kgbfbi How do I cheat?
Reputation: 0
Joined: 07 Dec 2016 Posts: 5
|
Posted: Sun Jun 28, 2026 7:07 am Post subject: Bug in C code injection within Cheat Engine |
|
|
I found a bug in C code injection today.
For example, this code:
{$ccode}
extern int x;
extern int y;
extern int z1;
extern int z2;
extern int z3;
extern int z4;
extern int z5;
extern int z6;
extern int z7;
extern int z8;
z1 = x + y;
z2 = y + x;
z3 = x - y;
z4 = y - x;
z5 = x * y;
z6 = y * x;
z7 = x / y;
z8 = y / x;
{asm}
x:
dd 4
y:
dd 2
z1:
dd 00
z2:
dd 00
z3:
dd 00
z4:
dd 00
z5:
dd 00
z6:
dd 00
z7:
dd 00
z8:
dd 00
Everything works correctly when running.
However, when switching to float type:
{ccode}
extern float x;
extern float y;
extern float z1;
extern float z2;
extern float z3;
extern float z4;
extern float z5;
extern float z6;
extern float z7;
extern float z8;
z1 = x + y;
z2 = y + x;
z3 = x - y;
z4 = y - x;
z5 = x * y;
z6 = y * x;
z7 = x / y;
z8 = y / x;
{asm}
All calculation results are incorrect.
For instance:
z1 = x + y is supposed to equal 6
z1 = y + x should also equal 6
But the actual outputs are 4 and 2 respectively. This means the right-hand operand is not involved in calculations at all. The same issue occurs with double type.
The identical error exists under 64-bit mode, except the outputs become the address pointers of the left operands instead.
Nevertheless, the problem is fixed and results become accurate after adding two lines of code to copy values to local variables and perform calculations with them:
float a=x;
float b=y;
z1 = a + b;
z2 = b + a;
z3 = a - b;
z4 = b - a;
z5 = a * b;
z6 = b * a;
z7 = a / b;
z8 = b / a;
I cannot tell for sure whether I missed key documentation details or this is a genuine bug. I shared this issue with multiple AIs including ChatGPT and Gemini, and all of them concluded this is a bug within TCC.
Therefore I am submitting this issue for the developer to investigate.
The CT file to reproduce this bug is attached.
Since I cannot upload the CT file for reproducing the bug, I have pasted the code below.
NO.1
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
{$ccode}
extern int x;
extern int y;
extern int z1;
extern int z2;
extern int z3;
extern int z4;
extern int z5;
extern int z6;
extern int z7;
extern int z8;
z1 = x + y;
z2 = y + x;
z3 = x - y;
z4 = y - x;
z5 = x * y;
z6 = y * x;
z7 = x / y;
z8 = y / x;
{$asm}
originalcode:
nop
mov esp,ebp
pop ebp
ret
exit:
jmp returnhere
x:
dd 4
y:
dd 2
z1:
dd 00
z2:
dd 00
z3:
dd 00
z4:
dd 00
z5:
dd 00
z6:
dd 00
z7:
dd 00
z8:
dd 00
"Tutorial-i386.exe"+7320F:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Tutorial-i386.exe"+7320F:
db 90 89 EC 5D C3
//nop
//mov esp,ebp
//pop ebp
//ret
NO.2
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
{$ccode}
extern float x;
extern float y;
extern float z1;
extern float z2;
extern float z3;
extern float z4;
extern float z5;
extern float z6;
extern float z7;
extern float z8;
z1 = x + y;
z2 = y + x;
z3 = x - y;
z4 = y - x;
z5 = x * y;
z6 = y * x;
z7 = x / y;
z8 = y / x;
{$asm}
originalcode:
nop
mov esp,ebp
pop ebp
ret
exit:
jmp returnhere
x:
dd (float)4
y:
dd (float)2
z1:
dd 00
z2:
dd 00
z3:
dd 00
z4:
dd 00
z5:
dd 00
z6:
dd 00
z7:
dd 00
z8:
dd 00
"Tutorial-i386.exe"+7320F:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Tutorial-i386.exe"+7320F:
db 90 89 EC 5D C3
//nop
//mov esp,ebp
//pop ebp
//ret
NO.3
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
{$ccode}
extern float x;
extern float y;
extern float z1;
extern float z2;
extern float z3;
extern float z4;
extern float z5;
extern float z6;
extern float z7;
extern float z8;
float a=x;
float b=y;
z1 = a + b;
z2 = b + a;
z3 = a - b;
z4 = b - a;
z5 = a * b;
z6 = b * a;
z7 = a / b;
z8 = b / a;
{$asm}
originalcode:
nop
mov esp,ebp
pop ebp
ret
exit:
jmp returnhere
x:
dd (float)4
y:
dd (float)2
z1:
dd 00
z2:
dd 00
z3:
dd 00
z4:
dd 00
z5:
dd 00
z6:
dd 00
z7:
dd 00
z8:
dd 00
"Tutorial-i386.exe"+7320F:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Tutorial-i386.exe"+7320F:
db 90 89 EC 5D C3
//nop
//mov esp,ebp
//pop ebp
//ret
|
|