 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Jul 17, 2013 1:12 pm Post subject: |
|
|
As you wish. It will be the same as first.
Code: | [ENABLE]
alloc(hack,1024)
label(retHere)
label(multiplyBy)
hack:
sub esp,10 // prepare space
movdqu [esp],xmm1 // store xmm1
movss xmm1,[multiplyBy] // get multiply factor
shufps xmm1,xmm1,00
// change deltas for [eax+30] [eax+34] and [eax+38]
movups xmm0,[esi+00000094] // get current delta
mulps xmm0,xmm1 // multiply delta by user factor
movss [esi+00000094],xmm0 // store new delta <= I CHANGED THIS (movq to movss)
// movhlps xmm0,xmm0 <= I CHANGED THIS (commented)
// movss [esi+0000009C],xmm0 <= I CHANGED THIS (commented)
movdqu xmm1,[esp] // restore xmm1
add esp,10
movss xmm0,[eax+30] //original code
jmp retHere
hack+100:
multiplyBy:
dd (float)1.001 // CHANGE THIS
Phys_x86.dll+1D7C48:
jmp hack
retHere:
[DISABLE]
Phys_x86.dll+1D7C48:
db F3 0F 10 40 30
dealloc(hack) |
And no, it affects other vehicles too. (maybe you don't see it, but that screenshot you gave proves it )
_________________
|
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Wed Jul 17, 2013 1:46 pm Post subject: |
|
|
@mgr.inz.Player
It did something! And the game hasn't freaked out (which is a big plus)
I have set the float value to 5.0 because the smaller ones weren't noticeable and now the vehicle changes speed so fast! I mean going from 90 to 0 in a sec (it normally just slows down, definetly not that fast) and to 90 again in a sec or less.
BUT it is not really speedhack because the vehicle still retains it's max speed limit (which is confusing :/ ) so this is altering how fast the speed variations are beind made but not the speed itself (?) or it is altering the speed increments but the max speed is unchanged.
My brain stopped working after that one, this is very strange.
Edit: Sorry I always quote when I shouldn't, quote removed.
Wait, nevermind, I just saw one vehicle spazzing out when I turned the script on and going back to normal when I turned it off, you are correct, that opcode is really affecting other vehicles which I might have missed because they render out and in of distance and when that happens the opcodes may or may not affect them.
Well this makes much more sense now... But why modifying the movss [eax+30],xmm0 only affects my vehicle and not the others?
|
|
Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Jul 17, 2013 1:56 pm Post subject: |
|
|
"it is altering the speed increments but the max speed is unchanged"
Yes, we changed acceleration (aka speed delta).
Now we can change above script that way:
- if delta is below 0, we don't do anything. normally slow down
- if delta is above 0, we multiply it by our factor.
- if delta is very close to zero (but still positive) and vehicle is still below our new buffed maximum speed limit, we change it to bigger value, otherwise, we just zero it.
_________________
|
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Wed Jul 17, 2013 2:07 pm Post subject: |
|
|
@mgr.inz.Player
But I am still left with the problem of filtering the delta for my own vehicle, which proves you were right.
I wonder if these 2 other opcodes that write to the velocity address have anything that can be changed to achieve this result.
Code: | jna Phys_x86.dll+132995
divss xmm3,xmm0
sqrtss xmm0,xmm3
movaps xmm3,xmm0
mulss xmm3,xmm4
movaps xmm4,xmm3
mulss xmm5,xmm0
mulss xmm2,xmm0
mov ecx,[edi-04]
mov edx,[ebp-04]
push ecx
movss [eax+20],xmm7 <-- This one writes to velocity address NS
movss [eax+24],xmm1 <-- This one writes to velocity address UD (up/down)
movss [eax+28],xmm6 <-- This one writes to velocity address WE
|
Code: | jb Phys_x86.dll+139803
mov edi,edx
mov edx,[ebp-10]
fld dword ptr [esi-18]
mov edx,[eax+edx*4]
mov edx,[edx+48]
prefetchto [edx]
prefetchto [edx+00000080]
mov edx,[eax+edi*4]
prefetchto [edx]
prefetchto [edx+00000080]
prefetchto [esi+000000E8]
prefetchto [ebx+00000198]
mov edx,[ebp-04]
prefetchto [edx+eax+00000080]
lea eax,[edx+eax+00000080]
mov eax,[ecx+48]
fstp dword ptr [eax+20] <-- This one writes to velocity address NS
fld dword ptr [esi-14]
fstp dword ptr [eax+24] <-- This one writes to velocity address UD (up/down)
fld dword ptr [esi-10]
fstp dword ptr [eax+28] <-- This one writes to velocity address WE
|
Might be a long shot but they write to the velocity addresses.
