Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Need help improving Xenoblade X Cheat Table
Goto page 1, 2, 3, 4, 5, 6, 7, 8  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Mon Oct 28, 2019 5:48 pm    Post subject: Need help improving Xenoblade X Cheat Table Reply with quote

Hi!

I've been trying for days to improve the old Cheat Table made for Xenoblade X by some in the community years ago, both for myself and to be able to give something back to the community for this amazing Cheat Table...

Making progress but slowly learning Cheat Engine and the game. but I cannot for the life of me progress on a few things, and it's been making me go insane for a few days now. If anyone could help me out (Preferably through Discord, because to actually have someone to help me in real time would be a huge lifesaver...), I would be immensely grateful...

The Addresses I find for the game are always changing between sessions. So it doesn't matter if I find anything, by the next session its address will do nothing again... (With enough time passed, even in the same session). And I tried absolutely every single method and variable and tutorial I found out there, with no success whatsoever.

Pointer Scans with or without saved scans, with values, with address, and even figured on my own, through some snooping around and trial and error, how to convert the Addresses I find to be relative to a certain tag that the script to activate the Cheat Table uses to find all values (Every address is "_player+something"), but absolutely NONE of these methods worked... not even the last one, for some ungodly reason...

Please, somebody help me... I really wanted to make this work, but I'm borderline giving up by now...

Thank you everyone, and have a great day...
Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Tue Oct 29, 2019 9:51 am    Post subject: This post has 1 review(s) Reply with quote

A script I do to find addresses is:
1) see what it writes / accesses on that value
2) There should be a register named in square brackets, consequently through a Code Injection I would move the value of that register to a memory region with a symbol
3) I add any offsets by the script
4) I added the memory region to the cheat table and if I needed that address I just need to enable the script

Machine Code:
Code:
{Code...}
Mov [eax], ecx
{Code...}



CE Injection:
Code:
[ENABLE]
alloc(newmem, 128)
registersymbol(Address, 8)

newmem:
Mov [Address], eax
Mov [eax], ecx

return:
jmp {Address from which I made the injection}

[DISABLE]
dealloc(newmem)
unregistersymbol(Address)


from there just add the address "Address" to the Cheat Table and you have its value
Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Tue Oct 29, 2019 10:43 am    Post subject: Reply with quote

Thank you so much for the reply! um... I'm trying to understand what you said, but I get a bit lost in that coding part... ^^" (I'm still quite amateur to it... sorry!)

Could you maybe break it down a little more into a "for dummies" version? Much of what you said is a bit lost on me... on step 2 I'm already lost on what you mean... (I think I might be a bit unfamiliar with some of the terms you use...) ^^"

Also, I've been trying my absolute best to locate the pointer Address for the values I want to change because apparently (after more searching) that can also "fix" them to work between sessions...

But the thing is, Automated Pointer Search is worthless no matter what I try. And after a lot of effort rn, I'm trying to understand and work with all this weird gibberish in the "Extra Info" window that comes from the "Find what Accesses this Adress" command.

I'm using this super helpful Tutorial from Fresco I found on the first reply to this thread (On this same Forum!):

/viewtopic.php?t=552974 (Posting cropped link 'cause I apparently still can't post URLs here... Sad )

But alas... it gets me stuck on the very same part as all else... finding results for the "Guessed" pointer scan...

Here's a screenshot to show ya. Not a single result, green or not... same as automated Pointer Scanner... What do I do?!? Sad



help.png
 Description:
 Filesize:  101.26 KB
 Viewed:  19378 Time(s)

help.png


Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Wed Oct 30, 2019 5:30 pm    Post subject: Reply with quote

Just choose one of those codes (I usually choose the one with the highest refresh rate).
I create a script for you:
Code:
[ENABLE]
aobscanmodule(TakeAddress, {Module Name} ,41 8B 9C 15 84 00 00 00)
alloc(newmem,$1000,{Module Name + Offset})

alloc(Address, 8)
registersymbol(Address)

label(code)
label(return)

newmem:
push 84
pop [Address]
add [Address], r13
add [Address], rdx

code:
  mov ebx,[r13+rdx+00000084]
  jmp return

TakeAddress:
  jmp newmem
  nop 3
return:
registersymbol(TakeAddress)

[DISABLE]

TakeAddress:
  db 41 8B 9C 15 84 00 00 00

unregistersymbol(TakeAddress)
unregistersymbol(Address)
dealloc(newmem)
dealloc(Address)

To add the address you see in the image below the script just click on "Add address manually" and instead of writing a memory address write exactly "Address".
Not knowing the game and not having tried it on that I don't guarantee you it will work but give it a try.



