| View previous topic :: View next topic |
| Author |
Message |
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
 Posted: Sun Aug 29, 2021 2:34 pm Post subject: Can someone help me deciper this short script for Halo ? |
 |
|
This script changes bullet magnetism. I want to change the amount but I can't decipher how.
What would I need to do to track down that address and change it? I really don't know what I'm looking at here.
Thank you so much !
| Code: |
[ENABLE]
alloc(newmem,2048,"halo3.dll"+14B7DB)
label(returnhere)
label(originalcode)
label(exit)
newmem:
mulss xmm0,[rsi+00000358]
originalcode: //00000358
exit:
jmp returnhere
"halo3.dll"+14B7DB:
jmp newmem
nop 3
returnhere:
[DISABLE]
dealloc(newmem)
"halo3.dll"+14B7DB:
mulss xmm0,[rsi+00000358]
|
Last edited by garbygarb on Sun Aug 29, 2021 3:01 pm; edited 2 times in total |
|
| Back to top |
|
 |
LeFiXER
Grandmaster Cheater Supreme
![]() Reputation: 20
Joined: 02 Sep 2011
Posts: 1069
Location: 0x90
|
| Posted: Sun Aug 29, 2021 2:58 pm Post subject: |
|
|
Please use code tags when submitting code.
This is the address of the instruction, the script is injected at this location.
Which places a jump instruction to "newmem:", then CE writes the instructions under the "newmem:" label following that it jumps to the "exit:" label which jumps back to the instruction after the point of injection to continue flow of code.
|
|
| Back to top |
|
|
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
| Posted: Sun Aug 29, 2021 3:03 pm Post subject: |
|
|
Okay will do!
How can I find halo3.dll"+14B7DB? Do I need to locate that to modify what I'm trying to modify?
| LeFiXER wrote: | Please use code tags when submitting code.
This is the address of the instruction, the script is injected at this location.
Which places a jump instruction to "newmem:", then CE writes the instructions under the "newmem:" label following that it jumps to the "exit:" label which jumps back to the instruction after the point of injection to continue flow of code. |
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4719
|
| Posted: Sun Aug 29, 2021 3:11 pm Post subject: |
|
|
Unless the disable section is misleading, that code injection does effectively nothing.
It replaces the original code "mulss xmm0,[rsi+00000358]" with a code injection that contains only one instruction: "mulss xmm0,[rsi+00000358]".
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
| Posted: Sun Aug 29, 2021 3:17 pm Post subject: |
|
|
| ParkourPenguin wrote: | Unless the disable section is misleading, that code injection does effectively nothing.
It replaces the original code "mulss xmm0,[rsi+00000358]" with a code injection that contains only one instruction: "mulss xmm0,[rsi+00000358]". |
Yeah, to my very very inexperienced eye it seems like it's replacing the code with the same code?
What about this one? This one is for aim angle.
| Code: | [ENABLE]
alloc(newmem,2048,"halo3.dll"+14B79E)
label(returnhere)
label(originalcode)
label(exit)
newmem:
//mulss xmm1,[rsi+00000358]
originalcode: //00000348
exit:
jmp returnhere
"halo3.dll"+14B79E:
jmp newmem
nop 3
returnhere:
[DISABLE]
dealloc(newmem)
"halo3.dll"+14B79E:
mulss xmm1,[rsi+00000348] |
|
|
| Back to top |
|
|
LeFiXER
Grandmaster Cheater Supreme
![]() Reputation: 20
Joined: 02 Sep 2011
Posts: 1069
Location: 0x90
|
| Posted: Sun Aug 29, 2021 5:10 pm Post subject: |
|
|
| ParkourPenguin wrote: | Unless the disable section is misleading, that code injection does effectively nothing.