|
|
Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Jul 17, 2013 2:20 pm Post subject: |
|
|
Right click on this opcode, and test how many addresses it access.
movss [eax+20],xmm7
_________________
|
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Wed Jul 17, 2013 2:32 pm Post subject: |
|
|
I see, that is something I should have done already, will do it right away for that one and the other fstp aswell.
Also I modified the script to change
Code: | movss xmm0,[esi+00000098] <- this delta
addss xmm0,[eax+34]
movss [eax+34],xmm0 |
And it didn't affect any vehicles so far besides my own, sadly it crashed when I disabled the script (I think I might have made a mistake while replacing the addresses in there and it breaks the code when I disable)
--------------
For movss [eax+20],xmm7:
0 Addresses are accessed
For fstp dword ptr [eax+20]:
57 Addresses are accessed
So this means that they are of no use :/
|
|
Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Jul 17, 2013 3:23 pm Post subject: |
|
|
I repeat myself: take your time.
Read about "shared code" and "structure dissect".
_________________
|
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Wed Jul 17, 2013 5:30 pm Post subject: |
|
|
mgr.inz.Player wrote: | I repeat myself: take your time.
Read about "shared code" and "structure dissect". |
Yeah, I have been until now and still no luck, will keep working on it.
In the mean time, I tried your limiter and even added the label as it should but for some reason it is ignoring any float limit that I place, what am I doing wrong?
Code: | [ENABLE]
//Speedhack
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(donotadjust)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
sub esp,04
mov [esp],(float)1.015
mulss xmm0,[esp]
add esp,04
movss [eax+30],xmm0
cmp dword ptr [eax+30],(float)125.00
jb donotadjust
mov dword ptr [eax+30],(float)125.00
donotadjust:
originalcode:
movss [eax+30],xmm0
exit:
jmp returnhere
"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F 11 86 C8 00 00 00 |
Hmm, as far as I know cmp dword ptr [eax+30],(float)125.00 is checking if the 4 bytes in eax+30 are equal to float125.00 before it can jump below, the problem seems to be that the 4 bytes never get to 125.00, instead they either go from 120 to 132 without crossing 125, rendering this line useless, what might be the opcode that checks if the 4 bytes are greater than?
|
|
Back to top |
|
 |
daspamer Grandmaster Cheater Supreme
Reputation: 54
Joined: 13 Sep 2011 Posts: 1588
|
Posted: Wed Jul 17, 2013 7:17 pm Post subject: |
|
|
Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem:
cmp dword ptr [eax+30],(float)125.00
jb originalcode
mov dword ptr [eax+30],(float)125.00
jmp exit
originalcode:
sub esp,04
mov [esp],(float)1.015
mulss xmm0,[esp]
add esp,04
movss [eax+30],xmm0
jmp exit
exit:
jmp returnhere
"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F 11 86 C8 00 00 00 |
Labels are memory regions,
Who can point from region to region, but if you don't point, they will continue to the next region under them.
So basically your mistake was,
You've multiplied the speed and set the value already in the address (you put the speed modifier and the original code at the top) and then only compare.
After that you compare the address with the value of 125 float, so if its equal or above, it'll keep the speed at 125, if its not, let it to increase.
_________________
I'm rusty and getting older, help me re-learn lua. |
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Wed Jul 17, 2013 7:49 pm Post subject: |
|
|
@DaSpammer
That works 50% well! I guess it's my fault that I didn't mention the velocity also reaches negative values (when the vehicle is going South) and when I use your fix during the negative driving it will instantly set 125.
So if I am with 35 speed heading south, speed is -35. If I activate that script at that moment, -35 becomes 125.
Also it is making all vehicles fly towards north at the same time.
|
|
Back to top |
|
 |
daspamer Grandmaster Cheater Supreme
Reputation: 54
Joined: 13 Sep 2011 Posts: 1588
|
Posted: Wed Jul 17, 2013 7:53 pm Post subject: |
|
|
Edit:
Wait, your speed is below 0, and it goes to 125 instantly,strange.
__________________________________________________________
Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(below)
label(exit)
newmem:
cmp dword ptr [eax+30],(float)0.00
jle originalcode
cmp dword ptr [eax+30],(float)125.00
jb below
mov dword ptr [eax+30],(float)125.00
jmp exit
below:
sub esp,04
mov [esp],(float)1.015
mulss xmm0,[esp]
add esp,04
jmp originalcode
originalcode:
movss [eax+30],xmm0
jmp exit
exit:
jmp returnhere
"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F 11 86 C8 00 00 00 |
_________________
I'm rusty and getting older, help me re-learn lua. |
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Wed Jul 17, 2013 8:13 pm Post subject: |
|
|
It's almost perfect! Now it sets the limit right when it is going North and doesn't auto set when going south BUT it also doesn't seem to do anything now when going south, the velocity remains unchanged when the limit is breached.
I watch the velocity changing when I go north and once I reach the 125 it sits there perfectly still at 125 but when I go south and it reaches -125 it doesn't stay there, it just increases to -130 and so forth.
EDIT: I think that is because the function is jumping to the original code when the limite is lower or equal to 0 so it is not setting any negative limit like the positive limit is.
Should it be
Code: | cmp dword ptr [eax+30],(float)0.00
jle lowerlimit
lowerlimit:
mov dword ptr [eax+30],(float)-25.00
jmp exit |
?
edit: I tried my lowerlimit idea but it just crashed the game
Edit: I did it! here is the result
Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(lowerlimit)
label(below)
label(exit)
newmem:
cmp dword ptr [eax+30],(float)0.00
jle lowerlimit
cmp dword ptr [eax+30],(float)25.00
jb below
mov dword ptr [eax+30],(float)25.00
jmp exit
lowerlimit:
cmp dword ptr [eax+30],(float)-25.00
jb below
mov dword ptr [eax+30],(float)-25.00
jmp exit
below:
sub esp,04
mov [esp],(float)1.015
mulss xmm0,[esp]
add esp,04
jmp originalcode
originalcode:
movss [eax+30],xmm0
jmp exit
exit:
jmp returnhere
"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F 11 86 C8 00 00 00 |
Thanks!
|
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Thu Jul 18, 2013 3:43 pm Post subject: |
|
|
Well I have been doing what you said, trying to find the id and stuff like that, re-read the scrutcture dissection lots of times and did as it suggested, read the shared code too.
Nothing worth using was found, no ID's or things like those, all the vehicles share the same structure or stack sperated by symmetric distances and they all hold the same fields (velocity, position, etc).
I did find out that the addresses for my vehicle writen by that opcode usually stand in the last place when they are sorted and I say "usually" because I have yet to see them elsewhere beside's the last row. Don't know what I could do with this because I already have the pointers for each of those addresses.
I also tried to find the address for the increment value that is specific to my vehicle (?) but I couldn't find anything worth using, modified every single value from all the addresses written by, accessed by and the respective eax and esi (yes I even went after the esi) but none of those changed a thing when I moved, they are probably just placeholders for other things which I know nothing of.
And this is it, what I am left with is mgr.inz.Player's first idea, DaSpamer's great fix and a lot of new things I learned.
Regarding the code + DaSpammer's fix, it works great, the limits activate perfectly well when they are reached and they work for negative and positive values as intended.
Now my problem is that these are vectors (like mgr.inzPlayer said) and they will add up even when one or two limits are reached, let's say I am going north at 25 (25 being my limit) west or south still haven't reached the limit so they start adding up until they reach the limit, same goes for the height speed. I end up moving in spatial diagonals when all 3 reach the limit which is kinda hard to maneouver (can't do it at all actually).
What I would like to do now is to sum the 3 vectors (their modules so no negative value subtracts the positive values), verify if the total scalar velocity is 25 or above and then act accordingly: If it is above 25 then block that limit, if it is below the limit then let it work as normal.
