Cheat Engine

[Rotschild]

I have problem with AOB AutoAssable with BlueStacks memory.

I want to create Jump for new memory region created by AOB script (pic1) and it works fine in CT MemoryViewer that is outside BlueStacks (Pic2) but when i look at what have script done in CT MemoryViewer from inside BlueStacks (ceserver_x86) i see some crazy jump to nowhere(Pic3). And as a result - app crash.

I assume this is Alloc problems. BlueStacks has its own virtual address table inside itself. How can i fix it?

[Dark Byte]

From outside bluestacks you are working on the physical memory ofbthe android device, not on the virtual memory of the process running inside the android device.

You need to do the alloc from inside ceserver. Which will require the extension module te get injected into the target first (sometimes the inject works fine, but i never tested that on bluestacks)

Then do the jmp from inside ceserver as well, else the jump distance is wrong, as virtual memory is randomized over physical memory in 4096 byte blocks

-

else find a codecave inside the target process and use and aob to find that.
Then build the jmp yourself using the virtual address of origin and destination

[Doraneko]

ceserver's so injection is a little unstable.
Load libceserver-extension_x86.so directly embedded in apk (like frida-gadget).
Or you can inject the so file with frida.

I have confirmed that CE AutoAssemble works correctly with NoxAppPlayer using the above method.

[nadinemagazine]

thanks

[Rotschild]

[Doraneko]

I verified with a common so file injection program.
(x86 program => x86 program)
Nox 4.4.2: Failure
Nox 5.1.1: Success
Nox 7.1.2: Failure

(x86 program => ARM program)
In the above case, an emulator hooking library called 「EHook」 is used.

I also succeeded with Nox 5.1.1 by modifying the ceserver program. But I didn't know why this was successful.

In Frida, if you implement a script that invokes dlopen, it is possible in Nox5.1.1.

[Rotschild]