Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


problem with assembler

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Tutorials -> Auto Assembler tutorials
View previous topic :: View next topic  
Author Message
reverser69
Cheater
Reputation: 0

Joined: 03 Sep 2014
Posts: 49

PostPosted: Mon Dec 25, 2017 4:03 pm    Post subject: problem with assembler Reply with quote

hi
I wanna assemble this:
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"ACU.exe"+55D873F)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

cmp rdx,1455D7223
je patch1

cmp rdx,1455F1E0C
je patch2

cmp rdx,1455D87CA
je patch3
jmp originalcode

patch1:
mov eax,D11ABCAB
jmp originalcode

patch2:
mov eax,6795B2CE
jmp originalcode

patch3:
mov eax,074A8DA2A


originalcode:
mov [rbp+00],eax
jmp ACU.exe+55D5D0A

exit:
jmp returnhere

"ACU.exe"+55D873F:
jmp newmem
nop
nop
nop
returnhere:




[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"ACU.exe"+55D873F:
mov [rbp+00],eax
jmp ACU.exe+55D5D0A
//Alt: db 89 45 00 E9 C3 D5 FF FF


but what is assembled is this:
cmp rdx,455D7223 { [0] }
je 147850035
nop
nop
nop
nop
cmp rdx,455F1E0C { [00000000] }
je 147850048
nop
nop
nop
nop
cmp rdx,455D87CA { [0] }
je 14785005B
nop
nop
nop
nop
jmp 147850060
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax,D11ABCAB { -786776917 }
jmp 147850060
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax,6795B2CE { ["WKjtpe??qޞ??tx?????????h3????Cpت????i葅?c?,?m?I"] }
jmp 147850060
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax,74A8DA2A { [0] }
mov [rbp+00],eax
jmp ACU.exe+55D5D0A
jmp ACU.exe+55D8747


why?????
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 11

Joined: 01 Feb 2016
Posts: 1027

PostPosted: Mon Dec 25, 2017 4:09 pm    Post subject: Reply with quote

explain what are you trying to do.

you are comparing rdx with hex value, is it a floating point value? or an address?

if its an address is it dynamic? or static?

if its static then put the module address, same thing for patch x labels.

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
patched cheat engine tutorials
Back to top
View user's profile Send private message Visit poster's website
reverser69
Cheater
Reputation: 0

Joined: 03 Sep 2014
Posts: 49

PostPosted: Mon Dec 25, 2017 4:17 pm    Post subject: Reply with quote

patchx are instant values

and rdx are static addres
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 11

Joined: 01 Feb 2016
Posts: 1027

PostPosted: Mon Dec 25, 2017 4:39 pm    Post subject: Reply with quote

static addresses 0{000}0000 the bytes inside the curly brackets can change.
so make sure you put the module address instead.

in your case ACU.exe+xxxxx

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
patched cheat engine tutorials
Back to top
View user's profile Send private message Visit poster's website
reverser69
Cheater
Reputation: 0

Joined: 03 Sep 2014
Posts: 49

PostPosted: Mon Dec 25, 2017 4:45 pm    Post subject: Reply with quote

i just want them to get treated as values not addresses.ce assembles them as address.

cmp rdx,140007ECA
becomes:
cmp rdx,40007ECA

i put moddle addres but same problem 140007ECA become 40007ECA
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 11

Joined: 01 Feb 2016
Posts: 1027

PostPosted: Mon Dec 25, 2017 5:48 pm    Post subject: Reply with quote

put them in square brackets [ ... ]
so you can compare the value of that address with rdx

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
patched cheat engine tutorials
Back to top
View user's profile Send private message Visit poster's website
reverser69
Cheater
Reputation: 0

Joined: 03 Sep 2014
Posts: 49

PostPosted: Tue Dec 26, 2017 3:22 am    Post subject: Reply with quote

I think I'm not explaining good enough
cmp rdx,140007ECA:
140007ECA is an immediate value like 6. but ce assemble it as an address.
my problem also is that 140007ECA is assembled 40007ECA. I don't know if it's a x64-x86 issue or not.
or I don't understand you
can you please correct this script for me?
cmp rdx,140007ECA //constant
je patch1
cmp rdx,1455F1E0C //constant
je patch2
cmp rdx,1455D87CA //constant
je patch3
jmp originalcode

patch1:
mov eax,D54F1D3C //constant
jmp originalcode
patch2:
mov eax,6795B2CE //constant
jmp originalcode
patch3:
mov eax,74A8DA2A //constant

originalcode:
mov [rbp+00],eax
jmp ACU.exe+2890347
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 28

Joined: 01 Oct 2008
Posts: 694

PostPosted: Tue Dec 26, 2017 6:13 am    Post subject: Reply with quote

In x86-64 instructions, 'mov' should be the only instruction having a 64-bit (8 bytes) imm values, so CE truncate the higher 4 bytes in the 'cmp' instruction. Note the 'jmp' instruction encode a 64-bit values (jump target address) as 32-bit offset from that 'jmp' instruction.

Here a sample code to move the 64-bit imm values to a data area (jmpTable) and use memory addressing with relative offset to access them.
Code:

push   rax
  mov  rax,[jmpTable+30] //// default jump

  cmp    rdx,[jmpTable]
  jne    short @f   //// add 'short' to avoid extra 'nop'
                    ///  but it must be 'short', target
                    ///  within +/- 7f offset
    mov  rax,[jmpTable+8]  ///  case 1
  @@:
  cmp    rdx,[jmpTable+10]
  jne    short @f
 
    mov  rax,[jmpTable+18] ///  case 2
  @@:
  cmp    rdx,[jmpTable+20]
  jne    short @f
 
    mov  rax,[jmpTable+28] ///  case 3
  @@:
 
xchg   rax,[rsp] /// restore rax, by EXCHANGE where to 'jmp' in next 'ret' instruction
ret    /// equal to jmp with the address in top of stack, also pop the stack

jmpTable:
dq 140007ECA, patch1 //// case 1 test, jmp
dq 1455F1E0C, patch2 //// case 2 test, jmp
dq 1455D87CA, patch3 //// case 3 test, jmp
dq originalcode /// default jmp


if rax (or some other free register) don't need to save, may use this
Code:

//// no need push rax
....
//// simply replace last 2 instruction with this jmp
  jmp  rax



ADDED:
So with your last post, probably the 'jumps' is not need, the eax can be directly set, like:
Code:

////  mov  eax,[jmpTable+30] //// not needed, keep eax value if following 3 test not matched, or use default value below

  cmp    rdx,[jmpTable]
  jne    short @f   //// add 'short' to avoid extra 'nop'
                    ///  but it must be 'short', target
                    ///  within +/- 7f offset
    mov  eax,[jmpTable+8]  ///  case 1
  @@:
  cmp    rdx,[jmpTable+10]
  jne    short @f

    mov  eax,[jmpTable+18] ///  case 2
  @@:
  cmp    rdx,[jmpTable+20]
  jne    short @f

    mov  eax,[jmpTable+28] ///  case 3
  @@:
  jmp   originalcode

jmpTable: //// more like a switch case table
dq 140007ECA, D54F1D3C //// case 1 test, jmp
dq 1455F1E0C, 6795B2CE //// case 2 test, jmp
dq 1455D87CA, 74A8DA2A //// case 3 test, jmp
///       dq originalcode /// not need.... or this ? 74A8DA2A, a default value


_________________
- Retarded.
Back to top
View user's profile Send private message
reverser69
Cheater
Reputation: 0

Joined: 03 Sep 2014
Posts: 49

PostPosted: Wed Dec 27, 2017 6:18 am    Post subject: Reply with quote

great.thanks.I already solved the issue in some newb way but this code is handier.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Tutorials -> Auto Assembler tutorials All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites