 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
XaneXXXX
Expert Cheater
 Reputation: 0
Joined: 29 Nov 2012
Posts: 212
|
 Posted: Sun Mar 27, 2016 4:37 pm Post subject: Use Read From opcode/globalalloc with FILTER. Is this doable |
 |
|
Since i always try to avoid pointers when i can because they take a long time to scan and they change with game updates.
If an opcode accesses a lot of things, it is possible to use the globalalloc with a good compare to get the address i want, but there is pretty hard to find something that is static enough.
So i have a game, The address for no reload is: 899DC31EC4
I restart the game, and the address is: 41492686C4
So the address ALWAYS ends with C4, is it possible to "tell" the globalalloc function to only show the address that ends with C4?
Thanks!
|
|
| Back to top |
|
 |
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Sun Mar 27, 2016 5:10 pm Post subject: |
|
|
Going this route is probably unnecessary. However, to answer your question, yes, it is possible.
| Code: | push rdi
lea rdi,[register+offset]
mov [address],rdi
pop rdi
cmp byte ptr [address],C4
je code
jmp originalcode |
| ++METHOS wrote: | There are other things that you can try.
- You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
- You can use pointer trees inside of the data structure to find something viable.
- You can shift the data structure (+ or -) and/or expand its size to find something useful.
- You can use the structure spider to find workable strings and/or for comparative analysis.
- You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
- You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
- Et al.
|
|
|
| Back to top |
|
|
XaneXXXX
Expert Cheater
Reputation: 0
Joined: 29 Nov 2012
Posts: 212
|
| Posted: Mon Mar 28, 2016 9:28 am Post subject: |
|
|
| ++METHOS wrote: | Going this route is probably unnecessary. However, to answer your question, yes, it is possible.
| Code: | push rdi
lea rdi,[register+offset]
mov [address],rdi
pop rdi
cmp byte ptr [address],C4
je code
jmp originalcode |
| ++METHOS wrote: | There are other things that you can try.
- You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
- You can use pointer trees inside of the data structure to find something viable.
- You can shift the data structure (+ or -) and/or expand its size to find something useful.
- You can use the structure spider to find workable strings and/or for comparative analysis.
- You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
- You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
- Et al.
|
|
Thank you very much! This will help me a lot. Gonna try this right now 
Just to be sure, could you give me an example? Never used lea command before so i'm a bit unsure.
If i want to apply this filter on this code:
| Code: | globalalloc(_findcord,4)
newmem:
push rbx
mov rbx,_findcord
mov [rbx],rax
pop rbx
movaps xmm1,[rax+70] // < Originalcode
jmp return |
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Mon Mar 28, 2016 10:08 am Post subject: |
|
|
Alright, so, your originalcode is this:
| Code: | | movaps xmm1,[rax+70] |
That means, all of the addresses that are being accessed are at [rax+70]. So, you would have this:
| Code: |
//stuff above
label(address)
registersymbol(address)
newmem:
push rdi
lea rdi,[rax+70]
mov [address],rdi
pop rdi
cmp byte ptr [address],C4
je code
jmp originalcode
//code
//originalcode
address:
dq 0
//returnhere stuff
//stuff below |
You can just as well use globalalloc in lieu of registersymbol etc.. But what the above code will do is check if the addresses being accessed end with the Byte C4, if they do, they get filtered out and jump to the code section, if not, they jump to originalcode and return.
But, again, this is not ideal, as there are other things that you can do to find a reliable filter. More than likely, the above method is not required at all.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
