View previous topic :: View next topic |
Author |
Message |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Thu Jan 17, 2013 2:17 am Post subject: Freeze Interval |
|
|
Setting freeze interval to 1 ms isn't fast enough. When I freeze my Y coordinate, my results aren't 100%. I know it's working, because I can float over objects...but the animation for my character flickers and I am sometimes brought back to the ground.
Any ideas on how to remedy this?
Thanks.
EDIT: and I slowly fall to the ground and can run around until I interact with something - which puts me back in to the air...where I slowly fall back to the ground. The only way I can avoid hitting things is by setting my values high enough so that I am way above everything.
|
|
Back to top |
|
 |
thenibble Newbie cheater
Reputation: 0
Joined: 30 Nov 2010 Posts: 22
|
Posted: Thu Jan 17, 2013 3:36 am Post subject: |
|
|
sounds like there is a routine that is rewriting the actual value of the y coordinate. freezing the value will usually cause the character or the camera to flicker. simply attach the debugger to the address of the y coord and see where it is being rewritten. from there you can either nop the opcode if possible, or you can inject your own code where you can write your own coord value
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Thu Jan 17, 2013 11:01 am Post subject: |
|
|
Thanks. Yeah, that is what I am trying to do now. Unfortunately, I can't seem to find much documentation on how to alter the assembly in my favor. So far, nop'ing everything has not worked.
It is true, something is rewriting the value of the Y coordinate because there are times that it changes rapidly. Sometimes, when I jump, it will stop changing once I am back on the ground.
EDIT:
When I select 'Find what writes the address pointed at by this pointer', I get three results:
Code: | 0050352C - F3 0F10 48 38 - movss xmm1,[eax+38]
00503531 - 66 0F5A C0 - cvtpd2ps xmm0,xmm0
00503535 - F3 0F11 40 34 - movss [eax+34],xmm0 <<
0050353A - F3 0F10 41 08 - movss xmm0,[ecx+08]
0050353F - 0F5A C0 - cvtps2pd xmm0,xmm0 |
Code: | 004DD414 - F3 0F10 48 08 - movss xmm1,[eax+08]
004DD419 - D9 59 30 - fstp dword ptr [ecx+30]
004DD41C - F3 0F11 41 34 - movss [ecx+34],xmm0 <<
004DD421 - F3 0F11 49 38 - movss [ecx+38],xmm1
004DD426 - C3 - ret |
Code: | 006085B3 - FF D2 - call edx
006085B5 - DC 6C 24 10 - fsubr qword ptr [esp+10]
006085B9 - D9 5F 34 - fstp dword ptr [edi+34] <<
006085BC - 8B 8C 24 24040000 - mov ecx,[esp+00000424]
006085C3 - 5F - pop edi |
Here is a look at the third result in memory viewer:
Code: | FGUY.exe+2085B9 - D9 5F 34 - fstp dword ptr [edi+34]
FGUY.exe+2085BC - 8B 8C 24 24040000 - mov ecx,[esp+00000424]
FGUY.exe+2085C3 - 5F - pop edi
FGUY.exe+2085C4 - 64 89 0D 00000000 - mov fs:[00000000],ecx
FGUY.exe+2085CB - 5E - pop esi
FGUY.exe+2085CC - 8B E5 - mov esp,ebp
FGUY.exe+2085CE - 5D - pop ebp
FGUY.exe+2085CF - C2 0400 - ret 0004 |
If I nop the following line, from the result above, I can jump twice as high:
FGUY.exe+2085B9 - D9 5F 34 - fstp dword ptr [edi+34]
How can I manipulate this to jump higher?
Thanks.
EDIT:
Alright, I've managed to get Stewie floating like he should. For some reason, it wasn't working before...or maybe I overlooked something.
Now I just need to figure out how to write the code that will allow me to rapidly increment and decrement while certain buttons are pressed.
Can someone point me in the right direction?
Thanks.
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Thu Jan 17, 2013 9:20 pm Post subject: |
|
|
Anyone?
|
|
Back to top |
|
 |
happyreadygo Advanced Cheater
Reputation: 1
Joined: 14 Sep 2011 Posts: 87
|
Posted: Fri Jan 18, 2013 3:30 am Post subject: |
|
|
Quote: | Now I just need to figure out how to write the code that will allow me to rapidly increment and decrement while certain buttons are pressed.
Can someone point me in the right direction? |
you mean the buttons in the game? if yes.
you should using the code injection funtion in CE.
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Jan 18, 2013 12:36 pm Post subject: |
|
|
Yes. I am using a Logitech Rumblepad II controller with Xbox360 controller emulation to play the game. I have found the values for the two controller buttons that I want to use for the cheat, and realize that injecting code is probably the way to go...I just don't know how to properly do it. When I try to set up an auto-assembly script, I keep getting errors. Every example that I find online does not fully explain what I should be doing.
