Cheat Engine

[Codcat]

I've always used TSearch for writing my code caves but I wish to use CE's AA instead, I've tried bringing one of my scripts across. I use it in an mmorpg for creating my own static pointer addresses. It works fine in TSearch's Easywrite but trying to use it in CE's autoassembler it will crash the game process after a few seconds.

Here's the code cave i've converted from tsearch correcting the syntax for CE(although i dont know think ths syntax matters much)

[Labyrnth]

In the AA script you left out dword ptr on allot of it!

[Codcat]

[Labyrnth]

hmmm, i would have the memory window open and go to my first address and enable the script, watch to see if it over writes anything. Disable it again to see if it writes back what was removed. Looking to see if it leaves or overwrites anything.
Then go to the cave and see if that is over writing anything there.
Keep going down the list of address's and see if anything is over written or leaving bytes.

From what i see, i counted the bytes on the scripts and unless im missing the same thing as you. It looks like it is right. So only thing i can think of is to check visually in memory and see what it is doing.

[-DEViL-]

try this:

[Labyrnth]

Only thing different in that is your using labels, and he is using code.
Both will work the same, his return jumps are jumping where AA script is sticking labels.
He will have to do what i said and look in memory as his script is turned on.
I think his caves may be to close together and over writing each other.
But the number of bytes in the cave look to be good in size to not do this.

[Codcat]

Right here we go, problem was I needed a clean up NOP after the first cave.

[Labyrnth]

Hmm thats interesting, maybe DarkByte will see this thread and make a reply.
Is this memory cave protected?

[Dark Byte]

The memory region at 00400000 - 00401000 is usually READ-ONLY and NON-EXECUTABLE(Non executable only on pentium 4 and later with NX bit support and PAE paging mode) , writing to that region, or executing code there without making it writable/executable first will result in a access violation.

you can solve this by calling "Fullaccess(00400000,4096)"

[Codcat]

Thank you for your responses. I guessed that may be the case so I tried a much higher memory region cave found by CE's code cave finder. Still the same thing, crashing. Interesting how tsearch doesn't have this problem??

Anyway i'll have to come back to it another time, changing games

[Dark Byte]

hint: Don't use codecaves. Allocating memory saves you from a lot of trouble

also, add "Fullaccess(addressyouuse,size)" if you insist on using codecaves

[Labyrnth]

Oh, it just might be protected memory then.

DB, why do you suggest not using caves?
Like back in the day thats what was used. Is allocation better in some way?

[Dark Byte]

yes, thats why I say to use the fullaccess instruction, that'll make the memory writable and executable.

back in the day (pre win2000) there was no VirtualAllocEx so codecaves where the best thing there was . But you can pretty much assume most people have upgraded to at least win2k by now.

It also saves time finding codecaves and later finding out they get destroyed at runtime, or that your trainer doesn't work on other people's comp because you picked a non-executable code cave, and someone else has the NX protection enabled, and as bonus you don't have to worry about finding a big enough cave when you're going to write a huge chunk of code

[Labyrnth]

Ok, see im old school, manual code caves .

[Recifense]

Hi guys,

Since that code worked with TSearch, I think that this issue deserves more investigation.

I understood that the CE code injection worked fine right after the TSearch injection.

Jazcat, could you please give it another try?

1) Run the following scrip first: