmp edi,00650042 //hex representation for the string Be, for Bean.
pop edi
je filter_be |
There are other ways to do this. You can write strings inside of your AA script by doing something like this:
| Code: | cmp [edi+04],'St'
je Stupid
cmp [edi+08],'up'
je Stupid
cmp [edi+0C],'id'
je Stupid
jmp originalcode |
|
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 2:41 pm Post subject: |
|
|
| I will try this and come back with my results.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Fri Dec 09, 2016 2:47 pm Post subject: |
|
|
| Don't mention it.
|
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 4:08 pm Post subject: |
|
|
This is odd to me, even if I cor example:
| Code: |
push ecx
(all my code)
pop ecx
|
the game crashes, even though I am preserving the value of ecx?
Do you know any reason why this may be?
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Fri Dec 09, 2016 4:19 pm Post subject: |
|
|
Because the rest of your code is garbage? Your injection location is garbage?
I suspect showing us the injection template and your code could enlighten us.
|
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 4:25 pm Post subject: |
|
|
| Code: |
{
Version:
Date : 2016-12-08
Author : Kronogenics
This script should give the user infinite ammo
}
[ENABLE]
aobscanmodule(iAmmo,Nuclear Throne.exe,DD 1B 5D 5B 83 C4 04) // should be unique
alloc(newmem,$1000)
label(code)
label(code2)
label(return)
newmem:
code:
push edi
mov edi,[ebx] // here
mov edi,[edi+2F0]
cmp edi,'@y'
pop edi //to here seem totally unneeded like it could just be cmp [ebx+2F0],'@y'
jne code2
fstp qword ptr [ebx]
mov [pStruct],ebx
mov [ebx],(double)100
pop ebp
pop ebx
add esp,04
jmp return
code2:
fstp qword ptr [ebx]
pop ebp
pop ebx
add esp,04
jmp return
iAmmo:
jmp newmem
nop
nop
return:
registersymbol(iAmmo)
[DISABLE]
iAmmo:
db DD 1B 5D 5B 83 C4 04
unregistersymbol(iAmmo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Nuclear Throne.exe"+11989F
"Nuclear Throne.exe"+11988C: 5F - pop edi
"Nuclear Throne.exe"+11988D: 5E - pop esi
"Nuclear Throne.exe"+11988E: 5D - pop ebp
"Nuclear Throne.exe"+11988F: 89 58 08 - mov [eax+08],ebx
"Nuclear Throne.exe"+119892: 5B - pop ebx
"Nuclear Throne.exe"+119893: 83 C4 04 - add esp,04
"Nuclear Throne.exe"+119896: E9 15 3B 13 00 - jmp "Nuclear Throne.exe"+24D3B0
"Nuclear Throne.exe"+11989B: DD 00 - fld qword ptr [eax]
"Nuclear Throne.exe"+11989D: 5F - pop edi
"Nuclear Throne.exe"+11989E: 5E - pop esi
// ---------- INJECTING HERE ----------
"Nuclear Throne.exe"+11989F: DD 1B - fstp qword ptr [ebx]
"Nuclear Throne.exe"+1198A1: 5D - pop ebp
"Nuclear Throne.exe"+1198A2: 5B - pop ebx
"Nuclear Throne.exe"+1198A3: 83 C4 04 - add esp,04
// ---------- DONE INJECTING ----------
"Nuclear Throne.exe"+1198A6: E9 05 3B 13 00 - jmp "Nuclear Throne.exe"+24D3B0
"Nuclear Throne.exe"+1198AB: 8B 08 - mov ecx,[eax]
"Nuclear Throne.exe"+1198AD: 5F - pop edi
"Nuclear Throne.exe"+1198AE: 89 0B - mov [ebx],ecx
"Nuclear Throne.exe"+1198B0: 8B 50 04 - mov edx,[eax+04]
"Nuclear Throne.exe"+1198B3: 5E - pop esi
"Nuclear Throne.exe"+1198B4: 5D - pop ebp
"Nuclear Throne.exe"+1198B5: 89 53 04 - mov [ebx+04],edx
"Nuclear Throne.exe"+1198B8: 5B - pop ebx
"Nuclear Throne.exe"+1198B9: 83 C4 04 - add esp,04
}
|
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Fri Dec 09, 2016 5:43 pm Post subject: |
|
|
| Code: | mov edi,[ebx] // here
mov edi,[edi+2F0] |
This code is saying that the address of EBX contains a value which itself is another address (pointer).
You are then taking the value and using it as the address for your next instruction plus offset 2F0.
If EBX already contains the address you are after, then you are right, you can replace it all with: | Code: | | cmp word ptr [ebx+2F0],'@y' |
That is also likely what caused your crashes.
| Code: | | mov [ebx],(double)100 |
This code will not work. It is only copying the first 4 bytes of the double (8-byte) value.
Instead, you can do something like: | Code: | jne code2
fstp qword ptr [ebx]
mov [pStruct],ebx
push qword ptr [myvar]
pop qword ptr [ebx]
pop ebp
pop ebx
add esp,04
jmp return
myvar:
dq (double)100
code2: |
|
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 6:07 pm Post subject: |
|
|
To understand this a bit more I would like you to confirm or correct:
Instead of directly moving [ebx] (my ammo) a double of 100
I should be pushing the double quadword onto the stack then popping it from the stack into [ebx]?
So "mov" will only move 4 bytes instead of the 8 needed?