It replaces the original code "mulss xmm0,[rsi+00000358]" with a code injection that contains only one instruction: "mulss xmm0,[rsi+00000358]". |
That's effectively what I thought too.
| Code: |
[ENABLE]
alloc(newmem,2048,"halo3.dll"+14B79E)
label(returnhere)
label(originalcode)
label(exit)
newmem:
//mulss xmm1,[rsi+00000358]
originalcode: //00000348
exit:
jmp returnhere
"halo3.dll"+14B79E:
jmp newmem
nop 3
returnhere:
[DISABLE]
dealloc(newmem)
"halo3.dll"+14B79E:
mulss xmm1,[rsi+00000348]
|
This also does nothing.
To go to an address, in the disassembler window (Open Memory View) > Right-click > Go to address (Ctrl+G) > Type/paste address then press enter.
|
|
| Back to top |
|
|
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
| Posted: Sun Aug 29, 2021 5:26 pm Post subject: |
|
|
I'm very confused. I know it does something, it changes the angle of which I can be off the target and still hit a shot. I can tick it on and off and there's a visible difference. What makes you say it does nothing?
| LeFiXER wrote: | | ParkourPenguin wrote: | Unless the disable section is misleading, that code injection does effectively nothing.
It replaces the original code "mulss xmm0,[rsi+00000358]" with a code injection that contains only one instruction: "mulss xmm0,[rsi+00000358]". |
That's effectively what I thought too.
| Code: |
[ENABLE]
alloc(newmem,2048,"halo3.dll"+14B79E)
label(returnhere)
label(originalcode)
label(exit)
newmem:
//mulss xmm1,[rsi+00000358]
originalcode: //00000348
exit:
jmp returnhere
"halo3.dll"+14B79E:
jmp newmem
nop 3
returnhere:
[DISABLE]
dealloc(newmem)
"halo3.dll"+14B79E:
mulss xmm1,[rsi+00000348]
|
This also does nothing.
To go to an address, in the disassembler window (Open Memory View) > Right-click > Go to address (Ctrl+G) > Type/paste address then press enter. |
|
|
| Back to top |
|
|
LeFiXER
Grandmaster Cheater Supreme
![]() Reputation: 20
Joined: 02 Sep 2011
Posts: 1069
Location: 0x90
|
| Posted: Sun Aug 29, 2021 5:38 pm Post subject: |
|
|
Okay, so there must have been instructions under the "originalcode:" label that were removed. I say that it must do nothing because scripts often leave some information regarding the instructions that are to be changed, right at the bottom of the script in a large comment block, but also, the original instructions under the code are missing. "newmem:" doesn't do anything either, it's just a comment.
CE places a jmp instruction to newmem at the address "halo3.dll"+14B79E then jumps back. There are no instructions to execute after the jump besides the jump back.
|
|
| Back to top |
|
|
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
| Posted: Sun Aug 29, 2021 5:57 pm Post subject: |
|
|
I tried to post a video link but it wont let me. There are 7 scripts that make up this table. They all look just like the 2 I've posted.
They control:
Autoaim Range
Autoaim Angle
Autoaim Range Falloff
Magnetism Range
Magnetism Angle
Magnetism Range Falloff
and bullet deviation angle
They're clearly changing those things, but I'm confused how the script isn't indicating anything
| LeFiXER wrote: | Okay, so there must have been instructions under the "originalcode:" label that were removed. I say that it must do nothing because scripts often leave some information regarding the instructions that are to be changed, right at the bottom of the script in a large comment block, but also, the original instructions under the code are missing. "newmem:" doesn't do anything either, it's just a comment.
CE places a jmp instruction to newmem at the address "halo3.dll"+14B79E then jumps back. There are no instructions to execute after the jump besides the jump back. |
|
|
| Back to top |
|
|
LeFiXER
Grandmaster Cheater Supreme
![]() Reputation: 20
Joined: 02 Sep 2011
Posts: 1069
Location: 0x90
|
| Posted: Sun Aug 29, 2021 6:02 pm Post subject: |
|
|
| Well, without the game we can't see what it's changing because we can't view the instructions surrounding the addresses.
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 152
Joined: 06 Jul 2014
Posts: 4719
|
| Posted: Sun Aug 29, 2021 6:26 pm Post subject: |
|
|
| garbygarb wrote: | What about this one? This one is for aim angle.
| Code: | ...
newmem:
//mulss xmm1,[rsi+00000358]
... |
|
This line is commented out, so it is doing something by omitting the original instruction.