CTable.png
 Description:
 Filesize:  30.65 KB
 Viewed:  19328 Time(s)

CTable.png


Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Thu Oct 31, 2019 5:20 am    Post subject: Reply with quote

Omg thank you so much for your help so far!!! You are the best and I love you! 💙

But I tried your script and it didn't work... It says "Module not found"... did I do something wrong...? :'(

(I can pass you the emulator and game file in a zip if it helps? ^~^")



aaaaaaaa.png
 Description:
 Filesize:  50.9 KB
 Viewed:  19298 Time(s)

aaaaaaaa.png


Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Thu Oct 31, 2019 10:10 am    Post subject: Reply with quote

It doesn't find the module because I don't know what it's called, so you have to replace the comment in braces with the name of the module.
Just open the CE disassembler on the code "mov ebx,[r13 + rdx + 00000084]" open the "Code Injection" template and replace the lines where the module is written and the offset.
I could help but for now you should just replace the module name and the offset
Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Sun Nov 03, 2019 7:48 am    Post subject: Reply with quote

I tried using the Assembly Scan on the Memory Browser to find the OPcode you said (mov ebx,[r13 + rdx + 00000084]) and couldn't find a single resut... after 3 days scanning!!! ;~;

This scanner takes too long, I don't think I'm gonna be able to use it again... is there any better|faster way to do it...? Did I do something wrong...? ;~;



whhhyyyyyyy.png
 Description:
 Filesize:  737.53 KB
 Viewed:  19146 Time(s)

whhhyyyyyyy.png


Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Sun Nov 03, 2019 3:43 pm    Post subject: Reply with quote

"Assembly Scan" ?? it's the first time I've heard of it, I didn't think CE had this feature.
However what I was saying is that you have to replace my comment the one in braces with the name of the module on which is the instruction mov ebx, [r13 + rdx + 00000084].
If you go to the OP Code "mov ebx, [r13 + rdx + 00000084]" and open the disassembler and select "AOB Injection" and copy all the contents I could complete it for you
Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Sun Nov 03, 2019 6:20 pm    Post subject: Reply with quote

Yes, that's my point!

I made a google search before and found out that that "Assembly Scan" in CE apparently searches OP codes... But alas, 2 scans so far (I managed to find a way to make it go much faster) but still no results...

Is there any other way I could find where that OP code is?
Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Mon Nov 04, 2019 12:00 pm    Post subject: Reply with quote

I think there was a misunderstanding, I meant the code that appeared in the debugger (in the first image you sent in the discussion), you have to find that value, reopen the debugger and find that code, select it and click on "Show Disassembler" and on the window which will appear on the disassembler press "Crtl + A" so you will open the assembler car on that address, from there press the "Shift + Crtl + A" combination and click on the "Ok" item twice, a piece of code should appear , copy and paste it here so I can help you with scripting
Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Mon Nov 04, 2019 2:52 pm    Post subject: Reply with quote

Holy fudge I feel like an idiot now... and holy damn this feels like magic... I press some combinations and suddenly code... >-<"""

Anyway, here's the Code!

Code:

{ Game   : Cemu.exe
  Version:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]

aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)

label(code)
label(return)

newmem:

code:
  mov r8d,[r13+rsi+00000554]
  jmp return

INJECT:
  jmp newmem
  nop 3
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rsi+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap r8d
173200941B4: 41 39 F8                    -  cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}
Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Mon Nov 04, 2019 4:28 pm    Post subject: Reply with quote

I tell you that in the first image the code is "mov ebx, [r13 + rdx + 00000084]" while in the code you sended me is "mov r8d, [r13 + rsi + 00000554]" so I'll make you the following script works on "mov r8d, [r13 + rsi + 00000554]" ":
Code:
{ Game   : Cemu.exe
  Version:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
alloc(Address, 8)

registersymbol(Address)

label(code)
label(return)

newmem:
push 554
pop [Address]
add [Address], r13
add [Address], rsi

code:
mov r8d,[r13+rsi+00000554]
jmp return

INJECT:
jmp newmem
nop 3

return:
registersymbol(INJECT)

[DISABLE]

INJECT:
db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rsi+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap r8d
173200941B4: 41 39 F8                    -  cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}


If it does not work, try:
Code:
{ Game   : Cemu.exe
  Version:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
alloc(Address, 8)

registersymbol(Address)

label(code)
label(return)

newmem:
push eax
mov eax, 554
mov [Address], eax
pop eax
add [Address], r13
add [Address], rsi

code:
mov r8d,[r13+rsi+00000554]
jmp return

INJECT:
jmp newmem
nop 3

return:
registersymbol(INJECT)

[DISABLE]

INJECT:
db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rsi+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap r8d
173200941B4: 41 39 F8                    -  cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}


In case your result is a rather strange address maybe it's because there are more addresses that use that code, initially try these scripts and tell me if they work.
Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Tue Nov 05, 2019 10:19 am    Post subject: Reply with quote

I tried it and... the game crashed... ;w;

(Sorry, the code keeps changing each session... so I had to change it again in your code... was this right?)

