Twistedfate Expert Cheater Reputation: 1
Joined: 11 Mar 2016 Posts: 231
|
Posted: Thu Nov 23, 2017 12:52 pm Post subject: Asm how to Check if address is valid or still under write ? |
|
|
lets say
[esi+1a0] contain 3 monsters names:
monster A
monster B
monster C
If monster A,B,C in my screen they will moved to 3 addresses :
address 1
address 2
address 3
If monster A leaved my screen the address 1 will not change and will stay in my memory ...
in the same time it will not be in [esi+1a0] .
I want to check if address one is still under write by [esi+1a0] or not .
Using AA.
all I want to do to check if the monster is in my screen or not .
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1587
|
Posted: Thu Nov 23, 2017 5:40 pm Post subject: |
|
|
Twistedfate wrote: | If monster A leaved my screen the address 1 will not change and will stay in my memory ...
in the same time it will not be in [esi+1a0] |
if this code didnt work then compare it with the value of monsterA, because something must change whether the address or value or something related to monsterA.
this is good if monsters b and c addresses got changed ..
Code: | {just a quick example, very similar to your request .. but it depends on you whether you want to make some action when condition is hit or not}
[ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
globalalloc(CEtut,04)
newmem:
originalcode:
mov [ebx+00000480],eax // original instruction - imagine its your hooked instruction
push edx
push ecx
lea ecx,[ebx+480] // loading the current address
lea edx,[[[[[["Tutorial-i386.exe"+001506E0]+584]+248]+c]+11c]+6c0] // assume its monsterA address (you have to pointer scan it)
cmp ecx,edx // compare if monsterA pointer address is equal to [ebx+480]
cmove eax,[CEtut] // if its equal then move 100 into there
mov [ebx+480],eax // otherwise the original instruction will repeat itself which will result nothing new
pop ecx
pop edx
exit:
jmp returnhere
CEtut:
db 64
"Tutorial-i386.exe"+23B80:
jmp newmem
nop
returnhere:
[DISABLE]
dealloc(newmem)
"Tutorial-i386.exe"+23B80:
mov [ebx+00000480],eax |
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|