 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
vng21092
Grandmaster Cheater
 Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
 Posted: Mon Jan 13, 2014 1:38 pm Post subject: A little help with understanding code injection? |
 |
|
[Enable]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(infinitehealth)
newmem:
cmp [esi+5C],0
je infinitehealth
jmp originalcode
infinitehealth:
mov [esi+00000150],64
jmp returnhere
originalcode:
mov [esi+00000150],ecx
jmp returnhere (WHAT IS RETURNHERE?)
"iw5sp.exe"+2205A:
jmp newmem
nop (WHY IS THERE A NOP HERE)
returnhere:
(THERES NOTHING HERE)
[Disable]
"iw5sp.exe"+2205A:
mov [esi+00000150],ecx
This is a script I wrote up for MW3, its suppose to grant infinite health to me while still allowing me to kill the computers, it works except I don't fully understand the whole code, if you guys could answer the stuff in the parenthesis, that would be great.
________________________________________
[Enable]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(oneshotkill)
newmem:
cmp [esi+5C],2047
je oneshotkill
jmp originalcode
oneshotkill:
mov [esi+00000150],00
jmp returnhere
originalcode:
mov [esi+00000150],ecx
jmp returnhere
"iw5sp.exe"+2205A:
jmp newmem
nop
returnhere:
[Disable]
"iw5sp.exe"+2205A:
mov [esi+00000150],ecx
Another thing here, this is a script that allows me to shoot any computer and they would die in one shot, it works but only problem is, if my infinite health is on, when I turn this on, my infinite health turns off somehow, how do I fix this, why are the codes affecting each other? I understand they use the same instruction but how do I make them work independently?
|
|
| Back to top |
|
 |
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 2:35 pm Post subject: |
|
|
you already have your comparison points | Code: | cmp [esi+5C],0 //hero
cmp [esi+5C],2047 //enemy |
so you would like to activate One-Hit-Kill and GOD at the same time? Or One-Hit-Kill not all the time?
you need extra address with em you later can compare and decide to enable 1-hit-kill or not
| Code: | Add an adress manually to your table, add as Address any label you like or prefer (for example "iOneShotKill")
now in your main script file add these lines:
......
label(oneshotkill)
label(iOneShotKill) // create label to use
registersymbol(iOneShotKill) // register label/symbol to be able to manipulate it
......
newmem:
cmp [esi+5C],0
je infinitehealth // do inf. health if [esi+5C] == 0 (= Hero)
cmp [esi+5C],2047
je oneshotkill // do One-Hit-Kill if [esi+5C] == 2047 (= Enemy)
jmp originalcode
infinitehealth:
mov [esi+00000150],64
jmp returnhere
oneshotkill:
cmp [iOneShotKill],0
je originalcode // do nothing/original code if One-Hit-Kill is deactivated (value = 0)
mov [esi+00000150],00
jmp returnhere
......
iOneShotKill:
dd 0 // default value of One-Hit-Kill activated or not
[DISABLE]
...... |
if you now want to enable one-hit-kill, change the value of the address you manually added to 1,
if you like it permanently, change the code at "dd 0" to "dd 1", you can than safely remove the manually added address
-------------------------------------------------------------
| Quote: | | jmp returnhere (WHAT IS RETURNHERE?) |
in asm your only option to do (if true than do this else this) is by using jump statements with comparison,
or directly jump with a single "jmp" statement. so "returnhere" is used to jump/GoTo "returnhere" and "returnhere" is written at the end of the code injection line. For better understandings, you can rephrase the "returnhere" label to for example "exit".
| Quote: | "iw5sp.exe"+2205A:
jmp newmem
nop (WHY IS THERE A NOP HERE)
returnhere:
(THERES NOTHING HERE)
[Disable] |
to do a code injection you usually need to do a "jmp newmem" statement. that statement usually take up 5 bytes. And at your point where you are injecting your code (doing a jmp newmem) the original code is | Code: | | mov [esi+00000150],ecx |
that would be 6 bytes long. if you leave it and not nopping the last byte the result would be that the code right after the injection would change and most likely crash your game/process.
