Cheat Engine

[mordax]

Hi. I'm having some problems figuring out how to do the following: there is a shared opcode that accesses about 300 addresses that i want to change, how would i go about doing that?

here's what i did:

i found the opcode by right clicking on certain address and then breakpoint on read (find out what accesses this address)

then i disassembled that opcode and right clicked and breakpoint on read (find out what addresses this instruction accesses), then the new window will list about 100-600 addresses depending on what happens in game.

it's important to remember that this instruction does not write anything, so changing the instruction itself would have no effect. i need a method to read all of those addresses and then modify all of their values. how would i do that?

here's my asm script (i used aob template and then modified it to find the target address, but i think it's useless for what i need it for.

[ENABLE]

aobscanmodule(inject,game.dll,C7 02 00 00 80 3F F8 AC)
alloc(newmem,$1000,inject)
label(return)
alloc(_logaddr,8)
registersymbol(_logaddr)

newmem:

push rax
mov rax,_logaddr
mov [rax],rdx
pop rax

mov [rdx],3F800000
jmp return

inject:
jmp newmem
nop
return:
registersymbol(inject)

[DISABLE]

inject:
db C7 02 00 00 80 3F

unregistersymbol(inject)
dealloc(newmem)

so how would i be able to somehow intercept all the addresses that this opcode accesses and then modify all of those address values?
can it be done in asm or do i need lua for it? i tried chatgpt, but it doesn't seem to figure it out. i tried for hours, so now i'm here asking. i hope someone can point out how to achieve this. thanks.

[ParkourPenguin]

Don't delete the comment at the end of the template. The code around the injection point (including the unmodified original code) is important.


If you want to change the values of all the addresses to the same value, write to the address in your code injection.

[mordax]

[ParkourPenguin]

"Access" can mean read or write. An instruction that writes to an address accesses it.

The instruction `mov [rdx],3F800000`, which I can only assume is the original code, writes the value 0x3F800000 (float 1.0) to the memory location specified by the address `rdx`.

[mordax]

[ParkourPenguin]

[mordax]

[LeFiXER]

[Corroder]

@LeFiXER, I am strongly agree !

[MDon]

[ENABLE]

aobscanmodule(inject,game.dll,C7 02 00 00 80 3F F8 AC)
alloc(newmem,$40,inject) // $1000 too long... set $40
label(return)
alloc(_logaddr,$1000)
registersymbol(_logaddr)

newmem: // get all addr or you can add cmp..?..nya~

push rax
push rbx
mov rax,_logaddr

cmp [rax],#396 // max addr count..~
ja code

inc [rax]
mov rbx,[rax]
mov [rax+rbx*4],rdx

code:
pop rbx
pop rax

mov [rdx],3F800000
jmp return

inject:
jmp newmem
nop
return:
registersymbol(inject)

[DISABLE]

inject:
db C7 02 00 00 80 3F

unregistersymbol(*) // this all
dealloc(*)

// The effect achieved: Retrieve the value of RDX at around 300 times, not tested yet, it might crash... Meow?~