 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Mon Oct 28, 2019 5:48 pm Post subject: Need help improving Xenoblade X Cheat Table |
|
|
Hi!
I've been trying for days to improve the old Cheat Table made for Xenoblade X by some in the community years ago, both for myself and to be able to give something back to the community for this amazing Cheat Table...
Making progress but slowly learning Cheat Engine and the game. but I cannot for the life of me progress on a few things, and it's been making me go insane for a few days now. If anyone could help me out (Preferably through Discord, because to actually have someone to help me in real time would be a huge lifesaver...), I would be immensely grateful...
The Addresses I find for the game are always changing between sessions. So it doesn't matter if I find anything, by the next session its address will do nothing again... (With enough time passed, even in the same session). And I tried absolutely every single method and variable and tutorial I found out there, with no success whatsoever.
Pointer Scans with or without saved scans, with values, with address, and even figured on my own, through some snooping around and trial and error, how to convert the Addresses I find to be relative to a certain tag that the script to activate the Cheat Table uses to find all values (Every address is "_player+something"), but absolutely NONE of these methods worked... not even the last one, for some ungodly reason...
Please, somebody help me... I really wanted to make this work, but I'm borderline giving up by now...
Thank you everyone, and have a great day...
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Tue Oct 29, 2019 9:51 am Post subject: |
|
|
A script I do to find addresses is:
1) see what it writes / accesses on that value
2) There should be a register named in square brackets, consequently through a Code Injection I would move the value of that register to a memory region with a symbol
3) I add any offsets by the script
4) I added the memory region to the cheat table and if I needed that address I just need to enable the script
Machine Code:
Code: | {Code...}
Mov [eax], ecx
{Code...} |
CE Injection:
Code: | [ENABLE]
alloc(newmem, 128)
registersymbol(Address, 8)
newmem:
Mov [Address], eax
Mov [eax], ecx
return:
jmp {Address from which I made the injection}
[DISABLE]
dealloc(newmem)
unregistersymbol(Address) |
from there just add the address "Address" to the Cheat Table and you have its value
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Wed Oct 30, 2019 5:30 pm Post subject: |
|
|
Just choose one of those codes (I usually choose the one with the highest refresh rate).
I create a script for you:
Code: | [ENABLE]
aobscanmodule(TakeAddress, {Module Name} ,41 8B 9C 15 84 00 00 00)
alloc(newmem,$1000,{Module Name + Offset})
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push 84
pop [Address]
add [Address], r13
add [Address], rdx
code:
mov ebx,[r13+rdx+00000084]
jmp return
TakeAddress:
jmp newmem
nop 3
return:
registersymbol(TakeAddress)
[DISABLE]
TakeAddress:
db 41 8B 9C 15 84 00 00 00
unregistersymbol(TakeAddress)
unregistersymbol(Address)
dealloc(newmem)
dealloc(Address) |
To add the address you see in the image below the script just click on "Add address manually" and instead of writing a memory address write exactly "Address".
Not knowing the game and not having tried it on that I don't guarantee you it will work but give it a try.
Description: |
|
Filesize: |
30.65 KB |
Viewed: |
19328 Time(s) |

|
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Thu Oct 31, 2019 5:20 am Post subject: |
|
|
Omg thank you so much for your help so far!!! You are the best and I love you! 💙
But I tried your script and it didn't work... It says "Module not found"... did I do something wrong...? :'(
(I can pass you the emulator and game file in a zip if it helps? ^~^")
Description: |
|
Filesize: |
50.9 KB |
Viewed: |
19298 Time(s) |

|
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Thu Oct 31, 2019 10:10 am Post subject: |
|
|
It doesn't find the module because I don't know what it's called, so you have to replace the comment in braces with the name of the module.
Just open the CE disassembler on the code "mov ebx,[r13 + rdx + 00000084]" open the "Code Injection" template and replace the lines where the module is written and the offset.
I could help but for now you should just replace the module name and the offset
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Sun Nov 03, 2019 7:48 am Post subject: |
|
|
I tried using the Assembly Scan on the Memory Browser to find the OPcode you said (mov ebx,[r13 + rdx + 00000084]) and couldn't find a single resut... after 3 days scanning!!! ;~;
This scanner takes too long, I don't think I'm gonna be able to use it again... is there any better|faster way to do it...? Did I do something wrong...? ;~;
Description: |
|
Filesize: |
737.53 KB |
Viewed: |
19146 Time(s) |

|
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Sun Nov 03, 2019 3:43 pm Post subject: |
|
|
"Assembly Scan" ?? it's the first time I've heard of it, I didn't think CE had this feature.
