Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Using AoB to load address?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
relentlesstech
Cheater
Reputation: 1

Joined: 02 Sep 2018
Posts: 44
Location: Rhode Island, USA

PostPosted: Sat Aug 26, 2023 9:31 pm    Post subject: Using AoB to load address? Reply with quote

Long story short, I watched a few videos regarding registering symbols to load addresses from an AoB, but no matter what I try it is not loading the correct value for me - Can someone take a quick look at my script, and possibly guide me in the right direction?

Code:


[ENABLE]

aobscanmodule(damage,NeedForSpeedUnbound.exe,F3 0F 11 B3 20 04 00 00)
alloc(newmem,$100,damage)

alloc(gDamage,8) //Allocating memory for my value
registersymbol(gDamage) //Registering symbol for my value

label(me)
label(police)
label(racers)
label(code)
label(return)

newmem:
  movss [gDamage],xmm6 //Move value in xmm6 to [gDamage] (my value)

  cmp [rbx+0C],(float)165
  je me
  cmp [rbx+0C],(float)100
  je police
  cmp [rbx+0C],(float)110
  je racers
  jmp code

me:
  movss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

police:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

racers:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

code:
  movss [rbx+00000420],xmm6
  jmp return

damage:
  jmp1 newmem
  nop 7
return:
registersymbol(damage)

[DISABLE]

damage:
  db F3 0F 11 B3 20 04 00 00

unregistersymbol(damage)
dealloc(newmem)
dealloc(gDamage,8)
unregistersymbol(gDamage)


Or, is there a way to use an AoB to get the value without actually creating a JMP (Just read from where AoB starts)?

_________________
.: Cheat Engine N00b in Progress :.

I'll earn my avatar someday ...


Last edited by relentlesstech on Sun Aug 27, 2023 5:47 am; edited 1 time in total
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4719

PostPosted: Sat Aug 26, 2023 10:44 pm    Post subject: Reply with quote

`alloc(newmem,$100,damage)` - there's no point in making it that small. It's going to take up 4 KiB anyway. Use $800 (2 KiB) or something. I don't think the code you've written overflows the allocated memory, but it is around half.

`cmp [rbx+0C],(float)165` - `cmp` is for integers, not floating point numbers. Practically speaking, this is probably fine, but the "correct" way is to use `ucomiss`.

`movss [gDamage],xmm6` - why? You seem to understand that xmm6 is being read from and [gDamage] is being written to, but it's reading/writing a float value, not an address. The first sentence of your post seems to indicate you want to store an address.
Next question is which address do you want to store? That instruction seems to access multiple addresses, so you'll have to place that instruction in one of those jcc branches.
Then again, that last sentence seems like you want to store some value?

I really don't understand what you're trying to do.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
relentlesstech
Cheater
Reputation: 1

Joined: 02 Sep 2018
Posts: 44
Location: Rhode Island, USA

PostPosted: Sun Aug 27, 2023 5:45 am    Post subject: Reply with quote

ParkourPenguin wrote:
`alloc(newmem,$100,damage)` - there's no point in making it that small. It's going to take up 4 KiB anyway. Use $800 (2 KiB) or something. I don't think the code you've written overflows the allocated memory, but it is around half.

`cmp [rbx+0C],(float)165` - `cmp` is for integers, not floating point numbers. Practically speaking, this is probably fine, but the "correct" way is to use `ucomiss`.

`movss [gDamage],xmm6` - why? You seem to understand that xmm6 is being read from and [gDamage] is being written to, but it's reading/writing a float value, not an address. The first sentence of your post seems to indicate you want to store an address.
Next question is which address do you want to store? That instruction seems to access multiple addresses, so you'll have to place that instruction in one of those jcc branches.
Then again, that last sentence seems like you want to store some value?

I really don't understand what you're trying to do.


The script I posted is already working fine, I just wanted to add the ability to be able to extract the value I want (which is stored in xmm6), and have it in my address list so that I can modify the value if I want to.

_________________
.: Cheat Engine N00b in Progress :.

I'll earn my avatar someday ...
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4719

PostPosted: Sun Aug 27, 2023 10:00 am    Post subject: Reply with quote

But extracting the value won't do anything. `[gDamage]` is only being written to. It's never read from. I think you're confusing addresses and values.

Search for "injection copy". I'm pretty sure that's what you're looking for.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Sun Aug 27, 2023 11:19 am    Post subject: Re: Using AoB to load address? Reply with quote

relentlesstech wrote:
regarding registering symbols to load addresses from an AoB
-I could be way off on this, but ssuming that [rbx+0C] holds the damage value, then you can try altering the script to match the code below. Once altered, approve the changes and enable the script inside of your cheat table. Once enabled, click on 'Add Address Manually' in the upper-right corner of your cheat table. A new window should pop up. Check the box that says 'Pointer'. In the bottom text field, paste gDamage. Change the value type as needed. Click 'OK'.

(Not tested; may contain errors)

Code:
[ENABLE]

aobscanmodule(damage,NeedForSpeedUnbound.exe,F3 0F 11 B3 20 04 00 00)
alloc(newmem,$100,damage)

label(me)
label(police)
label(racers)
label(code)
label(return)
label(gDamage)

registersymbol(damage)
registersymbol(gDamage) //Registering symbol for my value

newmem:
  cmp [rbx+0C],(float)165
  je me
  cmp [rbx+0C],(float)100
  je police
  cmp [rbx+0C],(float)110
  je racers
  jmp code

me:
  push rdi
  lea rdi,[rbx+0C]
  mov [gDamage],rdi
  pop rdi
  movss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

police:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

racers:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

code:
  movss [rbx+00000420],xmm6
  jmp return

gDamage:
dq 0

damage:
  jmp1 newmem
  nop 7
return:

[DISABLE]

damage:
  db F3 0F 11 B3 20 04 00 00

dealloc(newmem)
unregistersymbol(damage)
unregistersymbol(gDamage)
Back to top
View user's profile Send private message
relentlesstech
Cheater
Reputation: 1

Joined: 02 Sep 2018
Posts: 44
Location: Rhode Island, USA

PostPosted: Sun Aug 27, 2023 1:03 pm    Post subject: Re: Using AoB to load address? Reply with quote

++METHOS wrote:
relentlesstech wrote:
regarding registering symbols to load addresses from an AoB
-I could be way off on this, but ssuming that [rbx+0C] holds the damage value, then you can try altering the script to match the code below. Once altered, approve the changes and enable the script inside of your cheat table. Once enabled, click on 'Add Address Manually' in the upper-right corner of your cheat table. A new window should pop up. Check the box that says 'Pointer'. In the bottom text field, paste gDamage. Change the value type as needed. Click 'OK'.

(Not tested; may contain errors)

Code:
[ENABLE]

aobscanmodule(damage,NeedForSpeedUnbound.exe,F3 0F 11 B3 20 04 00 00)
alloc(newmem,$100,damage)

label(me)
label(police)
label(racers)
label(code)
label(return)
label(gDamage)

registersymbol(damage)
registersymbol(gDamage) //Registering symbol for my value

newmem:
  cmp [rbx+0C],(float)165
  je me
  cmp [rbx+0C],(float)100
  je police
  cmp [rbx+0C],(float)110
  je racers
  jmp code

me:
  push rdi
  lea rdi,[rbx+0C]
  mov [gDamage],rdi
  pop rdi
  movss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

police:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

racers:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

code:
  movss [rbx+00000420],xmm6
  jmp return

gDamage:
dq 0

damage:
  jmp1 newmem
  nop 7
return:

[DISABLE]

damage:
  db F3 0F 11 B3 20 04 00 00

dealloc(newmem)
unregistersymbol(damage)
unregistersymbol(gDamage)


This is close to what I was looking for (not knowing if it were even possible), but the value I'm looking for is stored in xmm6 - The original code I posted was more of just an example regarding the value I wanted, I was hoping I could create a 'main' script that could use the AoBs that I have for my other scripts to load the values into the address list (even if the other scripts are not enabled) - Load value from xmm6 (in this case), and display it in address list (to manually added pointer address as 'gDamage')

EDIT
I just found that my value is also held in [rbx+08], and when I follow the steps and add the pointer, the address is all 0s, and the value is ??? - All I did with the sample you posted was change the [rbx+0C] to [rbx+08]
Code:

  push rdi
  mov rdi,[rbx+08]
  mov [gDamage],rdi
  pop rdi

_________________
.: Cheat Engine N00b in Progress :.

I'll earn my avatar someday ...
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4719

PostPosted: Sun Aug 27, 2023 2:40 pm    Post subject: Reply with quote

Again, you're moving the value stored at the address and not the address itself.

Have you ever programmed in C or more generally any language that has both by-value and by-reference semantics?
Code:
#include <stdio.h>

// this takes an int value
int inc_by_value(int i) {
    return i + 1;
}

// this takes the address of an int
int inc_by_reference(int *i) {
    *i += 1;
    return *i;
}

int main(int, char**) {
    int i = 1;
    printf("%d\n", inc_by_value(i)); // prints 2
    printf("%d\n", i);  // prints 1 - did not change `i`
    printf("%d\n", inc_by_reference(&i));  // prints 2
    printf("%d\n", i);  // prints 2
    return 0;
}
Just copying the value will give you by-value semantics. Whenever that code runs in-game, you'll see the new value, but changing the value in CE won't change the value in-game. Copying the address will give you by-reference semantics: changing the value then will actually change the value of the real address in-game.

Again, "injection copy". There's plenty of information already available.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Sun Aug 27, 2023 3:08 pm    Post subject: Re: Using AoB to load address? Reply with quote

relentlesstech wrote:
I just found that my value is also held in [rbx+08], and when I follow the steps and add the pointer, the address is all 0s, and the value is ???
-You enabled the script before manually adding the address?

Also, when asking for help, it is better to provide the full vanilla script so that we can see what is going on in lieu of just guessing. It is also okay to say thank you when people take time out to help you. Mr. Green
Back to top
View user's profile Send private message
Fernando450
How do I cheat?
Reputation: 0

Joined: 27 Aug 2023
Posts: 1

PostPosted: Sun Aug 27, 2023 6:48 pm    Post subject: Re: Using AoB to load address? Reply with quote

I'll address your concerns one by one:

Loading the correct value:
Your script looks correct in terms of syntax. However, there could be various reasons why it's not working:
The AoB might have changed since you last checked.
The AoB might not be unique and could be pointing to multiple locations.
The game or application could have anti-cheat mechanisms that prevent the correct value from being loaded.
There might be another script or modification conflicting with your code.
Ensure you're targeting the correct version of the game/application.

Regarding your code:
I see that you're trying to check a specific float value and based on that value you're making different modifications. The code logic seems fine at a glance.
One thing to note is that you're using jmp1 instead of jmp at damage:, which seems like a typo. Make sure to correct it to jmp newmem.
It might help to have a comment next to each cmp explaining the significance of the float number being checked to understand the logic behind each section.

Reading value without a jump:
You can use Cheat Engine's scripting capabilities to read values directly without creating a jump. Here's a basic idea:

pascal

aobscanmodule(damage,NeedForSpeedUnbound.exe,F3 0F 11 B3 20 04 00 00)
readFloat(damage, value)

This is a basic representation, and you might need to adjust offsets based on where your AoB ends and where the actual value is stored.

Suggestions:

If you're having issues, start with basics. Ensure that your AoB is still valid. Once confirmed, then move onto the more complex parts of your script.
Test individual components of your script to ensure each section is working as expected.
Use Cheat Engine's built-in debugger or similar tools to analyze what's happening in real-time.
Always keep backups and document changes, especially when troubleshooting issues like these.
Back to top
View user's profile Send private message
relentlesstech
Cheater
Reputation: 1

Joined: 02 Sep 2018
Posts: 44
Location: Rhode Island, USA

PostPosted: Mon Aug 28, 2023 2:09 pm    Post subject: Re: Using AoB to load address? Reply with quote

++METHOS wrote:

Also, when asking for help, it is better to provide the full vanilla script so that we can see what is going on in lieu of just guessing. It is also okay to say thank you when people take time out to help you. Mr. Green


I definitely appreciate you guys taking the time to respond! Right now I'm researching 'injection copy' as ParkourPenguin recommended, and trying to absorb everything, which my old brain does not want any part of LOL

_________________
.: Cheat Engine N00b in Progress :.

I'll earn my avatar someday ...
Back to top
View user's profile Send private message
CassiOwOpeia
Newbie cheater
Reputation: 0

Joined: 29 Nov 2018
Posts: 18
Location: France

PostPosted: Wed Sep 13, 2023 10:01 pm    Post subject: Reply with quote

If I understand your problem, then this should work :

Code:
[ENABLE]
aobscanmodule(damage,NeedForSpeedUnbound.exe,F3 0F 11 B3 20 04 00 00)
alloc(newmem,$800,damage)

label(gDamage)
registersymbol(gDamage) //Registering symbol for my value

label(me)
label(police)
label(racers)
label(code)
label(return)

newmem:
  //movss [gDamage],xmm6 There you are only moving the value
  //From what I can see I would do something like this I guess ?
  push rax              // save a temp register
  lea rax,[rbx+0C]      // load the address of the value [rbx+0C]
                        // [rbx+0C] is a value,
                        // and you need the address to modify it later
  mov [gDamage],rax     // you put the address in [gDamage]
                        // from now you have to either add manually an address:
                        // [gDamage]
                        // or check the pointer checkbox and enter "gDamage"
  pop rax

  cmp [rbx+0C],(float)165
  je me
  cmp [rbx+0C],(float)100
  je police
  cmp [rbx+0C],(float)110
  je racers
  jmp code

me:
  movss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

police:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

racers:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

code:
  movss [rbx+00000420],xmm6
  jmp return

gDamage:
  dq 0

damage:
  jmp newmem
  nop 7
return:
registersymbol(damage)

[DISABLE]

damage:
  db F3 0F 11 B3 20 04 00 00

unregistersymbol(damage)
dealloc(newmem)
unregistersymbol(gDamage)

