| View previous topic :: View next topic |
| Author |
Message |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Tue Aug 09, 2011 11:31 am Post subject: Help on hacking Assassin's Creed Brotherhood |
|
|
| hi there, i normally make codes for the games myself, but there's this one game that has a really tricky address, the knives address in the game mentioned above. I found the address of the knives value, 100% authentic, but the problem is, when i tried to increase the value, for example, the original amount of knives i have is 5, to an amount of 10, after i used finish the 5 i initially had, when i try to use till the 6th, it will crash the game immediately. Anyone has any ideas how to solve this problem? Help appreciated.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Aug 10, 2011 2:51 am Post subject: |
|
|
You can read here http://forum.cheatengine.org/viewtopic.php?p=5216239#5216239. That was a long battle.
First infinite knives codes were simple. But buggy (disappearing sword, etc). Then I fixed this with "mov al,5 ". Still, there were bugs. Then I made huge script, it was slow, but working.
Then I made this (cons? no more ):
| Code: | [ENABLE]
alloc(MyScript,128)
label(MyScript_part2)
label(returnhere1)
label(returnhere2)
label(exit1)
label(exit2)
aobscan(RetCheck, 85 C0 74 15 8B 10 8B C8 8B 42 38 56) //searching knives retcheck
aobscan(code1 , 0F B7 51 0A xx xx xx xx xx xx xx xx xx 8B C8 8D 14 91 56) //searching knives address
aobscan(code2 ,74 0D xx xx xx xx xx xx 48 FF D0 5D C2 04 00 33 C0 5D C2 04 00)//Knives quantity hack
label(KniveAddress)
MyScript:
cmp [ebp+04],RetCheck
jne short exit1
test ebx,ebx
je short exit1
mov eax,[ecx+04]
mov eax,[eax+20]
mov [KniveAddress],eax
exit1:
mov eax,[ecx+04] //original
and edx,00003FFF //original
jmp returnhere1
MyScript_part2:
mov edx,[eax] //original
mov ecx,eax //original
mov eax,[edx+48] //original
cmp ecx,[KniveAddress] //dealing with knives ??
jne short exit2
//"call eax" replacement
mov eax,5
pop ebp
ret 004
exit2:
jmp returnhere2
KniveAddress:
dd 00
code1+4://searching knives address
jmp MyScript
db 90 90 90 90
returnhere1:
code2+2://Knives quantity hack
jmp MyScript_part2
nop
db 48
returnhere2:
[DISABLE]
dealloc(MyScript)
aobscan(code1, 0F B7 51 0A xx xx xx xx xx xx xx xx xx 8B C8 8D 14 91 56)
code1+4:
mov eax,[ecx+04]
and edx,00003FFF
aobscan(code2, 74 0D xx xx xx xx xx xx 48 FF D0 5D C2 04 00 33 C0 5D C2 04 00)
code2+2:
mov edx,[eax]
mov ecx,eax
mov eax,[edx+48] |
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Aug 11, 2011 1:54 am Post subject: |
|
|
| does your script work against the check that was used in the game? it's sort of like comparing the knives value against some other address, if the game calculates that your knives value has already reached zero, but you changed the value via cheat engine, it will immediately crash when u try to use the extra knives that you have just given yourself...
|
|
| Back to top |
|
 |
SwaggaJackin' Master Cheater
Reputation: 2
Joined: 06 Nov 2009 Posts: 312
|
Posted: Thu Aug 11, 2011 2:30 am Post subject: |
|
|
| lalala1990 wrote: | | does your script work against the check that was used in the game? it's sort of like comparing the knives value against some other address, if the game calculates that your knives value has already reached zero, but you changed the value via cheat engine, it will immediately crash when u try to use the extra knives that you have just given yourself... |
Does it use windows live? You need to bypass the CRC check then.
