Cheat Engine

jobeth213 · Newbie cheater Reputation: 0 Joined: 27 Sep 2016 Posts: 22

Hi guys I am trying to call a function from the game outside of game exe(using my own exe program) but the game is always crashing, in cheat engine it work, but in my program it is crashing. The game is x86

Here is the full code in C++. Every GetLastError is returning 0, but the game is still crashing.

ParkourPenguin · Posted: Fri Nov 13, 2020 11:36 pm Post subject:

The E8 CALL opcode uses a rel32 displacement from RIP (address of next instruction). The address of the memory given by VirtualAllocEx shouldn't be assumed to be deterministic unless the second parameter, lpAddress, is not NULL. You'll need to do a little math and change the rel32 displacement depending on where the instruction is located in memory.

That's the first thing I saw that was wrong. I didn't look at the rest in much detail.

jobeth213 · Newbie cheater Reputation: 0 Joined: 27 Sep 2016 Posts: 22

Csimbi · Posted: Sat Nov 14, 2020 3:41 am Post subject:

Should be simple math - just calculate the offset from following instruction (EIP/RIP likeParkourPenguin said) and use that offset.
Might be a good idea to debug on the first try to see if you land on the right instruction of the call.

As you said, CE will do it right - you can debug that and see what's the difference between your offset and CE's, then adjust your math.

ParkourPenguin · Posted: Sat Nov 14, 2020 12:02 pm Post subject:

Take the address of the call instruction and add 5 to it. This is the address of the next instruction and where it will be jumping from.
Subtract that value from the address you're jumping to.
Write the resulting signed little-endian 32-bit integer to the rel32 displacement in the call instruction.

e.g. if VirtualAllocEx gives 0x65A00000, the bytes would be 004DA8E0 - 65A00010 = D0 A8 AD 9A

jobeth213 · Newbie cheater Reputation: 0 Joined: 27 Sep 2016 Posts: 22

ParkourPenguin · Posted: Sat Nov 14, 2020 10:35 pm Post subject:

Are you sure you got this working in CE? Did you use the auto assembler (alloc, createthread, etc) or something else?

Unless the function 004DA8E0 kills the thread, there's nothing stopping your thread. If that function simply returns, it'll run memory you didn't initialize. Add a ret instruction after the call, or do a tail call.

Also, read the documentation before using an API:

jobeth213 · Newbie cheater Reputation: 0 Joined: 27 Sep 2016 Posts: 22