| View previous topic :: View next topic |
| Author |
Message |
bhfff
Cheater
![]() Reputation: 0
Joined: 19 Jan 2017
Posts: 30
|
 Posted: Tue Dec 12, 2017 2:02 pm Post subject: Reading instruction problem |
 |
|
So I've been trying for quite some time to get this script to work properly and it's 50% done.
I can not inject code directly between instructions because of the integrity check (this is quite challenging for me and I love it)
But I can allocate new memory and the game won't crash! :)
The instruction looks like this: mov [0XXXXXXC],eax
1)
I've made a script with an aobscanmodule and registersymbol.
Now I have the exact location of the instruction. I've named it PlayerHeight
2) My script is able to write something to the eax by doing something like this:
| Code: |
push eax
mov eax,(float)-4000
readmem(PlayerHeight,5)
pop eax
|
But now I want to store the EAX and I don't think readmem will help me.
I thought that lua might come in handy (sadly I don't know anything about lua)
Does anyone have a solution to this problem?
|
|
| Back to top |
|
 |
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Tue Dec 12, 2017 10:23 pm Post subject: |
|
|
| Code: | | mov [PlayerHeight],eax |
|
|
| Back to top |
|
|
bhfff
Cheater
![]() Reputation: 0
Joined: 19 Jan 2017
Posts: 30
|
| Posted: Wed Dec 13, 2017 7:42 am Post subject: |
|
|
| Zanzer wrote: | | Code: | | mov [PlayerHeight],eax |
|
Thanks for the reply, but that will not work, as the eax is located in another memory region
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Wed Dec 13, 2017 8:39 pm Post subject: |
|
|
You're not explaining things very well.
Show us the injection and tell us your desired result.
It almost sounds like you want: | Code: | [ENABLE]
[PlayerHeight]:
dd (float)-4000 |
|
|
| Back to top |
|
|
FreeER
Grandmaster Cheater Supreme
![]() Reputation: 53
Joined: 09 Aug 2013
Posts: 1091
|
| Posted: Thu Dec 14, 2017 11:00 am Post subject: |
|
|
Sounds like PlayerHeight is the address of the mov instruction and you're essentially using createThread (or hooking somewhere else) to copy that instruction and use it to store -4000.
If so then what Zanzer gave is probably pretty close to letting you write directly to that address without createThread or hooking something else, though I'd expect you to need [PlayerHeight+1] so that you get the address not the 1 byte opcode for mov plus the last 3 bytes of the address (last because little endian).
If it's a static value (looks like it but then dynamic code like mono can look the same and change each start) you could simply copy the value eg.
| Code: | 0XXXXXXC:
dd (float)-4000 |
If you mean something else by "store the EAX" then you'll need to be more specific. If you want to be able to change the value of eax in the original code (PlayerHeight) so that the following code uses the new value, without hooking due to integrity checks, then you can try to right click the instruction and choose "change register at this location". AFAIK Lua can't use the same interface/api, but you can set a breakpoint and then change it in the handler function which is fairly simple, eg.
| Code: | -- set breakpoint at addr (first byte), when executed
-- and run given function when hit
debug_setBreakpoint(addr, 1, bptExecute, function()
EAX = newValue
return 0 -- return 1 will keep breakpoint active so user must continue
end)
|
|
|
| Back to top |
|
|
bhfff
Cheater
![]() Reputation: 0
Joined: 19 Jan 2017
Posts: 30
|
| Posted: Fri Dec 15, 2017 6:00 am Post subject: |
|
|
| FreeER wrote: | Sounds like PlayerHeight is the address of the mov instruction and you're essentially using createThread (or hooking somewhere else) to copy that instruction and use it to store -4000.
If so then what Zanzer gave is probably pretty close to letting you write directly to that address without createThread or hooking something else, though I'd expect you to need [PlayerHeight+1] so that you get the address not the 1 byte opcode for mov plus the last 3 bytes of the address (last because little endian).
If it's a static value (looks like it but then dynamic code like mono can look the same and change each start) you could simply copy the value eg.
| Code: | 0XXXXXXC:
dd (float)-4000 |
If you mean something else by "store the EAX" then you'll need to be more specific. If you want to be able to change the value of eax in the original code (PlayerHeight) so that the following code uses the new value, without hooking due to integrity checks, then you can try to right click the instruction and choose "change register at this location". AFAIK Lua can't use the same interface/api, but you can set a breakpoint and then change it in the handler function which is fairly simple, eg.
| Code: | -- set breakpoint at addr (first byte), when executed
-- and run given function when hit
debug_setBreakpoint(addr, 1, bptExecute, function()
EAX = newValue
return 0 -- return 1 will keep breakpoint active so user must continue
end)
|
|
The lua thing should do the job, thanks.
p.s. My apologies, i'm not really good at explaining things in english as it's not my native language (i speak italian)
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