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Thu Aug 11, 2011 4:04 am Post subject: |
|
|
This game is not using live.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Aug 11, 2011 5:03 am Post subject: |
|
|
i realised something, the address that i hooked to is the opcode writing the address, while there's another opcode that is accessing the address, and the crash is caused by the accessing address. now if i use the accessing address to change the value instead, it is all good... thanks for all your help!
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Sun Aug 14, 2011 4:41 am Post subject: |
|
|
| lalala1990 wrote: | now if i use the accessing address to change the value instead, it is all good... thanks for all your help! |
Ok. Try to buy items, dye clothing, etc.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Sun Aug 14, 2011 9:57 pm Post subject: |
|
|
i already tried that, it works perfectly
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Aug 15, 2011 9:15 am Post subject: |
|
|
Could you paste AA script?
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Tue Aug 16, 2011 1:46 am Post subject: |
|
|
| i overwrote it with another game's cheat table -_- but nevermind i will try to reproduce it. but first of all, can you tell me how to make it non-full screen? by using 3d ripper, it crashes so often.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Tue Aug 16, 2011 4:24 am Post subject: |
|
|
hmm that method crashes alot for me... when i try to use toggle breakpoint, after it breaks and i got the value i want, i removed the breakpoint and closed the viewer, when i go back to the game, either the camera gets stuck, or the whole game gets stuck.
EDIT:
ok after a lot of trouble i managed to come up with a script that's almost bugless... do help me test if there's any bugs with it
| Code: |
[ENABLE]
alloc(newmem,256)
label(returnAccess)
label(originalAccess)
label(infKnives)
label(debugKnives1)
registersymbol(infKnives)
registersymbol(debugKnives1)
"ACBSP.exe"+7EDED0:
jmp newmem
db 90 90 90 90
returnAccess:
newmem:
movzx eax,word ptr [ecx+1A]
cmp ecx,esi
je originalAccess
cmp word ptr [esp],6859
jne originalAccess
mov [debugKnives1],ecx
cmp [infKnives],1
jne originalAccess
movzx eax,byte ptr [ecx+02]
originalAccess:
and eax,00003FFF
jmp returnAccess
debugKnives1:
dd 0
infKnives:
dd 1
[DISABLE]
"ACBSP.exe"+7EDED0:
movzx eax,word ptr [ecx+1A]
and eax,00003FFF
unregistersymbol(debugKnives1)
unregistersymbol(infKnives)
dealloc(newmem)
|
this script ignores your maximum allowed knives and automatically sets it to 19.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Tue Aug 16, 2011 8:53 am Post subject: |
|
|
You are sure about this thing?
| Code: | | cmp word ptr [esp],6859 |
ESP - extended stack pointer register.
And this:
| Code: | | movzx eax,byte ptr [ecx+02] |
Why?
_________________
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 473
Joined: 09 May 2003 Posts: 25909 Location: The netherlands
|
Posted: Tue Aug 16, 2011 9:06 am Post subject: |
|
|
esp thing:
if the hook is done at a spot with no stackframe setup yet (so no pushes) this routine can be used to find out if the function was called from a specific address (or else if it contains the pushed address of a function table it's useful as well)
And word would be used to deal with the exe/dll address randomization
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Tue Aug 16, 2011 9:48 am Post subject: |
|
|
Nevermind. He has different AC:B version. For me, it would be
"cmp word ptr [esp],6639"
"cmp ecx,esi and je" isn't necessary (no difference if you use this or not)
But this "movzx eax,byte ptr [ecx+02]" sets 76 knives for me, for him 19. This would be better: "xor eax,eax; mov al,5" (or "mov eax,5").
| Code: | newmem:
movzx eax,word ptr [ecx+1A]
cmp word ptr [esp],6859
jne originalAccess
mov [debugKnives1],ecx
cmp [infKnives],1
jne originalAccess
////movzx eax,word ptr [ecx+1A] // debug purpose (try "find out what addresses this instruction accesses")
mov eax,5
originalAccess:
and eax,00003FFF
jmp returnAccess |
_________________
|
|
| Back to top |
|
 |
|