View previous topic :: View next topic |
Author |
Message |
KimochiYikes How do I cheat? Reputation: 0
Joined: 26 Dec 2023 Posts: 3
|
Posted: Tue Dec 26, 2023 12:06 pm Post subject: createthread ret op command crashes the game |
|
|
Hi, I was testing createthread on simple commands to add a number. In the end I decided to use the same function the game uses (it uses a special class to store currency).
Enabling the script works as expected, it adds 1000 each second. The problem however is when I turn it off, the game crashes. It still works when I remove the whole first call (the function isn't too complicated nor is it a loop and uses some other simple two sub-functions).
What is interesting though is that sleep before ret doesn't immediately crash the game, which I suspect is my problem. I am not sure how to debug it---
Code: |
[ENABLE]
globalalloc(mycode,100)
createthread(mycode)
label(closethread)
mycode:
push 01 // Flag2
push 00 // Flag1
push 00000000 // Add value (int64 pair)
push #1000 // Add value (int64 pair)
push 00F781E0 // Class address
call 006D26E0
push #1000
call sleep
cmp [closethread], 00
je mycode
// This sleep function keeps the game alive for a few seconds
push #5000
call sleep
ret
// But this "ret" pretty much kills the game
closethread:
db 00
[DISABLE]
closethread:
db 01 |
The game uses an x86 architecture.
Any help would be appreciated
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4307
|
Posted: Tue Dec 26, 2023 12:29 pm Post subject: |
|
|
KimochiYikes wrote: | The problem however is when I turn it off, the game crashes. It still works when I remove the whole first call | Does it work or does it crash? Maybe it's cdecl instead of stdcall and you're screwing up the stack
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
KimochiYikes How do I cheat? Reputation: 0
Joined: 26 Dec 2023 Posts: 3
|
Posted: Tue Dec 26, 2023 2:40 pm Post subject: |
|
|
ParkourPenguin wrote: | Maybe it's cdecl instead of stdcall and you're screwing up the stack |
IDA identifies it as cdecl. I figured to add 0x14 (because of 5 pushes) to the stack pointer after the call is done. Guess I didn't knew how to call it properly.
Thanks for mentioning it. It seems to be working just fine with it.
Is it safe to let it add to esp forever though? Do old stacks get reset or memory freed? Wouldn't want to let it do an infinite garbage stack growth...
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4307
|
Posted: Tue Dec 26, 2023 3:23 pm Post subject: |
|
|
Stacks grow downwards in memory. When you push values onto the stack, you increase the stack size by 4 bytes and subtract 4 from esp. Removing items from the stack entails adding to esp. Specifically, adding 0x14 to esp after the call removes all the items you pushed onto it. `add esp,14` keeps the stack balanced.
"Infinite garbage stack growth" is what you were doing- just pushing values onto the stack endlessly without ever cleaning them up.
When the `ret` instruction is executed, it's suppose to pop the return address from the stack that a `call` instruction pushed on the stack; instead, it pops the garbage you left on the stack and tries to jump there. This is obviously bad.
This doesn't apply to `sleep`. `sleep` is stdcall- a callee-cleanup calling convention. The function being called cleans up the arguments. No need for you to worry about it.
(in 64-bit code, values on the stack are 8 bytes, not 4)
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
KimochiYikes How do I cheat? Reputation: 0
Joined: 26 Dec 2023 Posts: 3
|
Posted: Tue Dec 26, 2023 3:59 pm Post subject: |
|
|
Thanks for pointing it out, that should be plenty for me to go on from!
|
|
Back to top |
|
|
|