just count the array of bytes at the dissassembler window when you need to know, if there are less, exact, or greater bytes as 5
------
ps: i think this topic is better off in the forum "General Gamehacking"
|
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 4:17 pm Post subject: |
|
|
I got the code working btw, thanks for that
Last edited by vng21092 on Mon Jan 13, 2014 4:36 pm; edited 2 times in total |
|
| Back to top |
|
|
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 4:31 pm Post subject: |
|
|
| Quote: | | but in regards to the one shot kill, wouldn't your solution mean if I wanted to enable it, I would have to manually go into the code, edit it, then re-execute it? Is there anyway I can hotkey it? |
>> see: | Quote: | | Add an adress manually to your table, add as Address any label you like or prefer (for example "iOneShotKill") |
example: 
----------------------
| Quote: | | Also, in the code you wrote you declared iOneShotKill twice, once as a label and once as a registersymbol, was that an error? |
before you can use your needed word/variable, you need to register it, and before you are able to register it, you need to declare it (make it known for the application).
to declare it you use the keyword "label" for example.
if you use commands like aobscan, you can skip that in newer CE versions, as it should be automatically declared
------------------------
and dont forget at the end ([DISABLE])
to remove the registered symbols etc.
| Code: | | unregistersymbol(WORD) |
Last edited by UnIoN on Mon Jan 13, 2014 4:59 pm; edited 1 time in total |
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 4:58 pm Post subject: |
|
|
[Enable]
alloc(newmem,2048)
label(returnhere)
label(infinitehealth)
label(oneshotkill)
label(originalcode)
label(oneshotkill_)
registersymbol(oneshotkill_)
newmem:
cmp [esi+5C],0
je infinitehealth
cmp [esi+5C],2047
je oneshotkill
jmp originalcode
infinitehealth:
mov [esi+00000150],64
jmp returnhere
oneshotkill:
cmp [oneshotkill_],0
je originalcode
mov [esi+00000150],00
jmp returnhere
originalcode:
mov [esi+00000150],ecx
jmp returnhere
oneshotkill_:
dd 0
"iw5sp.exe"+2205A:
jmp newmem
nop
returnhere:
[Disable]
unregistersymbol(oneshotkill_)
_____________
That's what I've got based on what you told me... so under oneshotkill, if the value is 0(false), it'll jump back to the original code whereas they don't die in one hit, but if it is any number other than 0, it would move the value of 0(death) to ESI+150, is that how it works? I've added the code and the address, the infinite health works but when I change the value of oneshotkill_ in the cheat table to anything else other than 0, nothing happens... what am I doing wrong?
|
|
| Back to top |
|
|
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 5:01 pm Post subject: |
|
|
you forgot | Code: | [DISABLE]
"iw5sp.exe"+2205A: //
mov [esi+00000150],ecx // restore game code (deactivate cheat)
dealloc(newmem) // unload / free memory |
|
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 5:12 pm Post subject: |
|
|
added that piece, change the value of oneshotkill_ still does nothing
[Enable]
alloc(newmem,2048)
label(returnhere)
label(infinitehealth)
label(oneshotkill)
label(originalcode)
label(oneshotkill_)
registersymbol(oneshotkill_)
newmem:
cmp [esi+5C],0
je infinitehealth
cmp [esi+5C],2047
je oneshotkill
jmp originalcode
infinitehealth:
mov [esi+00000150],64
jmp returnhere
oneshotkill:
cmp [oneshotkill_],0
je originalcode
mov [esi+00000150],0
jmp returnhere
originalcode:
mov [esi+00000150],ecx
jmp returnhere
oneshotkill_:
dd 0
"iw5sp.exe"+2205A:
jmp newmem
nop
returnhere:
[Disable]
"iw5sp.exe"+2205A:
mov [esi+00000150],ecx
unregistersymbol(oneshotkill_)
dealloc(newmem)
|
|
| Back to top |
|
|
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 5:18 pm Post subject: |
|
|
| Quote: | | added that piece, change the value of oneshotkill_ still does nothing |
you need to change the VALUE that is displaying 0 (zero), not to tick the activate box
|
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 5:24 pm Post subject: |
|
|
=]... that is exactly what I'm doing lol, ticking the box just locks the value
 , not working sir...
