| View previous topic :: View next topic |
| Author |
Message |
hot12345 Newbie cheater
Reputation: 0
Joined: 23 Mar 2016 Posts: 17
|
Posted: Sat Mar 26, 2016 11:19 am Post subject: Problem with adding float vallue. need help with it. |
|
|
Hi all,
I using a game for learning to hack it, its called Alan Wake.
I found the code with decrease and inc. vallue of limit bar of my fleshlight.
If I put on the float vallue '' 1'' then the bar is full. And if I search to "What Write's to this addres. I get a few codes.
'' 004D34E3 - D9 96 E0000000 - fst dword ptr [esi+000000E0] ''
But how can i make a AOInject script that's write '' 1 '' to the bar fleshlight bar?
And what is exacly now the base adress in this point? How and where can i see the base adress?
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Sat Mar 26, 2016 6:42 pm Post subject: |
|
|
Fleshlight, eh? Something else on your mind?
You can use the AOB Injection template and replace the original code with:
| Code: | | mov dword ptr [esi+000000E0],(float)1.0 |
The base address is stored in the ESI register.
|
|
| Back to top |
|
 |
hot12345 Newbie cheater
Reputation: 0
Joined: 23 Mar 2016 Posts: 17
|
Posted: Sun Mar 27, 2016 7:06 am Post subject: |
|
|
| Zanzer wrote: | Fleshlight, eh? Something else on your mind?
You can use the AOB Injection template and replace the original code with:
| Code: | | mov dword ptr [esi+000000E0],(float)1.0 |
The base address is stored in the ESI register. |
Could you explain how the code/scripts reads?
Does it reads from top to botom? or does its reads section to section?
| Code: |
[ENABLE]
aobscanmodule(fleshlight,AlanWake.exe,D9 96 E0 00 00 00 D9 EE) // should be unique
alloc(newmem,$100)
label(code)
label(return)
newmem:
code:
mov dword ptr [esi+000000E0],(float)1.0
//fst dword ptr [esi+000000E0]
jmp return
fleshlight:
jmp code
nop
return:
registersymbol(fleshlight)
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
fleshlight:
db D9 96 E0 00 00 00
unregistersymbol(fleshlight)
dealloc(newmem)
|
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Sun Mar 27, 2016 7:28 am Post subject: |
|
|
First the aobscanmodule function is executed to find your array of bytes.
It defines a memory location called "fleshlight" which is your starting injection point.
So you read from the "fleshlight:" label and start execution there.
It jumps (JMP) to the "code:" label to execute the new MOV statement.
It skips over the commented FST statement and then finishes up with a jump to "return".
That sends it back to the game's normal execution path.
|
|
| Back to top |
|
 |
|