Cheat Engine

sbryzl · Posted: Sat Feb 24, 2018 12:18 pm Post subject: PostMessage Key Sim

This game has 32 bit and 64 bit modes and both have references to PostMessageW. I've been using it in 32 bit mode to simulate key presses by using 4 dword parameters and it returns with a simulated key press and altered ecx and edx registers.

My problem is with 64 bit. I don't know whether to push the values as qword or 4 dwords combined into 2 qword or what other steps need to be taken to translate to the request to the function or if it will even work. The result in 64 bit is that it returns from function without removing any of my parameters from the stack and no key simulation.

ParkourPenguin · Posted: Sat Feb 24, 2018 1:04 pm Post subject:

The first 4 parameters are passed through registers, not the stack. Make sure the stack is aligned on a 16-byte boundary and there's some shadow space on the stack for the register parameters.

You can read about 64-bit calling conventions here.

sbryzl · Posted: Sat Feb 24, 2018 1:54 pm Post subject:

ParkourPenguin · Posted: Sat Feb 24, 2018 2:40 pm Post subject:

If you're doing this in a code injection, you should back up all volatile registers (including xmm0 - xmm5), but you can probably get away with not backing most of them up.

If you're not in a code injection (e.g. executing code via createThread), do whatever you want; it's your code.

sbryzl · Posted: Sat Feb 24, 2018 2:44 pm Post subject:

Yep, it's injected, thanks.