Code:

{ Game   : Cemu.exe
  Verdxon:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
alloc(Address, 8)

registersymbol(Address)

label(code)
label(return)

newmem:
push 88
pop [Address]
add [Address], r13
add [Address], rdx

code:
mov ebx,[r13+rdx+0000088]
jmp return

INJECT:
jmp newmem
nop 3

return:
registersymbol(INJECT)

[DISABLE]

INJECT:
db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rdx+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov ebx,[r13+rdx+0000088]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap ebx
173200941B4: 41 39 F8                    -  cmp ebx,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],ebx
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}
Back to top
View user's profile Send private message
DanyDollaro
Master Cheater
Reputation: 3

Joined: 01 Aug 2019
Posts: 334

PostPosted: Tue Nov 05, 2019 2:03 pm    Post subject: Reply with quote

try these others:
Code:
{ Game   : Cemu.exe
  Version:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00 41 0F C8 41 39 F8 0F 9C 84 24 8C 02 00 00 0F 9F 84 24 8D 02 00 00 0F 94 84 24 8E 02 00 00) // should be unique
alloc(newmem,$1000)
alloc(Address, 8)

registersymbol(Address)

label(code)
label(return)

newmem:
push 554
pop [Address]
add [Address], r13
add [Address], rsi

code:
mov r8d,[r13+rsi+00000554]
jmp return

INJECT:
jmp newmem
nop 3

return:
registersymbol(INJECT)

[DISABLE]

INJECT:
db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rsi+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap r8d
173200941B4: 41 39 F8                    -  cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}


2nd:
Code:
{ Game   : Cemu.exe
  Version:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00 41 0F C8 41 39 F8 0F 9C 84 24 8C 02 00 00 0F 9F 84 24 8D 02 00 00 0F 94 84 24 8E 02 00 00) // should be unique
alloc(newmem,$1000)
alloc(Address, 8)

registersymbol(Address)

label(code)
label(return)

newmem:
push eax
mov eax, 554
mov [Address], eax
pop eax
add [Address], r13
add [Address], rsi

code:
mov r8d,[r13+rsi+00000554]
jmp return

INJECT:
jmp newmem
nop 3

return:
registersymbol(INJECT)

[DISABLE]

INJECT:
db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rsi+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap r8d
173200941B4: 41 39 F8                    -  cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}


3rd:
Code:
{ Game   : Cemu.exe
  Verdxon:
  Date   : 2019-11-04
  Author : arche

  This script does blah blah blah
}

[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00 41 0F C8 41 39 F8 0F 9C 84 24 8C 02 00 00 0F 9F 84 24 8D 02 00 00 0F 94 84 24 8E 02 00 00) // should be unique
alloc(newmem,$1000)
alloc(Address, 8)

registersymbol(Address)

label(code)
label(return)

newmem:
push 88
pop [Address]
add [Address], r13
add [Address], rdx

code:
mov ebx,[r13+rdx+0000088]
jmp return

INJECT:
jmp newmem
nop 3

return:
registersymbol(INJECT)

[DISABLE]

INJECT:
db 45 8B 84 35 54 05 00 00

unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: 173200941A9

17320094160: 89 54 24 08                 -  mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00  -  movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00  -  movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00  -  movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00  -  movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00        -  mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20     -  jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04     -  sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00     -  mov edi,[r13+rdx+00000558]
173200941A7: 0F CF                       -  bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00     -  mov ebx,[r13+rdx+0000088]
// ---------- DONE INJECTING  ----------
173200941B1: 41 0F C8                    -  bswap ebx
173200941B4: 41 39 F8                    -  cmp ebx,edi
173200941B7: 0F 9C 84 24 8C 02 00 00     -  setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00     -  setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00     -  sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C              -  mov [rsp+7C],ebx
173200941D4: 89 7C 24 6C                 -  mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00           -  jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01     -  sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00              -  jmp 17320094650
}


When you activate these scripts you should wait a few seconds longer than expected.
And if in case they work, be careful not to activate more than 2 sets, since if you focus on the same registered memory, if it ever changes to:
Code:
alloc(Address_2, 8)

registersymbol(Address_2)
...
[DISABLE]
dealloc(Address_2)
unregistersymbol(Address_2)
Back to top
View user's profile Send private message
Archezuli
Advanced Cheater
Reputation: 0

Joined: 28 Oct 2019
Posts: 58

PostPosted: Tue Nov 05, 2019 2:19 pm    Post subject: Reply with quote

I'm gonna try them, thanks!

Last edited by Archezuli on Tue Nov 05, 2019 6:14 pm; edited 1 time in total
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Goto page 1, 2, 3, 4, 5, 6, 7, 8  Next
Page 1 of 8

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites