| View previous topic :: View next topic |
| Author |
Message |
dharmang1910
Expert Cheater
![]() Reputation: 0
Joined: 09 May 2010
Posts: 102
|
 Posted: Mon Jun 03, 2019 10:11 am Post subject: help related to unity mono |
 |
|
I have faced this problem in 3-4 unity games that when I see what writes to or what access to this address, it shows opcode for that. But address of this opcode is like "System.Collections.Generic:List`1:set_Item+5b" which contain non standard characters like "List`1" so cheat engine can not recognize it and shows this error.
And this class is found in "mscorlib" namespace instead of Assembly-CSharp Namespace. Also Aobscan can not find unique pattern for this address because of many duplicate classes. So in last it is like impossible to cheat in such games. This anti cheat technique is becoming popular in many recent unity titles. Some of them are "Rise of Industry" and "Shaq Fu A Legend Reborn".
Anybody can give some ideas to cheat in such situation or i request Darkbyte to add support for such non standard characters in AA script.
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 475
Joined: 09 May 2003
Posts: 25993
Location: The netherlands
|
| Posted: Mon Jun 03, 2019 11:09 am Post subject: |
|
|
trace back and see what the function is that uses it.
This is just a generic list, find something that accesses the thing the list refers and hook that
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
dharmang1910
Expert Cheater
![]() Reputation: 0
Joined: 09 May 2010
Posts: 102
|
| Posted: Mon Jun 03, 2019 11:40 am Post subject: |
|
|
| Dark Byte wrote: | trace back and see what the function is that uses it.
This is just a generic list, find something that accesses the thing the list refers and hook that |
Thanks Dark Byte for your reply.
I already backtrace for 3 levels and they all are such generic names atleast for 2 levels. First such generic class address is moved to r11 and then call r11 opcodes run in all the back 3 calls. Mostly all values are comes from rbp or rsp and then this values are moved to found adresses.
Can you check this game "rise of industry" . Free demo version of this game available on steam.Very small download of about 300 or 400 mb in size. In this game money is in double value and 15M means 15000000 in double.
Update 1:
I have backtrace to 3 back call and that 3rd call is for generic "SetElement" call which i have noped out. So this trick works in special attacks and in energy like items in "Shaq Fu" game but not in health system because this call is common in Player and Enemies. so nop this call is not possible. Can you suggest any idea in this situation.??
|
|
| Back to top |
|
|
dharmang1910
Expert Cheater
![]() Reputation: 0
Joined: 09 May 2010
Posts: 102
|
| Posted: Sat Jun 08, 2019 2:14 am Post subject: |
|
|
| Dark Byte wrote: | trace back and see what the function is that uses it.
This is just a generic list, find something that accesses the thing the list refers and hook that |
Can you please update mono plugin of cheat engine compatible with windows 10??
Me and other many table makers on fearless revolution site face same crashing issue with mono in windows 10.
I have tried cosmos software of cheathappens for testing whether game have issue of crashing or mono plugin have any issue with windows 10 or else and i found that game is not crashing in cosmos with veh debugger. So i have rule out that there is some issue with mono plugin in cheat engine.
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 475
Joined: 09 May 2003
Posts: 25993
Location: The netherlands
|
| Posted: Sat Jun 08, 2019 5:00 am Post subject: |
|
|
Describe what you do when it crashes
expand a specific node ?
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
dharmang1910
Expert Cheater
![]() Reputation: 0
Joined: 09 May 2010
Posts: 102
|
| Posted: Sat Jun 08, 2019 7:08 am Post subject: |
|
|
| Dark Byte wrote: | Describe what you do when it crashes
expand a specific node ? |
Mostly game crashes during when we activate mono during or when we expand tree of dissect mono. Sometimes it crashes when we activate mono script. And this is unrelated to mono but sometimes it crashes when we attach debugger by what writes, access or addresses access. Crashes only happens in unity games only not in other games. It is very frequent and spoils all of your backtracing and other scanning stuff. Here is the log of crash of two games, other game's log i have deleted. I have removed stack portion of log to reduce the length.
#1:
Fort Triumph [version: Unity 2017.3.0f3 (a9f86dcd79df)]
mono-2.0-bdwgc.dll caused an Access Violation (0xc0000005)
in module mono-2.0-bdwgc.dll at 0033:fd42c536.
Error occurred at 2019-06-08_174642.
Z:\games 7\Fort.Triumph.v0.7.4.5\Fort Triumph.exe, run by DHARMANG1910.
70% memory in use.
8062 MB physical memory [2419 MB free].
16124 MB paging file [8415 MB free].
134217728 MB user address space [134210756 MB free].
Read from location ffffffff caused an access violation.
Context:
RDI: 0xc26bfdba RSI: 0x00000000 RAX: 0x00000001
RBX: 0xffffffff RCX: 0xc26bfdba RDX: 0x9ff41ec0
RIP: 0xfd42c536 RBP: 0x00000000 SegCs: 0x00000033
EFlags: 0x00010202 RSP: 0x28bffa90 SegSs: 0x0000002b
R8: 0xffffffff R9: 0x00000000 R10: 0x00000000
R11: 0x00000246 R12: 0x00000000 R13: 0x00000000
R14: 0x00000000 R15: 0x00000000
Bytes at CS:EIP:
f6 47 20 01 0f 85 f6 05 00 00 f7 47 28 00 00 80
Module 1
C:\WINDOWS\SYSTEM32\xinput1_3.dll
Image Base: 0x00400000 Image Size: 0x0001e000
File Size: 107368 File Time: 2007-04-04_185422
Version:
Company: Microsoft Corporation
Product: Microsoft® DirectX for Windows®
FileDesc: Microsoft Common Controller API
FileVer: 9.18.944.0
ProdVer: 9.18.944.0
== [end of error.log] ==
#2:
Unity Player [version: Unity 5.4.3p1_00292ff31167]
mono.dll caused an Access Violation (0xc0000005)
in module mono.dll at 0033:dc421a80.
Error occurred at 2019-06-03_185834.
C:\Games\Shaq Fu A Legend Reborn Barack Fu\ShaqFu.exe, run by DHARMANG.
54% memory in use.
8062 MB physical memory [3697 MB free].
16766 MB paging file [9155 MB free].
134217728 MB user address space [134211359 MB free].
Read from location ffffffff caused an access violation.
Context:
RDI: 0x115cddc0 RSI: 0x36a909b0 RAX: 0x00000001
RBX: 0x114aa220 RCX: 0x00000000 RDX: 0x36a909b0
RIP: 0xdc421a80 RBP: 0x6cb0ba90 SegCs: 0x00000033
EFlags: 0x00010206 RSP: 0x0071e200 SegSs: 0x0000002b
R8: 0x6cb0bab0 R9: 0x00000001 R10: 0x00000001
R11: 0x0071e1d8 R12: 0x6cb09000 R13: 0x36a909b0
R14: 0x00000003 R15: 0x00000060
Bytes at CS:EIP:
48 8b 01 48 8b da 48 8b f9 a8 01 75 71 48 83 e0
Module 1
C:\Windows\System32\msvcrt.dll
Image Base: 0x00b70000 Image Size: 0x0009e000
File Size: 638376 File Time: 2019-05-04_104604
Version:
Company: Microsoft Corporation
Product: Microsoft® Windows® Operating System
FileDesc: Windows NT CRT DLL
FileVer: 7.0.17763.475
ProdVer: 10.0.17763.475
Module 2
C:\Windows\SYSTEM32\xinput1_3.dll
Image Base: 0x00400000 Image Size: 0x0001e000
File Size: 107368 File Time: 2007-04-04_185422
Version:
Company: Microsoft Corporation
Product: Microsoft® DirectX for Windows®
FileDesc: Microsoft Common Controller API
FileVer: 9.18.944.0
ProdVer: 9.18.944.0
Module 3
C:\Games\Shaq Fu A Legend Reborn Barack Fu\steam_api64.dll
Image Base: 0x6c450000 Image Size: 0x0003e000
File Size: 235600 File Time: 2018-06-30_170620
Version:
Company: Valve Corporation
Product: Steam Client API
FileDesc: Steam Client API
FileVer: 3.42.61.66
ProdVer: 1.0.0.1
== [end of error.log] ==
Last edited by dharmang1910 on Sat Jun 08, 2019 10:23 am; edited 2 times in total |
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 475
Joined: 09 May 2003
Posts: 25993
Location: The netherlands
|
| Posted: Sat Jun 08, 2019 9:44 am Post subject: |
|
|
No idea about error 2, but try running this code every time you use mono:
| Code: |
mono-2.0-bdwgc.mono_error_ok:
mov eax,1
ret
|
e.g add it in the monoscript at the start of LaunchMonoDataCollector()
| Code: |
autoAssemble([[
mono-2.0-bdwgc.mono_error_ok:
mov eax,1
ret
]])
|
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping
Last edited by Dark Byte on Sat Jun 22, 2019 1:29 am; edited 1 time in total |
|
| Back to top |
|
|
dharmang1910
Expert Cheater
![]() Reputation: 0
Joined: 09 May 2010
Posts: 102
|
| Posted: Sat Jun 08, 2019 10:20 am Post subject: |
|
|
| Dark Byte wrote: | No idea about error 2, but try running this code every time you use mono:
| Code: |
mono-2.0-bdwgc.mono_error_ok:
mov eax,1
ret
|
e.g add it in the monoscript at the start of LaunchMonoDataCollector()
| Code: |
autoassemble([[
mono-2.0-bdwgc.mono_error_ok:
mov eax,1
ret
]])
|
|
Thank you sir for help, I'll definitely try it and in 2nd log accidently removed first part from copy, here is the first part of error log, i also updated previous post.
mono.dll caused an Access Violation (0xc0000005)
in module mono.dll at 0033:dc421a80.
|
|
| Back to top |
|
|
dharmang1910
Expert Cheater
![]() Reputation: 0
Joined: 09 May 2010
Posts: 102
|
| Posted: Sun Jun 23, 2019 7:05 am Post subject: |
|
|
| Dark Byte wrote: | No idea about error 2, but try running this code every time you use mono:
| Code: |
mono-2.0-bdwgc.mono_error_ok:
mov eax,1
ret
|
|
Hello DarkByte,
This works very good. Can you explain or send me some reference link regarding this?
I really want to know that what really "mono-2.0-bdwgc.mono_error_ok" is and what is role of it in game crashing. Please reply me.
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 475
Joined: 09 May 2003
Posts: 25993
Location: The netherlands
|
| Posted: Sun Jun 23, 2019 8:35 am Post subject: |
|
|
when ce does a mono_class_get command mono calls mono_class_get_checked (not-exported) and then does an assert on the result if it returned an error, and if the error is ok or not
If not, then the assert will do a _fastfail intrinsic (software int) which causes an instant crash/terminate of the process (looks like it's compiled with assertions enabled)
https://github.com/mono/mono/blob/a5a26a2f92d00ab174d794f077007faaab5d3843/mono/metadata/class.c#L2814
it can fail if the class is defined in the typedef list, but not present in the package
you can of course do mono_class_from_typeref_checked which is exported, but not sure if you're able to get all classes then (only typerefs, no typedefs)
And by 'fixing' mono_error_ok to always return 1 most other asserts will also pass (which might make the whole game itself even more stable...)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
