Cheat Engine

[wayden]

Hi,
I got a little question about code injection and how to modify specific instruction
So im modding Hell is others and after using mono dissector i got to a method that call an other one :

xor edx,edx
mov rcx,rbx
call PlayerCharacter.EnableSeeEverything

the thing is i wanted to call this method with her boolean parameter set to 1
so i manualy did this:

mov dl,01
mov rcx,rbx
call PlayerCharacter.EnableSeeEverything

and it worked perfectly but when i tried to use the autoassemble and Aob injection template wich look like this :

aobscanmodule(SeeEverythings,GameAssembly.dll,33 D2 48 8B CB E8 4C
EE FF FF) // should be unique
alloc(newmem,$1000)

...
mov dl,01
mov rcx,rbx
call PlayerCharacter.EnableSeeEverything
jmp return
SeeEverythings:
jmp newmem
...
the game just crash, im gonna try to just modify the SeeEverythings: part to put it the modified operation directly
because i don't think i really need to alloc newmem since i don't create anything but perhaps im making mistake.

i wanted to know if their is others way more adapted for this kind of problem?

PS: modifying the SeeEvryhting: part directly worked , but i wonder why doing it the normal way by allocating new mem and just jmp to it didn't worked ?
is it possible that the alocated memory where i was doing the call from was too far away from the method i called ?

[ParkourPenguin]

If there's enough room in the injection point to do what I want, I typically do it there and delete all the alloc stuff. You have to be careful about the number of bytes you overwrite in the original code: it's easy to screw things up and crash the game. Pause the process if necessary (mono stuff stops working while it's paused, that's fine).

I don't know why the typical alloc code injection isn't working for you. Perhaps you injected at the wrong instruction? Post the full script, along with the comment at the bottom showing instructions around the injection point. This comment is included in the "AOB Injection" and "Full Injection" templates.

PS: this forum has code labels:

[wayden]

Thanks for your answer ! Here is the full script :

[ParkourPenguin]

Are you sure that script you just posted isn't working? It should be fine. Maybe CE isn't assembling the call instruction correctly (e.g. far call over that 5-byte call), or maybe the upper 3 bytes of edx matter. (modifying `dl` doesn't modify the other parts of `edx`)

There's no reason to overwrite those other 2 instructions, and most other lines can be deleted.

[wayden]

Ah yes it's the working one where i don't do any jump to newmem and doesn't call from it.

the one that wasn't working looked like that :

[ParkourPenguin]

The problem with that script is that `PlayerCharacter.EnableSeeEverything` is being called twice: once in your code injection with the correct arguments, and once again in the original code with undefined arguments.

`jmp newmem` takes up 5 bytes here... or, at least, it should if `alloc` was using the third parameter:

[wayden]

aight i think i get it, i had the "same" problem on an other script :

[ParkourPenguin]