Cheat Engine

[wulfcare]

The game I am currently reversing uses a mainGameFunction that passes different opcodes through it to determine what the user is trying to do. When i do stuff like talk to npc or attack npc calling the game function works perfect when i pass in the arguments that are shown in cheat engines registers and stack. But when I try the exact same thing with any GUI element the game instantly crashes. Is there something different about GUIs that tend to do this?

If anyone has experienced a similar problem dealing with gui elements in a game I would love to know.

[Dark Byte]

perhaps the GUI controls can only be called from one specific thread and will cause a crash if anything but the GUI thread accesses a GUI element

Perhaps you can find this thread and find code only this thread accesses and then call the function from there

[wulfcare]

Thats a good idea, but unfortunately when i set a breakpoint on the function and check its thread ID on the memory viewer window, they both use the same thread id. If you come up with any other potential solutions, I would love to here them.

[Dark Byte]

How do you currently call mainGameFunction ? Using ce's executecode functions, or using an ingame hook ?

If executeCode the issue may still apply (Wrong threadID for GUI access)

[wulfcare]

They both seem to share the same Thread ID, and the same TEB when I set a breakpoint on the function and use the function for an ingame action and use the function for interacting with the GUI. I am using threadlist to inspect.

This should mean they both are using the same thread? Or could I be missing something.

[Dark Byte]

how do you get the function to execute?

Using a code injection from a function that is called from the same thread, or using ce's executeCode(Ex) as ce's executeCodeEx runs in a different thread

[wulfcare]

omg i didnt know you could do that. Thank you DB

[wulfcare]

I debugged my code and it seems to crash at v19. I havn't dealt with volatile variables before, is there any tricks I need to do to when trying to call them?

volatile signed __int32 *v19; // [rsp+50h] [rbp-58h]

guiFunction(gameClient_1, v28, (__int64 *)v19, (__int64 *)a7);