(I have only worked with doubles one other time I am just trying to get an understanding of do's and do not's. Would you use my table as reference and then past the entire table back in a form that should work? Just so that I can see how you would do this. Because I have it all set up the way you show and no matter what I do it wont let me assign the to cheat table in the line
| Code: | | push qword ptr [newAmmo] |
it's saying push qword ptr [00000000] blah blah blah
I am not doing something right even with your help.
Thank you by the way!
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Fri Dec 09, 2016 7:05 pm Post subject: |
|
|
Correct, PUSH is able to push 8 bytes, but MOV cannot move 8 bytes.
Sounds like you don't have "newAmmo" defined properly.
It requires the label(newAmmo) as well as the actual label "newAmmo:"
| Code: | [ENABLE]
aobscanmodule(iAmmo,Nuclear Throne.exe,DD 1B 5D 5B 83 C4 04)
alloc(newmem,$1000)
label(code)
label(return)
label(newAmmo)
label(pStruct)
newmem:
cmp word ptr [ebx+2F0],'@y'
jne code
mov [pStruct],ebx
push qword ptr [newAmmo]
pop qword ptr [ebx]
code:
fstp qword ptr [ebx]
pop ebp
pop ebx
add esp,04
jmp return
pStruct:
dd 0
newAmmo:
dq (double)100
iAmmo:
jmp newmem
nop
nop
return:
registersymbol(iAmmo)
registersymbol(pStruct)
[DISABLE]
iAmmo:
db DD 1B 5D 5B 83 C4 04
unregistersymbol(iAmmo)
unregistersymbol(pStruct)
dealloc(newmem) |
Last edited by Zanzer on Fri Dec 09, 2016 7:06 pm; edited 1 time in total |
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 7:06 pm Post subject: |
|
|
| Which is what I was doing. I had it set up the same way you have there yet it just threw an error
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Fri Dec 09, 2016 7:07 pm Post subject: |
|
|
Post the exact error you get when you use my code.
I'm pretty sure 32-bit can push/pop 8 bytes. 
Maybe try: | Code: | push [newAmmo]
pop [ebx]
push [newAmmo+4]
pop [ebx+4] |
|
|
| Back to top |
|
|
Kronogenics
Advanced Cheater
Reputation: 0
Joined: 01 Dec 2016
Posts: 82
|
| Posted: Fri Dec 09, 2016 7:12 pm Post subject: |
|
|
"Not all code is injectable.
(Error in line 26 (push qword ptr [00000000]) :This
instruction can't be compiled)
Are you sure you want to edit it to this?
"
What the script looks like:
| Code: |
{
Version:
Date : 2016-12-08
Author : Kronogenics
This script should give the user infinite ammo
}
[ENABLE]
aobscanmodule(iAmmo,Nuclear Throne.exe,DD 1B 5D 5B 83 C4 04) // should be unique
alloc(newmem,$1000)
label(code)
label(code2)
label(return)
label(newAmmo)
newmem:
code:
cmp [ebx+2F0],'@y'
jne code2
fstp qword ptr [ebx]
mov [pStruct],ebx
push qword ptr [newAmmo]
pop qwordptr [ebx]
pop ebp
pop ebx
add esp,04
jmp return
code2:
fstp qword ptr [ebx]
pop ebp
pop ebx
add esp,04
jmp return
newAmmo:
dq (double)100
iAmmo:
jmp newmem
nop
nop
return:
registersymbol(iAmmo)
[DISABLE]
iAmmo:
db DD 1B 5D 5B 83 C4 04
unregistersymbol(iAmmo)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "Nuclear Throne.exe"+11989F
"Nuclear Throne.exe"+11988C: 5F - pop edi
"Nuclear Throne.exe"+11988D: 5E - pop esi
"Nuclear Throne.exe"+11988E: 5D - pop ebp
"Nuclear Throne.exe"+11988F: 89 58 08 - mov [eax+08],ebx
"Nuclear Throne.exe"+119892: 5B - pop ebx
"Nuclear Throne.exe"+119893: 83 C4 04 - add esp,04
"Nuclear Throne.exe"+119896: E9 15 3B 13 00 - jmp "Nuclear Throne.exe"+24D3B0
"Nuclear Throne.exe"+11989B: DD 00 - fld qword ptr [eax]
"Nuclear Throne.exe"+11989D: 5F - pop edi
"Nuclear Throne.exe"+11989E: 5E - pop esi
// ---------- INJECTING HERE ----------
"Nuclear Throne.exe"+11989F: DD 1B - fstp qword ptr [ebx]
"Nuclear Throne.exe"+1198A1: 5D - pop ebp
"Nuclear Throne.exe"+1198A2: 5B - pop ebx
"Nuclear Throne.exe"+1198A3: 83 C4 04 - add esp,04
// ---------- DONE INJECTING ----------
"Nuclear Throne.exe"+1198A6: E9 05 3B 13 00 - jmp "Nuclear Throne.exe"+24D3B0
"Nuclear Throne.exe"+1198AB: 8B 08 - mov ecx,[eax]
"Nuclear Throne.exe"+1198AD: 5F - pop edi
"Nuclear Throne.exe"+1198AE: 89 0B - mov [ebx],ecx
"Nuclear Throne.exe"+1198B0: 8B 50 04 - mov edx,[eax+04]
"Nuclear Throne.exe"+1198B3: 5E - pop esi
"Nuclear Throne.exe"+1198B4: 5D - pop ebp
"Nuclear Throne.exe"+1198B5: 89 53 04 - mov [ebx+04],edx
"Nuclear Throne.exe"+1198B8: 5B - pop ebx
"Nuclear Throne.exe"+1198B9: 83 C4 04 - add esp,04
}
|
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
