Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Understanding code flow

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Memnok
How do I cheat?
Reputation: 0

Joined: 07 Aug 2016
Posts: 3
PostPosted: Sun Aug 07, 2016 3:02 pm    Post subject: Understanding code flow Reply with quote
Hello,

I would like some help with understanding how the assembly code works and if what i want to do is the correct thing.

I have a value that i want to freeze basically. And i've found the instruction where a float is being loaded into the registry and it is this value i want to change.

(View attachment)

The marked line is what's writing the amount of "energy" i have. But i would like this to always write 100 "energy" for example. the FSTP command loads a float from the ST(0) registry into eax+30 which is the address of my "energy" total.

So if i understand this correctly i would want to inject some code that puts 100 in the ST(0) before it's loaded into eax (which is my "base"). But i'm not sure how to load a float into that register, as to the syntax. I assume i should use FLD but i get a compiler warning when i try to do

Code:
code:
  push ebx
  mov ebx, 100
  fld ebx
  fstp dword ptr [eax+30]
  pop ebx
  mov eax,[ebp+08]
  jmp return

  //fstp dword ptr [eax+30]
  //mov eax,[ebp+08]
  //jmp return

INJECT:
  jmp code
  nop
return:


Or could i just do
Code:
code:
  mov [ebx+30], 100
  mov eax,[ebp+08]
  jmp return

  //fstp dword ptr [eax+30]
  //mov eax,[ebp+08]
  //jmp return

INJECT:
  jmp code
  nop
return:
registersymbol(INJECT)


I'm not quite sure how FLD and FSTP works so some tips would be nice.

ss+(2016-08-07+at+09.29.56).png
 Description:
 Filesize:  16.1 KB
 Viewed:  4557 Time(s)

ss+(2016-08-07+at+09.29.56).png
Back to top
View user's profile Send private message
cooleko
Grandmaster Cheater
Reputation: 11

Joined: 04 May 2016
Posts: 717
PostPosted: Sun Aug 07, 2016 6:45 pm    Post subject: Reply with quote
I'm a sucker for the easy way. You have 4 lines of code:

Code:
fld dword ptr [eax+30] //Loads some value
fld dword ptr [ebp-94] //loads a value to be subtracted
fsubp st(1),st(0) //subtracts, pops the extra value from stack
fstp dword ptr [eax+30] //pops the result from the stack


Personally, if you didn't want to get your hands dirty, you could NOP the middle two instructions or all 4 instructions.

If you just wanted to always lose 0 energy, you could:

Code:

alloc(Zero,8)
label(Zero)
...
Zero:
dd (float)0
...
fld dword ptr [eax+30] //Loads some value
fld dword ptr [Zero] //loads a value to be subtracted
fsubp st(1),st(0) //subtracts, pops the extra value from stack
fstp dword ptr [eax+30] //pops the result from the stack


If you wanted to ensure you always had 100 energy you could:
Code:

fld dword ptr [eax+30] //Loads some value
fld dword ptr [Zero] //loads a value to be subtracted
fsubp st(1),st(0) //subtracts, pops the extra value from stack
fstp dword ptr [eax+30] //pops the result from the stack
mov [eax+30], (float)100


or

Code:

alloc(Energy,8)
label(Energy)
...
Energy:
dd (float)100
...
fld dword ptr [eax+30] //Loads some value
fld dword ptr [Zero] //loads a value to be subtracted
fsubp st(1),st(0) //subtracts, pops the extra value from stack
fstp dword ptr [eax+30] //pops the result from the stack
fld dword ptr [Energy]
fstp dword ptr [eax+30]


Lastly, you could NOP all 4 instructions and use only
Code:
mov [eax+30], (float)100

in their place
Back to top
View user's profile Send private message
Memnok
How do I cheat?
Reputation: 0

Joined: 07 Aug 2016
Posts: 3
PostPosted: Mon Aug 08, 2016 11:09 am    Post subject: Reply with quote
Ah i see, i was on the right track then. Still having some trouble with syntax.
Do you have to load in a declared variable to the float register or can i store a direct value, something like:

Code:
fld dword ptr (float)100
fstp dword ptr [eax+30]


I assumed the ptr meant it had to be the adress of a pointer to the value you want to store.

I appreciate the different solutions you've explained, i'm not that interested in just "getting it to work" i'm trying to learn more about how assembly functions and how to manipulate it.
Back to top
View user's profile Send private message
cooleko
Grandmaster Cheater
Reputation: 11

Joined: 04 May 2016
Posts: 717
PostPosted: Mon Aug 08, 2016 11:28 am    Post subject: Reply with quote
if you want to learn, then every time you encounter a new opcode, google it.

In this case:

fstp: http://x86.renejeschke.de/html/file_module_x86_id_117.html

As you can see, there is no immediate opcode, so you cannot load an immediate into the fp register.
Back to top
View user's profile Send private message
Memnok
How do I cheat?
Reputation: 0

Joined: 07 Aug 2016
Posts: 3
PostPosted: Mon Aug 08, 2016 12:00 pm    Post subject: Reply with quote
I did actually view that page before i made my post. That is where i took my conclusion that i had to load in the value in the register. But i'm quite new to assembly so i assume it's this part you're speaking of
Quote:
which can be a memory location or another register in the FPU register stack.

that excludes immediate values?

Another issue i'm having now is that i can no longer find the AOB adress that i used yesterday. Are these not static? The AOB i used yesterday was this:

Code:
""+1A27FE1: 8B 85 70 FF FF FF  -  mov eax,[ebp-00000090]
""+1A27FE7: 8B 80 38 02 00 00  -  mov eax,[eax+00000238]
""+1A27FED: D9 40 30           -  fld dword ptr [eax+30]
""+1A27FF0: D9 85 6C FF FF FF  -  fld dword ptr [ebp-00000094]
""+1A27FF6: DE E9              -  fsubp st(1),st(0)
// ---------- INJECTING HERE ----------
""+1A27FF8: D9 58 30           -  fstp dword ptr [eax+30]
""+1A27FFB: 8B 45 08           -  mov eax,[ebp+08]
// ---------- DONE INJECTING  ----------
""+1A27FFE: D9 80 90 02 00 00  -  fld dword ptr [eax+00000290]
""+1A28004: D9 85 6C FF FF FF  -  fld dword ptr [ebp-00000094]


But i can't seem to find this AOB anymore.
Back to top
View user's profile Send private message
cooleko
Grandmaster Cheater
Reputation: 11

Joined: 04 May 2016
Posts: 717
PostPosted: Mon Aug 08, 2016 12:16 pm    Post subject: Reply with quote
AOBs are not guaranteed to be static. Sometimes the code needs to be loaded in memory, other times the code is shuffled just a bit through some obfuscation, or the registers are changed on each startup, causing very minor changes in the opcode.

try: D9 40 30 D9 ?? 6C FF FF FF DE E9 D9 58 30
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites