Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Disassembly Window not displaying code properly

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
gid2525
Expert Cheater
Reputation: 2

Joined: 21 Oct 2013
Posts: 101
PostPosted: Thu Dec 24, 2020 3:47 pm    Post subject: Disassembly Window not displaying code properly Reply with quote
Hi, so I am reversing a trainer option for a trainer I found (for help with making a table) and I have an issue. So I see the original code:


Then I press the option on the trainer and it changes to a jump:



so far so good, so I follow the jump and get this jibberish:



Anyway to make it display properly? I need to check out what its doing.

Thanks!
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 470

Joined: 09 May 2003
Posts: 25807
Location: The netherlands
PostPosted: Thu Dec 24, 2020 4:23 pm    Post subject: Reply with quote
check the protection of that memory. If it's set as not-executable it may only get decrypted when executed and reencrypts itself on exit
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
gid2525
Expert Cheater
Reputation: 2

Joined: 21 Oct 2013
Posts: 101
PostPosted: Thu Dec 24, 2020 8:45 pm    Post subject: Reply with quote
Dark Byte wrote:
check the protection of that memory. If it's set as not-executable it may only get decrypted when executed and reencrypts itself on exit


I don't think its encrypted cause farther down a different trainer option uses some code and its fine. Anyway, I went to the address in the memory viewer and it says:

Back to top
View user's profile Send private message
MMM-304
Expert Cheater
Reputation: 0

Joined: 17 Aug 2020
Posts: 170
Location: Milkey Way
PostPosted: Fri Dec 25, 2020 4:30 am    Post subject: Reply with quote
did you do anything like:

Code:

newmem:
dd  yourMem
dd blabla


and then forgot to skip this portion

another possible reason is that you might be using opcodes that are still not implemented in CE
Back to top
View user's profile Send private message
Csimbi
I post too much
Reputation: 97

Joined: 14 Jul 2007
Posts: 3327
PostPosted: Fri Dec 25, 2020 5:53 am    Post subject: Reply with quote
gid2525 wrote:
Hi, so I am reversing a trainer option for a trainer I found



Did you try SunBeam's Competition Adjuster?
That was the best in class a few years back.
Back to top
View user's profile Send private message
gid2525
Expert Cheater
Reputation: 2

Joined: 21 Oct 2013
Posts: 101
PostPosted: Fri Dec 25, 2020 10:01 am    Post subject: Reply with quote
MMM-304 wrote:
did you do anything like:

Code:

newmem:
dd  yourMem
dd blabla


and then forgot to skip this portion

another possible reason is that you might be using opcodes that are still not implemented in CE


Not sure what/how the trainer option was set up so its possible. Certainly some of the jumps look sloppy so its possible the person who did the trainer was sloppy and the code is slightly jacked up. Was just wondering since its NOT encrypted (found several of the other options in the trainer and the opcodes look fine) if there was a way to fix the "view." The trainer option thats showing this code WORKS in the game so I'm assuming it has something to do with the view or there is some added sloppy stuff thats jacking up the code view...
Back to top
View user's profile Send private message
panraven
Grandmaster Cheater
Reputation: 62

Joined: 01 Oct 2008
Posts: 958
PostPosted: Fri Dec 25, 2020 2:47 pm    Post subject: Reply with quote
Why you not make a trace and break from the entry of the cave code (0x13ffe0000 as shown)?
If the cave code really not executed by page-fault or other tricky as DB said, you should see at least how the code return to the game code (return label in most AA template?), and might see possible memory access and write, where from these memory operation you might trace back what the cave code really do.

(fixed not typo -<delete>fix typo in the code bytes</delete> Smile
The code seemly ce-un-disassembled code, where from here http://shell-storm.org/online/Online-Assembler-and-Disassembler/?opcodes=9b+db+e0+41+b7+56+41+f6+d1+&arch=x86-64&endianness=little&dis_with_addr=True&dis_with_raw=True&dis_with_ins=True#disassembly

disassembled codes:
Code:

pic 1
0x0000000000000000:  9B          wait         
0x0000000000000001:  DB E0       feni8087_nop
0x0000000000000003:  41 B7 56    mov          r15b, 0x56
0x0000000000000006:  41 F6 D1    not          r9b
pic 2
0x0000000000000000:  9B          wait   
0x0000000000000001:  DB E4       fsetpm
0x0000000000000003:  41 B7 5D    mov    r15b, 0x5d
0x0000000000000006:  41 F6 D7    not    r15b

_________________
- Retarded.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites