Lets say you've found the code that decreases your health
Problem is that it seems to also affect the health of your opponents, and somehow you can't seem to find the
basepointer.
In those cases doing some code injection using CE's auto assembler is the easiest solution
There are several ways code injection can help solve this problem.
One method is finding another code that accesses your health, but does it only for your own health. (e.g the
code that is used to display your current health)
There inject some code that stores the address of your health to a address you can find back again (more on
that later)
Then in the code that decreases your health inject some code that checks if the address changes is the
address stored by the other routine, if it is, skip the code, otherwhise, just decrease the health, or even
create a instant kill cheat by decreasing the health of opponents by a really big value.
Now for the auto assemble script part:
lets say that at 00405000 is the code that reads your health: mov eax,[esi+ecx*4]
and at 00421000 is the code that decreases the health of enemies: mov [esi+ecx*4],edx
First allocate some memory to place your code in, and to allocate space for variables, use alloc(name,size)
for that.
Alloc allocates a region of memory with read,write and execute access. (be aware, this wont work in
windows me, 98 or 95 so please upgrade if you are using those ancient os's)
So:
Code:
alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024
bytes
alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy
management
alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have
to be 8 bytes)
Now, write your injecthealthreader routine to store the address, and place a jump to your original code as
well. dont forget that when placing a jump to your code cave keep in mind that if the instruction was larger
than a jump to nop the remaining bytes, and in case of the jump being bigger than the instruction also save
the other instruction, AND nop incomplete bytes. Jumps are 5 bytes.
So in the case of "mov eax,[esi+ecx*4]" the bytecode is 8b 04 8e (3 bytes) so you'll also need to save the
instruction after it. Let's say it's followed by a "mov ecx,[esi+edx*4+4]" , bytecode=8b 4c 8e 04 (4 bytes), so
now we have 7 bytes to place our jump, thats more than enough. So we'll have to place 2 nops after the
jump (7-5=2)
Code:
00405000:
jmp InjectHealthAddress //jump to the codecave
nop //nops for the lost space
nop
returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down
00405007 when jumping back, just to make it easy....)
injectHealthReader:
push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save
and restore registers
lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax
mov [playerhealthaddress],eax
pop eax //restore the register, again, not needed here, but good habbit to do
originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed
here
mov eax,[esi+ecx*4] //read health
mov ecx,[esi+edx*4+4] //read something else, my gues, armor
jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash...
As you see to specify a exact address just type it in ended with a ':' . Everything you type in after that will get
assembled on and after that address (the jump and nops in this case, and the definition of the
returnHealthReader:, which is in it's own turn also a address specifier, but doesn't change the current
address)
This code introduces labels, they are basicly identifiers specifying a address where thay have been placed.
you can't just use a label though, you'll first have to declare it using the label(labelname) function. I usually
declare labels right after the part where I alloc memory.
so, right after the alloc I have this code to get the code above working:
Code:
label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out
label(originalhealthreadercode) //same as above
now when you run the game the address of your health will get stored into the location of
playerhealthaddress.
You can already use this with cheat engine, because the auto assembler will tell you the address, but the
allocation will change each time, so making a table for other people won't work, they'd have to fill in the
address each time themselves. (I dont find that a problem but somehow some people do....)
So, let's automate it a little further and use the knowledge of your healthaddress to make yourself
invulnerable, but not your oponents.
Just like the injection for the code that reads your health you can do the same for that that decreases health.
And you can put it in the same script as the injection for the reader, as you saw in the alloc part where I
already allocated space for the injection for the health decreaser (so you dont have to edit the address the
other script allocated)
so, write scriptcode that places a jump over the code that decreases your health, in this case "mov
[esi+ecx*4],edx" which has bytecode 89 14 8e (3 bytes), too small, so find a instruction before or after thats
also suitable, in this case there's a sub edx,eax just before this instruction, its bytecode is 29 c2 (2 bytes) so
a perfect fit (5 bytes, so no need to nop), and even easier to make a code injection for (else I'd have to use a
label between the 2 instructions to just skip the original line, but this sub edx,eax line is used to decrease as
well, and doesn't change any of the locator addresses, and useless for the rest, so it doesn't hurt to skip it as
well)
so to inject your routine that checks if this is your health or not and if so, dont decrease do:
Code:
00421000:
jmp injectHealthWriter
returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get
converted to jmp 00421005
injectHealthWriter:
//do a check if esi+ecx*4 matches the address stored in playerhealthaddress
//if it matches, skip the original code, if it doesn't just execute it
//save the registers we use, and before I forget, do not touch esp between saving and restoring the registers
unless
//it's to read something(like parameters), in which case you'll have to adjust the offset
//also, dont change the registers that you use to find the address
push eax
push ebx
mov eax,[playerhealthaddress]
lea ebx,[esi+ecx*4]
cmp eax,ebx
je itstheplayer
//not the player
pop ebx //I think I could have doen this before the je, but better safe than sorry
pop eax
jmp originaldecreasehealthcode
itstheplayer:
pop ebx //restore the registers, keep in mind to restore the registers in reverse order
pop eax
jmp returnHealthWriter //dont execute the original code, return imeadiatly
originaldecreasehealthcode:
sub edx,eax
mov [esi+ecx*4],edx
jmp returnHealthWriter
again, I used a few labels to make it easier for me
but, that also means I'd have to declare them, else the assembler will complain it doesn't recognize them
so:
Code:
So, the complete auto assembler script would look like:
Code:
alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024
bytes
alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy
management
alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have
to be 8 bytes)
label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out
label(originalhealthreadercode) //same as above
label(returnHealthWriter)
label(itstheplayer)
label(originaldecreasehealthcode)
//----------------------------------------
// Healthreader
//----------------------------------------
00405000:
jmp InjectHealthAddress //jump to the codecave
nop //nops for the lost space
nop
returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down
00405007 when jumping back, just to make it easy....)
injectHealthReader:
push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save
and restore registers
lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax
mov [playerhealthaddress],eax
pop eax //restore the register, again, not needed here, but good habbit to do
originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed
here
mov eax,[esi+ecx*4] //read health
mov ecx,[esi+edx*4+4] //read something else, my gues, armor
jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash...
//----------------------------------------
// Health decreaser
//----------------------------------------
00421000:
jmp injectHealthWriter //overwrite the original code with a jump.
returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get
converted to jmp 00421005
injectHealthWriter:
//do a check if esi+ecx*4 matches the address stored in playerhealthaddress
//if it matches, skip the original code, if it doesn't just execute it
//save the registers we use, and before I forget, do not touch esp between saving and restoring the registers
unless
//it's to read something(like parameters), in which case you'll have to adjust the offset
//also, dont change the registers that you use to find the address
push eax
push ebx
mov eax,[playerhealthaddress]
lea ebx,[esi+ecx*4]
cmp eax,ebx
je itstheplayer
//not the player
pop ebx //I think I could have doen this before the je, but better safe than sorry
pop eax
jmp originaldecreasehealthcode
itstheplayer:
pop ebx //restore the registers, keep in mind to restore the registers in reverse order
pop eax
jmp returnHealthWriter //dont execute the original code, return imeadiatly
originaldecreasehealthcode:
sub edx,eax
mov [esi+ecx*4],edx
jmp returnHealthWriter
Please be aware that I havn't tested this in ce yet, I've been writing this in notepad on a pc that doesnt have
ce installed, so there may be a few syntax errors, and some of the code I've written can surely be optimised,
but I hope you get the general idea.
Also, there's a bug in ce 5.0 where you can't use small identiers that can apear in the name of another
identifier. (e.g weirdmemlocxxx and memloc can't be used at the same time, because memloc fits in
weirdmemlocxxx)
But if you use normal names for identifiers this wont couse a problem, and I recommend identifiers of more
than 4 characters, else it may happen you get the name of a assembler instruction and accidentally
overwrite that when used.
_____________________
The other method of using code injection is finding if there are differences between the player data and
opponent data.
Lets say that if it's the player [esi+ecx*4+14] contains a 1 otherwhise a 0. you can then do a check if that is
set or not, if so, skip, otherwhise, decrease health
Code:
alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy
management
label(returnHealthWriter)
label(itstheplayer)
label(originaldecreasehealthcode)
//----------------------------------------
// Health decreaser
//----------------------------------------
00421000:
jmp injectHealthWriter //overwrite the original code with a jump.
returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get
converted to jmp 00421005
injectHealthWriter:
push eax
mov eax,[esi+ecx*4+14]
cmp eax,1
je itstheplayer
//not the player
pop eax
jmp originaldecreasehealthcode
itstheplayer:
pop eax //restore the register
jmp returnHealthWriter //dont execute the original code, return imeadiatly
originaldecreasehealthcode:
sub edx,eax
mov [esi+ecx*4],edx
jmp returnHealthWriter