This could not work as I don't have access directly to what you are doing, but this is what I do when I want to access via instructions an address. Hope this will help


Here is the code with the ParkourPenguin's advices, I would be happy to know if it's what he means :

Code:
[ENABLE]
aobscanmodule(damage,NeedForSpeedUnbound.exe,F3 0F 11 B3 20 04 00 00)
alloc(newmem,$800,damage)

label(gDamage)
registersymbol(gDamage) //Registering symbol for my value

label(me)
label(police)
label(racers)
label(code)
label(return)

newmem:
  //movss [gDamage],xmm6 There you are only moving the value
  //From what I can see I would do something like this I guess ?
  push rax              // save a temp register
  lea rax,[rbx+0C]      // load the address of the value [rbx+0C]
                        // [rbx+0C] is a value,
                        // and you need the address to modify it later
  mov [gDamage],rax     // you put the address in [gDamage]
                        // from now you have to either add manually an address:
                        // [gDamage]
                        // or check the pointer checkbox and enter "gDamage"
                  // don't forget to pop rax, here I continue to use it so you can use comiss

  mov rax,(float)165
  ucomiss [rbx+0C],rax
  je me
 
  mov rax,(float)100
  ucomiss [rbx+0C],rax
  je police
 
  mov rax,(float)110
  ucomiss [rbx+0C],rax
  je racers
  jmp code

me:
  movss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

police:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

racers:
  subss xmm6,[rbx+0C]
  movss [rbx+00000420],xmm6
  jmp return

code:
  movss [rbx+00000420],xmm6
  jmp return

gDamage:
  dq 0

damage:
  jmp newmem
  nop 7
return:
pop rax
registersymbol(damage)

[DISABLE]

damage:
  db F3 0F 11 B3 20 04 00 00

unregistersymbol(damage)
dealloc(newmem)
unregistersymbol(gDamage)



2.PNG
 Description:
 Filesize:  7.87 KB
 Viewed:  2958 Time(s)

2.PNG



1.PNG
 Description:
 Filesize:  5.55 KB
 Viewed:  2958 Time(s)

1.PNG


Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4719

PostPosted: Wed Sep 13, 2023 11:22 pm    Post subject: Reply with quote

CassiOwOpeia wrote:
Code:
...
//movss [gDamage],xmm6 There you are only moving the value
  //From what I can see I would do something like this I guess ?
  push rax              // save a temp register
  lea rax,[rbx+0C]      // load the address of the value [rbx+0C]
                        // [rbx+0C] is a value,
                        // and you need the address to modify it later
  mov [gDamage],rax     // you put the address in [gDamage]
                        // from now you have to either add manually an address:
                        // [gDamage]
                        // or check the pointer checkbox and enter "gDamage"
                  // don't forget to pop rax, here I continue to use it so you can use comiss

  mov rax,(float)165
  ucomiss [rbx+0C],rax
...
damage:
  jmp newmem
  nop 7
return:
pop rax
I'd move `rbx` into [gDamage], make a new pointer, use `gDamage` as the base address, and use `C` as the offset.
`ucomiss` can't take general purpose registers. Use an xmm register instead.
Putting `pop rax` after the return label at the injection point is a bad idea. This negligently overwrites some of the game's code and will probably crash the game.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
relentlesstech
Cheater
Reputation: 1

Joined: 02 Sep 2018
Posts: 44
Location: Rhode Island, USA

PostPosted: Thu Sep 14, 2023 5:37 am    Post subject: Reply with quote

I just ended up doing this to load the addresses:
Code:
aobscan(arraystart,CD CC 2C 3F E8 B4 61 3F 00 00 80 3F 00 C8 AF 47 00 C8 AF 47 00 C8 AF 47 00 C8 AF 47 00 C8 AF 47 00 C8 AF 47 00 C8 AF 47 00 C8 AF 47 ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** ** 00 00 80 3F 00 00 00 00 00 00 00 00 ** ** ** 40 00 00 00 00 ** ** ** ** F0 15 19 44 01 00 00 00 *0 ** ** 33 00 00 00 00 *0 ** ** ** 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B4 42 00 00 A0 40 00 00 00 00 CD CC 14 41 CC CC 50 41 66 66 D4 41 67 66 83 42 33 33 97 42 9A 19 AA 42 00 00 B4 42 00 00 20 41 00 00 A0 40 00 00 68 40 BC BB 4B 40 00 00 40 40 BB BB 3B 40 BC BB 2B 40 22 22 1A 40)
registersymbol(_damage)
label(_damage)

arraystart+90:
_damage:


And added the pointers to the correct offsets once the script was loaded

_________________
.: Cheat Engine N00b in Progress :.

I'll earn my avatar someday ...
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites