 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
scearezt
Cheater
![]() Reputation: 0
Joined: 12 Feb 2011
Posts: 46
|
 Posted: Sun Mar 30, 2014 2:09 pm Post subject: Function Calling |
 |
|
Is there a way to properly call a function, and not crash the game? I have tried to call a function in auto assembly, first I found the timer of the match, and when the timer equals to let's say 30, I just prepare the function call, then call it. But it seems that it's not enough, because it's freezing the game out, and crashing it.
It seems that the application dies within the function that I call, and not after it.
Here is what I have tried:
| Code: |
push eax
push ebx
push ecx
push edx
push esi
push edi
push esp
push ebp
//the following ones are for the stack, preparing the the function call
//these values are from an exact call, I have traced the call with
//the stack, and got these values, I added the values is order
// ("app.exe"+CF50F is [esp+0])
push 1D
push 8
push 2
push "app.exe"+CF50F
call "app.exe"+BD3B0
pop ebp
pop esp
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
|
Could somebody give me a good example on how to call a function properly? Thanks in advance.
|
|
| Back to top |
|
 |
danrevella
Master Cheater
 Reputation: 2
Joined: 11 Jun 2008
Posts: 292
|
| Posted: Sun Mar 30, 2014 3:20 pm Post subject: |
|
|
@scearezt
No, you have not to be happy.... 
I only wanna add myself to this party..... 
It's a really interest argoument.....
|
|
| Back to top |
|
|
scearezt
Cheater
![]() Reputation: 0
Joined: 12 Feb 2011
Posts: 46
|
| Posted: Sun Mar 30, 2014 4:31 pm Post subject: |
|
|
You made me sad, and you should feel bad!
I've been trying to call functions in different games and programs, but only had luck several times out of hunderds of calls. But I'm sure it's not about luck.
For example, I have found the function of sound playing in a game, and I assigned it a key, thus every time I pressed the key, it played a sound. Was funny, though I'm aiming to achive more complex things via calling functions. It would be good to know how to properly call one. I know calling procedures are harder than calling functions, because functions are usually push and pop the used registers, but procedures does not.
EDIT:
I have successfully called a more complex function, where functions are calling functions, etc. The main reason my code failed is that I was pushing and poping the esp and ebp, and that I wasn't calling the MAIN function, I was just calling a function which was called by the main function.. so the conclusion is, that you must backtrace the functions, use "break and trace instructions" with "save stack snapshot", and try to backtrace the call through the program. Eventually you will find the start of it where you will find some push and mov instructions which is the preparing of the function call, you must do the same thing if you want to call that specific function.
| Code: | push eax
push ebx
push ecx
push edx
push esi
push edi
push 1D
push 8
push 5
mov ecx,"app.exe"+AE00A0
call "app.exe"+BD3B0
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax |
Is there a way to EXECUTE the code once on KEYPRESS?
|
|
| Back to top |
|
|
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Sun Mar 30, 2014 9:06 pm Post subject: |
|
|
@scearezt: Something I really HAVE TO say: use pushad/popad (save/restore all registers) instead of those battalions of pushs and pops.
| scearezt wrote: | | Is there a way to EXECUTE the code once on KEYPRESS? |
I know 3 methods to do that. For this explanation we'll assume F1 should trigger your code.
1-Create 2 scripts, one to write the hack in memory and another to run it, with F1 set as a hotkey used to toggle the runner script. Example
writer script:
| Code: | [enable]
alloc(MyCode,128)
regisertsymbol(MyCode) //so thar other scripts can use "MyCode"
MyCode:
push 1D
push 8
push 5
mov ecx,"app.exe"+AE00A0
call "app.exe"+BD3B0
retn //threads created with CreateThread(MyCode) will gracefully die here.
[disable]
dealloc(MyCode)
unregisertsymbol(MyCode) |
...and the script to run that: | Code: | [enable]
createthread(MyCode)
[disable]
createthread(MyCode) |
This approach is pretty simple, but might not work if "app.exe"+BD3B0 needs to be run by the main thread.
2-Find a frequently used function (WindowProc is a good example, just find the function that calls user32.DefWindowProcA/W: that's WindowProc or part of it) and hook it. Create a boolean variable and use CE to set it to 1 when F1 is pressed, and in your hook check this boolean's state and run your hack if it's =1. (Don't forget to reset your boolean too)
3-Find a frequently used function and use the game itself to check for hotkey. Simplest way is to hook WindowProc, check if the 2nd parameter is WM_KEYDOWN=0x100, 3rd param=key code for the hokey you want (so VK_F1=0x70 for F1), and {4th param AND 0x40}=0 (if it's 1 it means the key is held down). If you don't want to/can't hook WindowProc, you can repeatedly call GetAsyncKeyState.
| scearezt wrote: | | I know calling procedures are harder than calling functions, because functions are usually push and pop the used registers, but procedures does not. |
Huh?
When you say procedures, are you speaking about something like: | Code: | SomeFunction:
...some code1...
jmp MyProcedure
GetBackHere:
...some code3...
retn
MyProcedure
...some code2...
jmp GetBackHere |
If that's what you're speaking about, then "think" like a compiler: why bother writing a pair of jmp instead of merging "some code2" and "some code3"? It's not as if MyProcedure could return to multiple places.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