|
|
| Back to top |
|
|
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 5:28 pm Post subject: |
|
|
and inf health still works?
is the oneshotkill displaying 0 when activating inf health or is it displaying "???"
you know that you need to deactivate/reactivate inf health to apply new written asm code?
|
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 5:35 pm Post subject: |
|
|
| when infinite health is off, that value says ??, but when I turn it on, its set to 0, which is suppose to happen because (dd 0), but even when I change it to 1, nothing happens, and if I toggle the script off and on again, it just resets to 0 like it's suppose to, and yes the infinite health does work when the script is on, and when off it does revert back to the original code
|
|
| Back to top |
|
|
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 5:43 pm Post subject: |
|
|
than do a breakpoint (f5) at the point | Code: | | cmp [oneshotkill_],0 |
and look if it stops there, if not than your comparison point might have changed for enemys (maybe every other number except 0 is enemy?)
regardless of the result, take a look at [esi+5C] what is stored in that second the debugger stops your application
|
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 6:00 pm Post subject: |
|
|
| yup, the game stopped at that breakpoint when I shot someone, I'm not sure what to make of that but... ESI + 5C for them is still 2047, and 0 for me
|
|
| Back to top |
|
|
UnIoN
Expert Cheater
![]() Reputation: 2
Joined: 17 May 2011
Posts: 146
|
| Posted: Mon Jan 13, 2014 6:08 pm Post subject: |
|
|
go to the disassembler window when cheat is activated, do a rightclick at the code injection (jmp XXXXX) and click "follow"
now you are at your injection part, click at a line you want to set a breakpoint and pres "F5".
set 3 breakpoints (1 before cmp [oneshotkill_], one direct, and one after)
switch to the game and hit the enemy, your game should stop, switch to CE and check what is written at the registers that interests you, press "F9" to jump to the next breakpoint and load the registers, try to find out why the game, is not jumpin to that part, where you set the enemys health to 0 (zero)
--------------------
is the code where you/enemys health is processed looking like this??????? | Code: | iw5sp.exe+63D4A - E8 A1781600 - call iw5sp.exe+1CB5F0
iw5sp.exe+63D4F - 39 BE 50010000 - cmp [esi+00000150],edi
iw5sp.exe+63D55 - 0F8E A1010000 - jng iw5sp.exe+63EFC
iw5sp.exe+63D5B - 55 - push ebp
|
--------------------
ok i found the part where you are trying to do a One-Shot-Kill,
and i tested both scripts from your first post
inf health works, but the other didnt, so i think your suggestion that you can manipulate enemys health at that point is incorrent....
-------- and i even dont get it, why you need one-shot, even at veteran-level the enemys are dying with 2-shots.
if its for learning purposes, than ok
if you insist that you first code for one-shot-kill works, than pls send me your savefile and let me test it out myself.
i tried it on the first level and the enemys still not dying until they got hit 2-times
Last edited by UnIoN on Mon Jan 13, 2014 8:23 pm; edited 1 time in total |
|
| Back to top |
|
|
vng21092
Grandmaster Cheater
Reputation: 15
Joined: 05 Apr 2013
Posts: 644
|
| Posted: Mon Jan 13, 2014 8:13 pm Post subject: |
|
|
that code is identical, but for the health processing I was using
iw5sp.exe+2205A - mov [esi+00000150],ecx
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