But this might be very complicated to do with assembly, I think, so I understand if no one wants to give a hand with this.
Basically this is what I would like to do:
Limit check:
->Check if X Y or Z have negative symbol and store for later
Sum the modules of X Y and Z velocities
Compare the above sum result to the limit
If the sum is above or equal to the limit then lock it
If it is not then do nothing
Proportional speed multiplier:
Sum the modules X Y and Z velocities
Compare the X Y and Z to the sum and return a percentage for each one
Multiply the speed multiplier with the percentage returned for each axis
Replace each velocity with the respective speed multiplier
->And this is where the negative symbol is used on the respective axis if one was present.
Hope this isn't too confusing. Can I use math operations mixed with assembly code? X+Y=123 and so on?
EDIT: Better to elaborate on what I said
Code: |
My speed limit is:
SL = 125.00
My multiplier is:
m = 1.05
Current velocitiy values are:
X = 25.00
Y = -2.00
Z = 0.30
The calculations:
If x >= 0 then x1 = 1
Else x1 = -1
If y >= 0 then y1 = 1
Else y1 = -1
If z >= 0 then z1 = 1
Else z1 = -1
TV = [x]+[y]+[z] -> (total velocity = 27.30)
x% = ([X]*100)/TV -> (91.57%)
y% = ([Y]*100)/TV -> (7.32%)
x% = ([Z]*100)/TV -> (1.09%)
If [x] >= (SL*x%) then x = (SL*x%)
Else x = [x] + (m*x%) -> (25 + (1.05 * 91.57%) = 25.96)
If [y] >= (SL*y%) then y = (SL*y%)
Else y = [y] + (m*y%) -> (2 + (1.05 * 7.32%) = 2.08)
If [z] >= (SL*z%) then z = (SL*z%)
Else z = [z] + (m*z%) -> (0.30 + (1.05 * 1.09%) = 0.312)
New velocity values:
newX = x * x1 -> 25.96
newY = y * y1 -> -2.08 (because Y was negative)
newZ = z * z1 -> 0.312 |
And if we sum the new values = 28.352 is the same as 27.30*1.05 = 28.665 (difference is the result of rounding down)
Last edited by shadowpt on Thu Jul 18, 2013 7:02 pm; edited 3 times in total |
|
Back to top |
|
 |
daspamer Grandmaster Cheater Supreme
Reputation: 54
Joined: 13 Sep 2011 Posts: 1588
|
Posted: Thu Jul 18, 2013 4:37 pm Post subject: |
|
|
[x]+[y]+[Z] = 23.30.
And you may use math, by doing mov, sub,mul and etc.
Also
You can check if the value increases OR decreases, by doing this for example:
Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(lowerlimit)
label(below)
label(TempValue)
label(exit)
newmem:
push ecx
mov ecx,[eax+30]
movq [TempValue],xmm0
cmp ecx,[TempValue]
pop ecx
ja originalcode -- Jump if above, if ecx, is above xmm0, the 'new' value
{cmp dword ptr [eax+30],(float)0.00
jle lowerlimit}
cmp dword ptr [eax+30],(float)25.00
jb below
mov dword ptr [eax+30],(float)25.00
jmp exit
lowerlimit:
cmp dword ptr [eax+30],(float)-25.00
jb below
mov dword ptr [eax+30],(float)-25.00
jmp exit
below:
sub esp,04
mov [esp],(float)1.015
mulss xmm0,[esp]
add esp,04
jmp originalcode
originalcode:
movss [eax+30],xmm0
jmp exit
exit:
jmp returnhere
TempValue:
dd 0
"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F 11 86 C8 00 00 00 |
Please be aware, Im not great with assembly, but this is simple stuff that I know and understand.
I mean, I know many stuff, but do not understand many stuff in it .
_________________
I'm rusty and getting older, help me re-learn lua. |
|
Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Thu Jul 18, 2013 4:54 pm Post subject: |
|
|
Oh wow, that sounds awesome and simple!
Although I still have to get used with the order of the functions and the one you posted presents a problem, it will just affect 1 opcode line (the one for North/South velocity) which cannot retrieve the total value of the velocity, it will still need to address 2 more lines (West/east and Up/down opcodes) which are mainly the eax+34 and eax+38
This is going to be challenging
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|