Cheat Engine

[hashtag2]

hello guys. will try to be clear:

what do i want?

i have a game and i want to disable recoil once and for all.

where did i go?

so with CE i am able to find a memory address that is responsible for the recoil, for example these two bytes i have marked bold:

[mgostIH]

Try searching for the byte sequence for the opcode you found instead ( 89 83 40EB2006 ), otherwise you can just use the address of the code you found (This would work only if the game doesn't have Address Space Layout Randomization enabled, if it does, you also have to get the .exe base address).

[SunBeam]

"4BD47ACF" <- just from this I can tell the game has some sort of protection, as the alignment of code is scrambled (should end in parity most of the time). And the opcode that accesses recoil is again a replacement instruction for something like "mov [ptr],eax" (where 'ebx' is the base static).

These are just assumptions, but based on them, you won't be able to just find out where to NOP code out and save the .exe as you might hit a "File corrupted" error. That is if this piece of code of yours is in file space and not allocated memory

Provide more details, please.

BR,
Sun

P.S.: You can use PM me.

[++METHOS]

I'm curious about why you're wanting to hard patch the target? As mgostIH has pointed out, just us an AOB signature for finding your injection location, then, use a memory patch at run-time. And why are you using Olly for a basic no-recoil? As SunBeam says, please provide more details.

[mgostIH]

[hashtag2]

wow, thanks for replies guys, didn't expect this forum is so alive <3

@mgostIH in CE address for recoil is variable, every time i get different, now for example it is (always 4th and 5th byte):

[mgostIH]

[STN]

4D2B7ACA - 8B 07 - mov eax,[edi]
4D2B7ACC - 8B 5F FC - mov ebx,[edi-04]
4D2B7ACF - 89 83 40EB2D06 - mov [ebx+062DEB40],eax <<
4D2B7AD5 - 83 EF 04 - sub edi,04
4D2B7AD8 - BB C4554408 - mov ebx,084455C4

>>
8B 07 8B 5F FC 89 83 ???????? 83 EF 04 BB

^Search for that in CE, is it unique? no..add more bytes until your sig becomes unique. Then search it in olly.

What i don't understand is why you can't just enter the address you see in CE to ollydbg? allocated or not, Olly should still be able to access the address.

Also you can't patch mov [ebx+062DEB40],eax but you can do what mgostIH said - xor eax, eax etc

[++METHOS]

[SunBeam]

..because it's an online game, d'oh.. that's why he's trying not to be that transparent

[++METHOS]

Rhetorical.

[hashtag2]

hello guys. spend my last nighs on learning and trying different things. i've found this whole stuff more enjoyable than playing itself. didn't even run a game once (to play) since i'm so absorbed with olly

[pellik]

So you think whatever is calling your recoil function is not in this dynamically allocated code? If so just breakpoint the recoil function and look at the stack for the return address.

[SunBeam]

Your mouse code is in the game's executable space, while the code that handles recoil is in ALLOCATED memory. You won't be able to patch allocated memory and store it inside the executable (you can, actually, but not for this exercise). Find out where this block of code is allocated, then where it's stored and use that instead.

Example:
push 1000
..
..
call VirtualAlloc
mov [405000],eax <- the result of VirtualAlloc is in eax; store it to 405000

If it's not stored, just hook the instruction after the VirtualAlloc (making sure the code is not executed multiple times, hence multiple allocations, therefore you'd need to filter the result to get only your address) and store it yourself.

Bottom line:

- at 4BB27A0D place a breakpoint
- when it breaks, trace code till you exit the function to a game module address (within executable's memory space)
- figure your way from there, via hooking or pure logic

BR,
Sun