 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
MooMooCow Newbie cheater
Reputation: 0
Joined: 07 Jun 2007 Posts: 21
|
Posted: Mon May 26, 2008 3:31 pm Post subject: Code Injection |
|
|
Hello. I am having a very odd problem and I would greatly appreciate it if someone here could help me with it. I am trying to inject my code into a running process, however, for some odd reason it is not working and ends up crashing my program that I am injecting it into. I am basically trying to defeat DMA inside of a game so I can read an address of a game so it will return the address of the current target.
When searching for the target's address I get:
344D5DE8
when I watch what reads and writes to it I get:
The two main addresses that interest me are 4218AE and 101884C, but mainly 4218AE since it seems to be called first and all of the time. I have tried both and they both seem to crash my game. Here is the code I used:
FOR: 101884C
----------------------
| Code: | Offset 0x109B9
hex 00000000
Offset 0x10989
push ebx
lea ebx, [edi+ecx*4-0xC]
mov [0x109B9],ebx
pop ebx
mov [edi+ecx*4-0xC],eax
mov eax,[esi+ecx*4-0x8]
jmp 0x1018854
Offset 0x101884C
nop
nop
nop
jmp 0x10989 |
FOR: 4218AE
-----------------------
| Code: | Offset 0x109B9
hex 00000000
Offset 0x10989
push ebx
lea ebx, [esi+0x4]
mov [0x109B9],ebx
pop ebx
add [eax],al
mov eax,esi
pop esi
jmp 0x4218B3
Offset 0x4218AE
jmp 0x10989 |
I have verified the data and everything is being written properly. The code cave is being placed around all 0s and nothing uses the area my code cave is in. When I active the code cave it almost seems like it only nops the code and doesn't actually process the code cave.
Note: I have been able to get code caves to work before, but it has been a while and maybe I just forgot something. Any help would be greatly appreciated.
|
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6301
|
Posted: Mon May 26, 2008 5:45 pm Post subject: |
|
|
First i notice if this is the cave then your not jumping to it here.
And on both injections you are writing to the same cave, so one is over writing the other one.
Offset 0x109B9
hex 00000000
Offset 0x10989
push ebx
lea ebx, [esi+0x4]
mov [0x109B9],ebx
pop ebx
add [eax],al
mov eax,esi
pop esi
jmp 0x4218B3
Offset 0x4218AE
jmp 0x10989
|
|
| Back to top |
|
 |
MooMooCow Newbie cheater
Reputation: 0
Joined: 07 Jun 2007 Posts: 21
|
Posted: Mon May 26, 2008 5:52 pm Post subject: |
|
|
Thanks for the reply. Sorry, I should have made it clear. I am trying to use one or the other. Not both at the same time. It was my understanding that
| Code: | Offset 0x109B9
hex 00000000 |
just clears 0x109B9. I will remove that and see what happens, but I'm guessing there will be no difference.
Edit: That had no effect at all.
Edit2: After doing some reading I came across this usefull tidbit of information by Dark Byte:
"Just one caution to add to this:
If you have a recent cpu (bought within the last year) and have sp2 and no modified bios settings or boot.ini, then codecaves like 0x10bb0 will not work since they arn't marked as executable and will cause a access violation when executed. "
I'm going to change the code cave and see what happens, since this sounds promising.
Edit4: Nope that didn't fix it. Does anyone have any other ideas?
Edit5: I think I finally figured it out. I got it to stop crashing, but it isn't returning the proper address because neither address is being called all of the time and apparently other addresses are trying to access it at the same time, so it ends up reseting the address I want. I'll have to explore it and find something that will work. Thanks for the help.
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|