Are you sure you copied and pasted the first script correctly? Maybe it was commented out too?
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
| Posted: Sun Aug 29, 2021 6:35 pm Post subject: |
|
|
| ParkourPenguin wrote: | | garbygarb wrote: | What about this one? This one is for aim angle.
| Code: | ...
newmem:
//mulss xmm1,[rsi+00000358]
... |
|
This line is commented out, so it is doing something by omitting the original instruction.
Are you sure you copied and pasted the first script correctly? Maybe it was commented out too? |
Yep! I copied and pasted every line that was there.
This is the memory view before and after enabling the autoaim angle script
Before script is active:
| Code: |
halo3.dll+14B79E - F3 0F59 8E 48030000 - mulss xmm1,[rsi+00000348]
|
After:
| Code: |
halo3.dll+14B79E - E9 5D48EAFF - jmp 7FFC70750000
halo3.dll+14B7A3 - 0F1F 00 - nop dword ptr [rax]
|
I hope this means something lol
I realllly wish I could post a video/pictures
|
|
| Back to top |
|
|
LeFiXER
Grandmaster Cheater Supreme
![]() Reputation: 20
Joined: 02 Sep 2011
Posts: 1069
Location: 0x90
|
| Posted: Sun Aug 29, 2021 6:46 pm Post subject: |
|
|
A rather inefficient way of nopping (overwriting an opcode with no operation) an instruction.
You could effectively achieve the same thing with:
| Code: |
[ENABLE]
"halo3.dll"+14B79E:
db 90 90 90 90 90 90 90 90
[DISABLE]
"halo3.dll"+14B79E:
db F3 0F 59 8E 48 03 00 00
|
|
|
| Back to top |
|
|
garbygarb
Newbie cheater
![]() Reputation: 0
Joined: 10 Aug 2021
Posts: 20
|
| Posted: Sun Aug 29, 2021 6:48 pm Post subject: |
|
|
I have another script that looks a lot like that.
| Code: |
[ENABLE]
halo3.dll+14B7AE:
db F3 0F 2A 96 4C 03 00 00
halo3.dll+14B79E:
db 90 90 90 90 90 90 90 90
halo3.dll+14B7BB:
db F3 0F 59 86 58 03 00 00
halo3.dll+14B7CB:
db F3 0F 59 8E 58 03 00 00
halo3.dll+14B7DB:
db F3 0F 59 86 58 03 00 00
halo3.dll+14B7E8:
db F3 0F 59 8E 58 03 00 00
halo3.dll+14B812:
db 90 90 90 90 90 90 90 90
[DISABLE]
halo3.dll+14B7AE:
db F3 0F 59 96 4C 03 00 00
halo3.dll+14B79E:
db F3 0F 59 8E 48 03 00 00
halo3.dll+14B7BB:
db F3 0F 59 86 50 03 00 00
halo3.dll+14B7CB:
db F3 0F 59 8E 54 03 00 00
halo3.dll+14B7DB:
db F3 0F 59 86 58 03 00 00
halo3.dll+14B7E8:
db F3 0F 59 8E 5C 03 00 00
halo3.dll+14B812:
db F3 0F 10 86 60 03 00 00
|
| LeFiXER wrote: | A rather inefficient way of nopping (overwriting an opcode with no operation) an instruction.
You could effectively achieve the same thing with:
| Code: |
[ENABLE]
"halo3.dll"+14B79E:
db 90 90 90 90 90 90 90 90
[DISABLE]
"halo3.dll"+14B79E:
db F3 0F 59 8E 48 03 00 00
|
|
|
|
| Back to top |
|
|
LeFiXER
Grandmaster Cheater Supreme
![]() Reputation: 20
Joined: 02 Sep 2011
Posts: 1069
Location: 0x90
|
| Posted: Sun Aug 29, 2021 7:03 pm Post subject: |
|
|
| That actually works?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