However what I was saying is that you have to replace my comment the one in braces with the name of the module on which is the instruction mov ebx, [r13 + rdx + 00000084].
If you go to the OP Code "mov ebx, [r13 + rdx + 00000084]" and open the disassembler and select "AOB Injection" and copy all the contents I could complete it for you
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Sun Nov 03, 2019 6:20 pm Post subject: |
|
|
Yes, that's my point!
I made a google search before and found out that that "Assembly Scan" in CE apparently searches OP codes... But alas, 2 scans so far (I managed to find a way to make it go much faster) but still no results...
Is there any other way I could find where that OP code is?
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Mon Nov 04, 2019 12:00 pm Post subject: |
|
|
I think there was a misunderstanding, I meant the code that appeared in the debugger (in the first image you sent in the discussion), you have to find that value, reopen the debugger and find that code, select it and click on "Show Disassembler" and on the window which will appear on the disassembler press "Crtl + A" so you will open the assembler car on that address, from there press the "Shift + Crtl + A" combination and click on the "Ok" item twice, a piece of code should appear , copy and paste it here so I can help you with scripting
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Mon Nov 04, 2019 2:52 pm Post subject: |
|
|
Holy fudge I feel like an idiot now... and holy damn this feels like magic... I press some combinations and suddenly code... >-<"""
Anyway, here's the Code!
Code: |
{ Game : Cemu.exe
Version:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
label(code)
label(return)
newmem:
code:
mov r8d,[r13+rsi+00000554]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rsi+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap r8d
173200941B4: 41 39 F8 - cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
}
|
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Mon Nov 04, 2019 4:28 pm Post subject: |
|
|
I tell you that in the first image the code is "mov ebx, [r13 + rdx + 00000084]" while in the code you sended me is "mov r8d, [r13 + rsi + 00000554]" so I'll make you the following script works on "mov r8d, [r13 + rsi + 00000554]" ":
Code: | { Game : Cemu.exe
Version:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push 554
pop [Address]
add [Address], r13
add [Address], rsi
code:
mov r8d,[r13+rsi+00000554]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rsi+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap r8d
173200941B4: 41 39 F8 - cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
} |
If it does not work, try:
Code: | { Game : Cemu.exe
Version:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push eax
mov eax, 554
mov [Address], eax
pop eax
add [Address], r13
add [Address], rsi
code:
mov r8d,[r13+rsi+00000554]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rsi+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap r8d
173200941B4: 41 39 F8 - cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
} |
In case your result is a rather strange address maybe it's because there are more addresses that use that code, initially try these scripts and tell me if they work.
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Tue Nov 05, 2019 10:19 am Post subject: |
|
|
I tried it and... the game crashed... ;w;
(Sorry, the code keeps changing each session... so I had to change it again in your code... was this right?)