Thanks.
|
|
Back to top |
|
 |
happyreadygo Advanced Cheater
Reputation: 1
Joined: 14 Sep 2011 Posts: 87
|
Posted: Fri Jan 18, 2013 8:52 pm Post subject: |
|
|
Here is my unlimit ammo function..
you have to be careful about what's in [[..]] . if something wrong ,it won't work at all. maybe not even error shown.
if you have any more problem you can ask..
Code: | function unlimitammo()
if readInteger(0x00641d30)==nil then openProcess("ZombieShooter2.exe")end
if readInteger(0x00641d30)==nil then gamenotfound() return end
unlimitAmmoString=[[
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
label(freezeammo)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
cmp eax,0
jnge freezeammo
originalcode:
add [ebx+40],eax
mov eax,[ebx+40]
jmp exit
freezeammo:
sub [ebx+40],eax
mov eax,[ebx+40]
exit:
jmp returnhere
"ZombieShooter2.exe"+AF3BE:
jmp newmem
nop
returnhere:
]]
autoAssemble(unlimitAmmoString)
end |
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Jan 18, 2013 9:55 pm Post subject: |
|
|
Thanks, but I can't see that this really applies to my situation. Maybe I am overlooking something?
|
|
Back to top |
|
 |
happyreadygo Advanced Cheater
Reputation: 1
Joined: 14 Sep 2011 Posts: 87
|
Posted: Fri Jan 18, 2013 10:00 pm Post subject: |
|
|
Can you show me more detail about your case? . your AA code
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Jan 18, 2013 10:11 pm Post subject: |
|
|
I can't post URL's yet, but here is a post I made from another thread regarding my progress:
I have three parts that I need to create. I am having trouble figuring out how to write the code for the auto-assembly and/or how to create a proper codecave that will do what I need.
I am using a Logitech Rumblepad II controller with Xbox360 controller emulation to play the game. I have found the values for the two controller buttons that I want to use for the cheat, and realize that injecting code is probably the way to go...I just don't know how to properly do it. When I try to set up an auto-assembly script, I keep getting errors. Every example that I find online does not fully explain what I should be doing.
The first part of the cheat that I need to create will enable/disable the cheat by nop'ing 5 lines of code (and vice verca). The second and third part of the cheat will increment and decrement the Y value when a controller button is pressed.
Can anyone help me with this?
Thanks.
EDIT: I have managed to get the auto-assemble injection to enable the change, but I cannot seem to disable the cheat and return the code to its original form.
Where am I going wrong (I receive the message, not all instructions could be injected):
Code:
Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
originalcode:
movss [eax+34],xmm0
newmem:
nop
nop
nop
nop
nop
exit:
jmp returnhere
"FGUY.exe"+103535:
jmp newmem
returnhere:
[DISABLE]
dealloc(newmem)
"FGUY.exe"+103535:
movss [eax+34],xmm0 |
|
|
Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Fri Jan 18, 2013 10:13 pm Post subject: |
|
|
Quote: | you have to be careful about what's in [[..]] |
@happyreadygo
Code: | (...)
(...)
local isAutoAssembled= autoAssemble(unlimitAmmoString)
if not isAutoAssembled then print('wrong script') end
|
_________________
|
|
Back to top |
|
 |
happyreadygo Advanced Cheater
Reputation: 1
Joined: 14 Sep 2011 Posts: 87
|
Posted: Fri Jan 18, 2013 10:44 pm Post subject: |
|
|
mgr.inz.Player
Thanks .
Code: | originalcode:
movss [eax+34],xmm0
newmem:
nop
nop
nop
nop
nop |
you needs to comment out the line, else your aa is not doing anything at all. so it's got error.
Code: | originalcode:
//movss [eax+34],xmm0 |
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Jan 18, 2013 11:06 pm Post subject: |
|
|
So, where it says "originalcode:", I don't actually place the original code under this line?
Thanks.
|
|
Back to top |
|
 |
happyreadygo Advanced Cheater
Reputation: 1
Joined: 14 Sep 2011 Posts: 87
|
Posted: Fri Jan 18, 2013 11:19 pm Post subject: |
|
|
you can place codes under originalcode: but make sure that the result is what you want.. since it ll run both original part and new part..
in your case , u want to disable original part , right? and your new part is blank..
|
|
Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Fri Jan 18, 2013 11:51 pm Post subject: |
|
|
I don't understand why that works, but it does. When I first generated the AA, the code read like this:
originalcode:
movss [eax+34],xmm0
Now, I have it like this:
originalcode:
//movss [eax+34],xmm0
and it works...
Thanks.
Now I need to be able to enable/disable the above AA if a certain controller button is pressed. Is there something that can be written like so:
If value at controller address is 222, enable AA script. If value at controller address is 333, disable AA script.
I have found the address for the controller value, but it is tied to a .dll, and I can't seem to do any auto-assembly to it.
Here is the line for the controller value, when I search for what accesses this address, I get this:
Code: | dinput8.dll+99D0 - 88 18 - mov [eax],bl |
If I nop this line to test, then pressing the controller button does nothing.
|
|
Back to top |
|
 |
|