Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Struggling with calling a function using the Auto Assembler

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
BirchTree
How do I cheat?
Reputation: 0

Joined: 30 Oct 2023
Posts: 3

PostPosted: Mon Oct 30, 2023 8:49 am    Post subject: Struggling with calling a function using the Auto Assembler Reply with quote

I'm pretty much a noob at this, but I'm trying to call a function on a game using the Auto Assembler.

In the memory viewer, I can see that the function is called like this:

Code:
mov edx,fs:[0000002C]
mov eax,[Game.exe+D50500]
mov eax,[edx+eax*4]
mov edx,[esp+0C]
push 0F
push 00008000
add eax,00012B50
push eax
mov eax,[esp+14]
push edx
mov edx,[esp+14]
push eax
push 00
push edx
add ecx,04
call Game.exe+42A210
ret 000C


I've set a breakpoint on this caller function and I've taken note of the values assigned to the registers when they are pushed so I can do the same on the Auto Assembler.
So I'm trying to call the function like this:

Code:
[ENABLE]

alloc(thread, 256)
createthread(thread)

thread:
  push 0000000F
  push 00008000
  push 01A578F0
  push 00000005
  push 000102CC
  push 00000000
  push 00000036
  call Game.exe+42A210
ret

[DISABLE]


However, that does nothing. If I set a breakpoint to Game.exe+42A210 before I execute this, it doesn't get triggered. I figured even if there was something wrong with the values, the breakpoint should trigger anyway, right?
Could somebody help me figure out what I'm doing wrong and maybe point me in the right direction?
Back to top
View user's profile Send private message
Famine
Cheater
Reputation: 0

Joined: 23 Oct 2023
Posts: 27
Location: A club where people wee on each other.

PostPosted: Mon Oct 30, 2023 9:28 am    Post subject: Reply with quote

Your goal is to call a function within the game's code by replicating the assembly instructions. However, there are a few issues with your script that could be preventing it from working correctly.

Here are some things to check and correct:

Memory Addresses: Verify that the addresses you are using in your script (Game.exe+42A210, 01A578F0, 000102CC, etc.) are still valid. Game updates or changes in memory allocation can lead to these addresses becoming outdated.

Register Values: Ensure that the values you push onto the stack (push 0000000F, push 00008000, etc.) match the values the game expects at those points in the function. If you've copied the assembly code correctly, this should be fine.

Calling Convention: Confirm that the function Game.exe+42A210 uses the same calling convention as your script. The calling convention determines how function parameters are passed and how the stack is cleaned up after the call. If it's not a standard calling convention, you may need to adapt your script.

Code Flow: Check if there are any conditional branches or other code that could prevent the function from being called. The original assembly code might be part of a larger context that you're not replicating in your script.

Memory Permissions: Make sure that the memory areas you're trying to modify or execute code in have the necessary read, write, and execute permissions. Some parts of the game's memory may be protected, and you might need to use additional techniques to modify them.

Debugger State: Ensure that the game is running and the debugger in Cheat Engine is attached to the game process. It's important to have the debugger running for breakpoints to work.

Thread Handling: Your script creates a new thread to execute the code. Make sure this is the intended behavior in the game. Some games may not support or allow external threads to interact with their code.

Error Handling: Check for any error messages or issues in the Cheat Engine log. It might provide insights into what's going wrong.

Debugging: You can try single-stepping through your script in Cheat Engine's debugger to see if the code execution proceeds as expected and identify any issues.

Game Updates: Keep in mind that game updates or anti-cheat measures can break your cheats. You may need to update your script to match the latest version of the game. If you've checked all these points and the script still doesn't work, you may need to delve deeper into reverse engineering and debugging to understand the game's code better.

_________________
LeFiXER wrote:
You probably should read the replies to make sure someone else hasn't already mentioned what you are about to say. It gives the impression that you are ignorant of other members in this community.
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4711

PostPosted: Mon Oct 30, 2023 9:55 am    Post subject: Reply with quote

Are you using the VEH debugger? The thread probably finishes executing the code before the VEH debugger notices the thread exists. The windows debugger doesn't have this problem.

Do you know what calling convention the function uses? e.g. stdcall, cdecl...
`add ecx,04` is weird to have just before the call. ecx is typically a volatile register- there's no point to modify it before a call unless it's a parameter. Could be thiscall or fastcall.

I'd look at the function itself and see what it uses. Maybe check for globals too. You can't get the full story by just looking at a call to the function.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
BirchTree
How do I cheat?
Reputation: 0

Joined: 30 Oct 2023
Posts: 3

PostPosted: Mon Oct 30, 2023 10:53 am    Post subject: Reply with quote

ParkourPenguin wrote:

Are you using the VEH debugger? The thread probably finishes executing the code before the VEH debugger notices the thread exists. The windows debugger doesn't have this problem.

Yes, unfortunately the game detects the windows debugger. Is there any way I can make the breakpoint work with the VEH debugger?


Famine wrote:

Calling Convention: Confirm that the function Game.exe+42A210 uses the same calling convention as your script. The calling convention determines how function parameters are passed and how the stack is cleaned up after the call. If it's not a standard calling convention, you may need to adapt your script.


ParkourPenguin wrote:

Do you know what calling convention the function uses? e.g. stdcall, cdecl...


I have no idea.
This is the function that I want to call:
Code:
push ebx
push esi
mov esi,ecx
cmp dword ptr [esi+00008134],00
push edi
setne bl
test bl,bl
je Game.exe+42A230
lea eax,[esi+00008138]
push eax
call dword ptr [Game.exe+9AA234]
mov ecx,[esp+28]
mov edx,[esp+24]
mov edi,[esp+20]
mov eax,[esp+1C]
push ecx
mov ecx,[esp+1C]
push edx
mov edx,[esp+1C]
push edi
push eax
mov eax,[esp+20]
push ecx
push edx
push eax
lea ecx,[esi+08]
call Game.exe+411FF0
push eax
push edi
mov ecx,esi
call Game.exe+429E10
mov [esp+28],al
test bl,bl
je Game.exe+42A27D
add esi,00008138
push esi
call dword ptr [Game.exe+9AA238]
mov al,[esp+28]
pop edi
pop esi
pop ebx
ret 001C

Does this have any hints on what are its calling conventions?

Famine wrote:

Code Flow: Check if there are any conditional branches or other code that could prevent the function from being called. The original assembly code might be part of a larger context that you're not replicating in your script.

You mean from previous functions?
The caller function I pasted in the OP is called by other functions, could something from them be required to call this function?

Famine wrote:

Memory Permissions: Make sure that the memory areas you're trying to modify or execute code in have the necessary read, write, and execute permissions. Some parts of the game's memory may be protected, and you might need to use additional techniques to modify them.

Thread Handling: Your script creates a new thread to execute the code. Make sure this is the intended behavior in the game. Some games may not support or allow external threads to interact with their code.

If I try some simple instructions like just moving a value to an address in the auto assembler, it works. So I assume this is not the issue.

If I was using the Windows debugger, would it have at least triggered the breakpoint even if the calling was wrong? Because if so, I believe fixing this would make any further problem solving a lot easier.
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4711

PostPosted: Mon Oct 30, 2023 11:22 am    Post subject: Reply with quote

BirchTree wrote:
Is there any way I can make the breakpoint work with the VEH debugger?
I don't know enough about the VEH debugger to answer that properly. Maybe sleeping for a second at the beginning of the thread would work?
Code:
push #1000
call kernel32.Sleep
...

BirchTree wrote:
Code:
...
mov esi,ecx  // ecx is definitely a parameter
...
ret 001C  // callee clean up
Probably thiscall
Anyway ecx is a parameter and you have to set it properly before calling the function

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
BirchTree
How do I cheat?
Reputation: 0

Joined: 30 Oct 2023
Posts: 3

PostPosted: Mon Oct 30, 2023 6:05 pm    Post subject: Reply with quote

ParkourPenguin wrote:
BirchTree wrote:
Is there any way I can make the breakpoint work with the VEH debugger?
I don't know enough about the VEH debugger to answer that properly. Maybe sleeping for a second at the beginning of the thread would work?
Code:
push #1000
call kernel32.Sleep
...

BirchTree wrote:
Code:
...
mov esi,ecx  // ecx is definitely a parameter
...
ret 001C  // callee clean up
Probably thiscall
Anyway ecx is a parameter and you have to set it properly before calling the function


Sorry it took so long for me to respond, I just got around to trying your suggestions now. But thank you very much for your help (yours too, Famine), it really was something as simple as setting up ecx.
Unfortunately I could not make the breakpoint work by sleeping which would've been useful for debugging but I can work with that.
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4711

PostPosted: Mon Oct 30, 2023 6:45 pm    Post subject: Reply with quote

Might need to wait longer
https://forum.cheatengine.org/viewtopic.php?p=5694129#5694129

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites