 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
jgoemat
Master Cheater
![]() Reputation: 23
Joined: 25 Sep 2011
Posts: 264
|
 Posted: Sat Feb 29, 2020 7:50 pm Post subject: Stupid java, JIT code |
 |
|
I see CE has a 'Java' menu, but it seems to just crash games for me. I'm looking at Pathway and had a good cheat going, but of course the instructions changed. I think I'm going to have to write some LUA to get it working.
The problem isn't only that the offsets change, but the registers used and even instruction sizes can change. For example the first time I ran I see something like this:
| Code: | // ---------- INJECTING HERE ----------
1D81852528D: 44 8B 52 34 - mov r10d,[rdx+34]
1D818525291: E9 56 FE FF FF - jmp 1D8185250EC
// ---------- DONE INJECTING ----------
1D818525296: 44 8B 52 24 - mov r10d,[rdx+24]
1D81852529A: E9 4D FE FF FF - jmp 1D8185250EC
1D81852529F: 44 8B 52 3C - mov r10d,[rdx+3C]
1D8185252A3: E9 44 FE FF FF - jmp 1D8185250EC
1D8185252A8: 44 8B 52 2C - mov r10d,[rdx+2C]
1D8185252AC: E9 3B FE FF FF - jmp 1D8185250EC
1D8185252B1: 44 8B 52 30 - mov r10d,[rdx+30]
1D8185252B5: E9 32 FE FF FF - jmp 1D8185250EC |
The next time:
| Code: | 2559708B6A5 - 8B 42 34 - mov eax,[rdx+34]
2559708B6A8 - E9 5DFEFFFF - jmp 2559708B50A
2559708B6AD - 8B 42 24 - mov eax,[rdx+24]
2559708B6B0 - E9 55FEFFFF - jmp 2559708B50A
2559708B6B5 - 8B 42 3C - mov eax,[rdx+3C]
2559708B6B8 - E9 4DFEFFFF - jmp 2559708B50A
2559708B6BD - 8B 42 2C - mov eax,[rdx+2C]
2559708B6C0 - E9 45FEFFFF - jmp 2559708B50A
2559708B6C5 - 8B 42 30 - mov eax,[rdx+30]
2559708B6C8 - E9 3DFEFFFF - jmp 2559708B50A |
So not only did the used register change, but the size of the mov instructions went from 4 to 3 because it's eax now. I'm working on it, but does anyone have some advice or code they used before for something similar? I'm thinking I'll have to do two aob scans for the different sizes and hope they're unique. Then have to disassemble to get the registers used, then create the AA script using those registers in LUA...
The calling method (target of the JMPs) is likewise quite different due to the next instruction being `xor r10d,r10d` or `xor rax,rax` which are different sizes...
| Code: | 1D8185250E4: 42 FF 64 D9 F8 - jmp qword ptr [rcx+r11*8-08] // various calls that load values from [rdx+?], [rdx+34] is HP btw
1D8185250E9: 45 33 D2 - xor r10d,r10d
// ---------- INJECTING HERE ----------
1D8185250EC: 41 8B C2 - mov eax,r10d
1D8185250EF: 48 83 C4 20 - add rsp,20
// ---------- DONE INJECTING ----------
1D8185250F3: 5D - pop rbp
1D8185250F4: 85 05 06 AF 8E FC - test [1D814E10000],eax
1D8185250FA: C3 - ret |
or
| Code: | 2559708B503 - 43 FF 64 D3 F8 - jmp qword ptr [r11+r10*8-08]
2559708B508 - 33 C0 - xor eax,eax
2559708B50A - 48 83 C4 20 - add rsp,20
2559708B50E - 5D - pop rbp
2559708B50F - 85 05 EB4A4DFF - test [25596560000],eax
2559708B515 - C3 - ret |
Is there something like a scan to find jmp to a particular address?
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4702
|
| Posted: Sat Feb 29, 2020 9:35 pm Post subject: |
|
|
Changing the bytecode should be more reliable.
| Quote: | | Is there something like a scan to find jmp to a particular address? |
If you're looking for something like an aobscan, use an aobscan.
DissectCode can help you figure out what's going on by adding information to the disassembler. There's something in one of the memoryview window's menus, but last time I checked it can only target exe/dlls, not dynamically allocated memory. Look up the DissectCode class in celua.txt and call it yourself on memory regions you care about. Find regions via memoryview -> view -> memory regions, or iterate over enumMemoryRegions() - doing everything might take a while, even if excluding non-executable regions and system dlls.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
jgoemat
Master Cheater
![]() Reputation: 23
Joined: 25 Sep 2011
Posts: 264
|
| Posted: Sat Feb 29, 2020 10:37 pm Post subject: |
|
|
Here's what I came up with, I think it will work. It would have been more trouble, but in this instance I can just redirect the JMP instruction to my code. All I need then is the address of the JMP instruction and the target of it to go back. I register those as symbols and let my normal script to it's job. I have this as a parent to register the symbols for my actual script:
| Code: | [enable]
{$lua}
if syntaxcheck then return end
function findSingleAOB(aob)
local scan = createMemScan()
local found = createFoundList(scan)
local a, n, p = fsmNotAligned, 1, "*X*W"
scan.firstScan(soExactValue, vtByteArray, nil, aob, nil, 0x0, 0xffffffffffffffff, p, a, n, true, false, false, false)
scan.waitTillDone()
found.initialize()
if (found.getCount() < 1) then return nil end
local addr = found.getAddress(0)
found.destroy()
scan.destroy()
return addr
end
function hookScript()
local aob1 = "e9 * * ff ff 44 8B * 24 e9 * * ff ff 44 8B * 3c e9 * * ff ff 44 8B * 2c e9 * * ff ff 44 8B * 30 e9 * * ff ff"
local aob2 = "e9 * * ff ff 8B * 24 e9 * * ff ff 8B * 3c e9 * * ff ff 8B * 2c e9 * * ff ff 8B * 30 e9 * * ff ff"
local addr = findSingleAOB(aob1)
if addr == nil then addr = findSingleAOB(aob2) end
if addr == nil then print('Sorry, could not find code... :(') return end
local extraField, opcode, bytes, address = splitDisassembledString(disassemble(addr))
local returnAddress = string.gmatch(opcode, "jmp (.*)")()
unregisterSymbol("INJECT")
registerSymbol("INJECT", addr, true)
unregisterSymbol("JMPTARGET")
registerSymbol("JMPTARGET", returnAddress, true)
end
hookScript()
{$asm}
[disable]
unregistersymbol(INJECT)
unregistersymbol(JMPTARGET) |
Of course it'll only work as long as RDX is the pointer. If that changes I'll have to pick that out as well and generate the script in LUA...
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
