Cheat Engine

Tatsu808 · Newbie cheater Reputation: 0 Joined: 15 Nov 2014 Posts: 20

I'm looking at the opcodes in cheat engine and it says that:

E9 0E 50 EE FE has an Opcode of jmp 7FF66B2A0000

When I paste E9 0E 50 EE FE into an online dissembler (google search defuse.ca online assembler), it says the opcode is jmp 0xfffffffffeee5013

I'm kind of confused. Shouldn't the same bytes always mean the same opcode when dissembled? Question

Zanzer · Posted: Fri Jan 29, 2016 11:50 pm Post subject:

The bytes are based on the offset of where the current instruction is in relation to the jump target.
It's FEEE500E bytes away.

If you try to use those bytes in some other location, it will jump to an entirely different address.

CE has the reassemble(addr) method, which will correct the offset in any injection script you use.

Tatsu808 · Newbie cheater Reputation: 0 Joined: 15 Nov 2014 Posts: 20

So what if the jump target was at memory address 4383890000 for example? if the current instruction was at 7FF66C3BAFED, the jump target would be 7FB2E8B2AFED bytes away from it. Would that jmp not be possible since jmps are only 5 bytes long? Just wondering because I created an alloc method in C# and it seems to allocate the memory to an address very far from the instruction I'm interested in which is at 7FB2E8B2AFED. I may have to fix this method...

atom0s · Posted: Sat Jan 30, 2016 12:19 am Post subject:

Jumps are not directly to an address, they are calculated.

jmp 7FF66B2A0000

While that says to jump to address 0x7FF66B2A0000, you'll see that the bytes do not match that.

E9 0E 50 EE FE

E9 is the opcode for JMP. While the other bit is the offset to jump to.
0xFEEE500E

This is calculated based on the current position and the position to jump to.

Jumps are calculated like this:
result = ((jumpTo - jumpFrom) - 5)

Zanzer · Posted: Sat Jan 30, 2016 12:34 am Post subject:

You can set an address to the value of that destination address.
Then create an instruction which jumps to the value of that address.
CE sometimes will do this:

Bytes: FF 25 00 00 00 00

This translates to a jump which uses the next 8 bytes after the jump instruction as the address to which you want to jump.

So in your example, you would replace all of the following bytes:
FF 25 00 00 00 00 00 00 89 83 43 00 00 00

hhhuut · Posted: Sat Jan 30, 2016 9:41 am Post subject:

Additionally, VirtualAlloc (and also the alloc of CE) has a parameter with which you can define near which position the new allocated space will be, so that you can be sure it's within 32bit address range and therefore near jumps will be sufficient ...

Tatsu808 · Newbie cheater Reputation: 0 Joined: 15 Nov 2014 Posts: 20

Thanks for the help all, I was able to solve what I was trying to accomplish via C#.

Dark Byte · Posted: Sun Jan 31, 2016 3:36 am Post subject:

Tatsu808 · Newbie cheater Reputation: 0 Joined: 15 Nov 2014 Posts: 20

panraven · Posted: Mon Feb 01, 2016 1:34 am Post subject:

The original relative call +1b1a8f1 is not properly convert in the cave?
I guess the call need to make indirect manually, or something like ce reassemble function.

Tatsu808 · Newbie cheater Reputation: 0 Joined: 15 Nov 2014 Posts: 20

As a work around, I placed the JMP high enough so that I wouldn't need to re-write the CALL in the code cave and was able to still edit the instruction I was interested in.