| View previous topic :: View next topic |
| Author |
Message |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Thu Mar 19, 2015 12:02 am Post subject: inf health |
|
|
can any one tell me how to make inf health
if nop the instruction that make the health decreasing the other enemy's health will not decreasing too
i try to solve it with dissect data / structures but i don't know which offset i should choose i try many offset but it didn't work
and there is another problem
it's with the script
i'm using full injection script
what should i change in the full injection script to make comparison
|
|
| Back to top |
|
 |
hhhuut Grandmaster Cheater
Reputation: 6
Joined: 08 Feb 2015 Posts: 607
|
Posted: Thu Mar 19, 2015 2:42 am Post subject: |
|
|
| Did you do the last step in the CE Tutorial? It's exactly the same thing...
|
|
| Back to top |
|
 |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Fri Mar 20, 2015 5:59 am Post subject: |
|
|
yes i did. u can see that i told u i tried this process "i try to solve it with dissect data / structures"
my problem with which offset should i choose i tried many offset but none of them work
it work but if i close the game and reopen it the script not working
i thought the problem was with my script but it's working without any problem
so any idea about which offset should i choose ?!
|
|
| Back to top |
|
 |
hhhuut Grandmaster Cheater
Reputation: 6
Joined: 08 Feb 2015 Posts: 607
|
Posted: Fri Mar 20, 2015 6:12 am Post subject: |
|
|
Did you get an offset which exactly identifies your character? So like in the CE Tutorial where your own player(s) have a "1" and the enemies a "2"?
Which game is it anyways?
|
|
| Back to top |
|
 |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Fri Mar 20, 2015 8:55 am Post subject: |
|
|
i'm trying to find this offset ! i know that the offset should be different for the enemies and i didn't find it
it so hard coz i need to close the game and reopen it many time so i can find it
|
|
| Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Fri Mar 20, 2015 9:31 am Post subject: |
|
|
The way I do it is I see what an instruction accesses and find my character's HP, then I check out what registers it has (right click it) and I write them down.
I then close the game, reopen, find what the instruction accesses, then my character's HP again, then I check out the registers at that point and compare them to what I wrote down. Use the ones that haven't changed.
Then in my "cave" (script), I compare the unchanged register and if it equals then it should jump to the part of my script that "nops" the instruction.
Here's an example:
This is my list:
EAX 00000000
EBX 08A9B8C0//this has changed
ECX 00000000
EDX 00000000
ESI 08A9B870//this has changed
EDI 08A9B8B4//this has changed
EBP 00000100
ESP 0028FCA0//this has changed
EIP 00548506
in the above example I can use anyone of those top ones that haven't changed, so I can do...
| Code: | Mycode:
cmp eax,0 //comparison
je check // if eax is 0 then go to "check"
jmp originalcode // otherwise execute the "normal" code
check:
nop //we don't want the HP going down, so we "nop" the instruction
jmp exit //we then go to the exit, otherwise the "sub [eax+30],ecx" will still get executed
originalcode:
sub [eax+30],ecx
exit:
jmp returnhere
//some other exit stuff... |
If this doesn't work then you probably checked the wrong register, or not enough, sometimes you'll need to do multiple checks.
if you don't know if the check worked, or just want to check (instead of the game crashing...)
try this one:
| Code: | Mycode:
cmp eax,0 //comparison
je check // if eax is 0 then go to "check"
jmp originalcode // otherwise execute the "normal" code
check:
sub [eax+30],ecx //this way we can check which one this instruction at this point is accessing
jmp exit
originalcode:
sub [eax+30],ecx
exit:
jmp returnhere
//some other exit stuff... |
once you enable this script, go to your code "cave" in the assembly viewer and right click the first "sub [eax+30],ecx" and see what it accesses, if it's just your health then it worked and you can "nop" it or whatever.
|
|
| Back to top |
|
 |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Fri Mar 20, 2015 6:46 pm Post subject: |
|
|
i tried it but it didn't work
i tried multiple checks but none of them work
this is what i got "go to the pic "
RDX = 1
RBP = 7FF645539F80
R12 = 7FF645539F80
RIP = 7FF643DB3827
i tried all of them
i have question
if i want to compare RDX,RBP,R12 or RIP
should i put the instruction like this
or
| Description: |
|
| Filesize: |
7.75 KB |
| Viewed: |
8602 Time(s) |

|
|
|
| Back to top |
|
 |
hhhuut Grandmaster Cheater
Reputation: 6
Joined: 08 Feb 2015 Posts: 607
|
Posted: Fri Mar 20, 2015 8:12 pm Post subject: |
|
|
Small tip: Never compare the IP-register. It's the Index Pointer, so it always points to the instruction that will be executed next, which usually is the same with enemies and friendly players, so using this in a compare won't work.
To your problem: Did you try to dissect other registers that are different at each player (no matter if friendly or not)?
|
|
| Back to top |
|
 |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Fri Mar 20, 2015 8:28 pm Post subject: |
|
|
| different at each player ? u mean it would be different at each enemies ?
|
|
| Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Fri Mar 20, 2015 10:55 pm Post subject: |
|
|
| mohammedfenix1 wrote: | i tried it but it didn't work
i tried multiple checks but none of them work
this is what i got "go to the pic "
RDX = 1
RBP = 7FF645539F80
R12 = 7FF645539F80
RIP = 7FF643DB3827
i tried all of them
i have question
if i want to compare RDX,RBP,R12 or RIP
should i put the instruction like this
or
|
--If it says "RDX 00045620" then you would type it as:
cmp rdx,45620
or
CMP RDX,45620
or
cmp rdx,00045620
these three will work fine, just a matter of "style", which one you prefer.
As for it not working... well, could you post your script of how you did the comparison and all that? Or perhaps you could tell us the game your trying to hack?
|
|
| Back to top |
|
 |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Fri Mar 20, 2015 11:24 pm Post subject: |
|
|
i thought what was wrong haha
that was stupid question but i needed it
anyway
the game is Woolfe - The Red Hood Diaries
this the scrpit
| Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"WoolfeGame.exe"+53827)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
cmp rdx,1
je exit
jmp originalcode
originalcode:
mov [rbx],eax
add rsp,20
jmp returnhere
exit:
mov [rbx],64
add rsp,20
jmp returnhere
"WoolfeGame.exe"+53827:
jmp newmem
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"WoolfeGame.exe"+53827:
mov [rbx],eax
add rsp,20
//Alt: db 89 03 48 83 C4 20 |
do u need something more ?
|
|
| Back to top |
|
 |
hhhuut Grandmaster Cheater
Reputation: 6
Joined: 08 Feb 2015 Posts: 607
|
Posted: Sat Mar 21, 2015 7:31 am Post subject: |
|
|
I meant if you also dissected other registers?
So I think you dissected the rbx register (since it's the one where the value is written to), but did you also try to dissect i.e. the rcx or r8/r9 register? Because perhaps one of those points to an individual player structure...
|
|
| Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Sat Mar 21, 2015 9:56 am Post subject: |
|
|
Yeah, like "hhhuut" mentioned, try other registers; I think that one your using in your script might be used by the enemies too.
EDIT: Yeah, I downloaded it to give it ago...
Well, the major problem is that it uses x64 architecture, and I'm not that well versed in it "yet", but anyway...
Your using the wrong register, "RDX" which is also used by the enemies.
Use RBX instead, that seemed to work for me.
since you can't compare a register to a value over 32-bits (I donno why) you'll have to compare RBX's lower part (EBX), which should be "precise" enough I think, though unfortunetely they keep changing as well, except for the utmost lowest part (BL).
so pretty much do...
| Code: | cmp bl,78 // 000007FFF167B878
//000007FF upper RBX register
//F167B878 lower RBX register, or EBX
//B878 is BX
//78 is BL
|
RBX works for now, though if it doesn't work later on try different registers; though all of them seem to change, only that lowest part of RBX doesn't.
EDIT: Well, apparentely RBX doesn't work, though I have found out that RAX never goes below 50 for the main character...
try this instead:
| Code: | cmp al,50 // lowest half of the RAX register
jge check // this will only jump if "al" is greater than or equal to 0x50
|
SIDE NOTE: Apparentely if you play the game in 20fps then enemies can't hit you...???
|
|
| Back to top |
|
 |
mohammedfenix1 Cheater
Reputation: 0
Joined: 08 Feb 2015 Posts: 48
|
Posted: Sun Mar 22, 2015 2:09 am Post subject: |
|
|
that was a good idea to dissect the register but that doesn't work
rax goes below 50 , it's 30 now and if it doesn't it will be the same for the enemies
i found many registers doesn't change but the problem was when i saw enemies registers it was the same
any aonther ideas ?
for u deama1234 many times they can't hit me
like if the try to hit me 5 time they will touch me just one time
it's glitch in the game
sorry for late
u r hleping me guys thnx
u can see this script in pic 2
like i said i downloaded trainer
and opened memory viewer , activated the trainer and it does this " go to pic 2 "
| Description: |
|
| Filesize: |
34.25 KB |
| Viewed: |
8402 Time(s) |

|
| Description: |
|
| Filesize: |
19.65 KB |
| Viewed: |
8403 Time(s) |

|
|
|
| Back to top |
|
 |
hhhuut Grandmaster Cheater
Reputation: 6
Joined: 08 Feb 2015 Posts: 607
|
Posted: Sun Mar 22, 2015 10:43 am Post subject: |
|
|
Just to make sure: Did you also dissect the rsi and r14 register? Since they are different at each player it could be you find an acceptable compare in one of them.
If you've already done that a further suggestion would be to look at all the xmm-values of each player ... Perhaps one of them has the value one when it's an enemy and zero if it's your character or something like that ...
|
|
| Back to top |
|
 |
|