Code: |
{ Game : Cemu.exe
Verdxon:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00) // should be unique
alloc(newmem,$1000,173200941A9)
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push 88
pop [Address]
add [Address], r13
add [Address], rdx
code:
mov ebx,[r13+rdx+0000088]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rdx+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov ebx,[r13+rdx+0000088]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap ebx
173200941B4: 41 39 F8 - cmp ebx,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],ebx
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
}
|
|
|
Back to top |
|
 |
DanyDollaro Master Cheater
Reputation: 3
Joined: 01 Aug 2019 Posts: 334
|
Posted: Tue Nov 05, 2019 2:03 pm Post subject: |
|
|
try these others:
Code: | { Game : Cemu.exe
Version:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00 41 0F C8 41 39 F8 0F 9C 84 24 8C 02 00 00 0F 9F 84 24 8D 02 00 00 0F 94 84 24 8E 02 00 00) // should be unique
alloc(newmem,$1000)
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push 554
pop [Address]
add [Address], r13
add [Address], rsi
code:
mov r8d,[r13+rsi+00000554]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rsi+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap r8d
173200941B4: 41 39 F8 - cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
} |
2nd:
Code: | { Game : Cemu.exe
Version:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00 41 0F C8 41 39 F8 0F 9C 84 24 8C 02 00 00 0F 9F 84 24 8D 02 00 00 0F 94 84 24 8E 02 00 00) // should be unique
alloc(newmem,$1000)
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push eax
mov eax, 554
mov [Address], eax
pop eax
add [Address], r13
add [Address], rsi
code:
mov r8d,[r13+rsi+00000554]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rsi+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov r8d,[r13+rsi+00000554]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap r8d
173200941B4: 41 39 F8 - cmp r8d,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],r8d
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
} |
3rd:
Code: | { Game : Cemu.exe
Verdxon:
Date : 2019-11-04
Author : arche
This script does blah blah blah
}
[ENABLE]
aobscan(INJECT,45 8B 84 35 54 05 00 00 41 0F C8 41 39 F8 0F 9C 84 24 8C 02 00 00 0F 9F 84 24 8D 02 00 00 0F 94 84 24 8E 02 00 00) // should be unique
alloc(newmem,$1000)
alloc(Address, 8)
registersymbol(Address)
label(code)
label(return)
newmem:
push 88
pop [Address]
add [Address], r13
add [Address], rdx
code:
mov ebx,[r13+rdx+0000088]
jmp return
INJECT:
jmp newmem
nop 3
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 45 8B 84 35 54 05 00 00
unregistersymbol(INJECT)
unregistersymbol(Address)
dealloc(Address)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: 173200941A9
17320094160: 89 54 24 08 - mov [rsp+08],edx
17320094164: 66 0F 11 84 E4 58 02 00 00 - movupd [rsp+00000258],xmm0
1732009416D: 66 0F 11 8C E4 68 02 00 00 - movupd [rsp+00000268],xmm1
17320094176: 66 0F 11 94 E4 48 02 00 00 - movupd [rsp+00000248],xmm2
1732009417F: 66 0F 11 9C E4 78 02 00 00 - movupd [rsp+00000278],xmm3
17320094188: 8B 94 24 B8 02 00 00 - mov edx,[rsp+000002B8]
1732009418F: 41 FF A4 57 00 00 00 20 - jmp qword ptr [r15+rdx*2+20000000]
17320094197: 83 AC 24 B0 02 00 00 04 - sub dword ptr [rsp+000002B0],04
1732009419F: 41 8B BC 35 58 05 00 00 - mov edi,[r13+rdx+00000558]
173200941A7: 0F CF - bswap edi
// ---------- INJECTING HERE ----------
173200941A9: 45 8B 84 35 54 05 00 00 - mov ebx,[r13+rdx+0000088]
// ---------- DONE INJECTING ----------
173200941B1: 41 0F C8 - bswap ebx
173200941B4: 41 39 F8 - cmp ebx,edi
173200941B7: 0F 9C 84 24 8C 02 00 00 - setl byte ptr [rsp+0000028C]
173200941BF: 0F 9F 84 24 8D 02 00 00 - setg byte ptr [rsp+0000028D]
173200941C7: 0F 94 84 24 8E 02 00 00 - sete byte ptr [rsp+0000028E]
173200941CF: 44 89 44 24 7C - mov [rsp+7C],ebx
173200941D4: 89 7C 24 6C - mov [rsp+6C],edi
173200941D8: 0F 8C 59 04 00 00 - jl 17320094637
173200941DE: 83 AC 24 B0 02 00 00 01 - sub dword ptr [rsp+000002B0],01
173200941E6: E9 65 04 00 00 - jmp 17320094650
} |
When you activate these scripts you should wait a few seconds longer than expected.
And if in case they work, be careful not to activate more than 2 sets, since if you focus on the same registered memory, if it ever changes to:
Code: | alloc(Address_2, 8)
registersymbol(Address_2)
...
[DISABLE]
dealloc(Address_2)
unregistersymbol(Address_2) |
|
|
Back to top |
|
 |
Archezuli Advanced Cheater
Reputation: 0
Joined: 28 Oct 2019 Posts: 58
|
Posted: Tue Nov 05, 2019 2:19 pm Post subject: |
|
|
I'm gonna try them, thanks!
Last edited by Archezuli on Tue Nov 05, 2019 6:14 pm; edited 1 time in total |
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|