View previous topic :: View next topic |
Author |
Message |
peter4d5 Cheater Reputation: 0
Joined: 21 Dec 2010 Posts: 37
|
Posted: Sun Sep 11, 2016 12:50 am Post subject: BUG in CE aobscan script |
|
|
Code: |
[ENABLE]
aobscanmodule(INJECT,calc.exe,48 83 EC 28 E8 67 F5 FF FF) // should be unique
alloc(newmem,$1000,"calc.exe"+1B9B8)
label(code)
label(return)
newmem:
code:
sub rsp,28
call calc.exe+1AF28
jmp return
INJECT:
jmp code //<----------- should be newmem
nop
nop
nop
nop
return:
registersymbol(INJECT)
.
.
.
|
_________________
my name is peter4d5 |
|
Back to top |
|
|
SER[G]ANT Expert Cheater Reputation: 10
Joined: 29 Dec 2005 Posts: 215 Location: Russia
|
Posted: Sun Sep 11, 2016 2:23 am Post subject: |
|
|
It's not a bug.
|
|
Back to top |
|
|
STN I post too much Reputation: 42
Joined: 09 Nov 2005 Posts: 2672
|
Posted: Sun Sep 11, 2016 6:32 am Post subject: |
|
|
Not a bug, code gets assigned the address of newmem so the jmp gets executed to proper place.
_________________
|
|
Back to top |
|
|
Dark Byte Site Admin Reputation: 457
Joined: 09 May 2003 Posts: 25262 Location: The netherlands
|
Posted: Sun Sep 11, 2016 7:07 am Post subject: |
|
|
The only 'bug' is that the aobscanmodule line is pretty useless in this case and you could as well have used an hardcoded addresses.
Instead of "call calc.exe+1AF28" use the reassemble instruction with INJECT+sizeofsubrsp (and perhaps also wildcard the jmp distance bytes in the aob in case the distance between these two functions change)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
|
peter4d5 Cheater Reputation: 0
Joined: 21 Dec 2010 Posts: 37
|
Posted: Mon Sep 12, 2016 2:14 am Post subject: |
|
|
Thanks DB,I did this example with calculator not for use.
What I mean is 'jmp code' should be 'jmp newmem'.
_________________
my name is peter4d5 |
|
Back to top |
|
|
++METHOS I post too much Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Sep 12, 2016 8:56 am Post subject: |
|
|
The templates were changed a few versions back (i.e. it's not a bug, as everyone has already noted).
|
|
Back to top |
|
|
peter4d5 Cheater Reputation: 0
Joined: 21 Dec 2010 Posts: 37
|
Posted: Tue Sep 13, 2016 2:15 am Post subject: |
|
|
Tell the truth,I saw it for long time time ago(I'm sure > a year).
At this time, I'm teaching my nephews to use CE and
he ask me that why I must remember to correct it,why don't he(CE) fix it?
'Because it's not a bug, everyone already know it then do it yourself'
_________________
my name is peter4d5 |
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 138
Joined: 06 Jul 2014 Posts: 4275
|
Posted: Tue Sep 13, 2016 7:57 am Post subject: |
|
|
It is not a bug.
There is nothing that needs to be fixed.
It works perfectly fine the way it is.
You are being pedantic and are making this unnecessarily complicated.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
panraven Grandmaster Cheater Reputation: 54
Joined: 01 Oct 2008 Posts: 941
|
Posted: Tue Sep 13, 2016 10:51 am Post subject: |
|
|
You can store data between NEWMEM and COCDE, without changing the JMP CODE line.
I myself store user customization value at the very beginning NEWMEM+00...NEWMEM+04 ... etc, and CODE is actually at NEWMEM+100 or NEWMEM+300. I also use this space to store wild-card aob line by readmem to be restore in [DISABLE] section.
It is not a bug, but may need some more clear comment for new comer.
bye~
_________________
- Retarded. |
|
Back to top |
|
|
danrevella Master Cheater Reputation: 2
Joined: 11 Jun 2008 Posts: 290
|
Posted: Tue Sep 13, 2016 2:26 pm Post subject: |
|
|
Of course is not a bug, but (if I good remember..)there was a time when the template:
1) jumped at newmem
2) newmem: //this is allocated memory, you have read,write,execute access
//place your code here
@panraven also code, not only data
IMO the old template was more clear in special way for the beginner.
Also a template who also include some comment is always better.
|
|
Back to top |
|
|
peter4d5 Cheater Reputation: 0
Joined: 21 Dec 2010 Posts: 37
|
Posted: Wed Sep 14, 2016 1:37 am Post subject: |
|
|
From CE Code Injection Template
Code: |
,
,
[ENABLE]
alloc(newmem,2048,"calc.exe"+1B9DC)
label(returnhere)
label(originalcode)
label(exit)
newmem:
//place your code here //<------ what is this meaning?
originalcode:
sub rsp,000000B0
exit:
jmp returnhere
"calc.exe"+1B9DC:
jmp newmem //<------- Why 'jmp newmem'? Why not 'jmp originalcode'?
nop
nop
returnhere:
;
;
|
This is not about me,but about 'new user'.
You think that what they wan to do with CE,
they just want to hack simple game and create simple script not using Ultimap function or Hi-Tech functions,
mean that basic function should be ready to work with perfect performance.
Oh..If Geri still here,I'm sure he understand about 'Customer'.
If you don't care about 'new user' and have fun when 'new user' waste time with aobscan script then do nothing.
Please understand me,I don't want to show off or I cleaver than you,
but when I contact with 'new user' (my nephews) and get his complain to you because 'we' understand but 'new user' not understand.
_________________
my name is peter4d5 |
|
Back to top |
|
|
danrevella Master Cheater Reputation: 2
Joined: 11 Jun 2008 Posts: 290
|
Posted: Wed Sep 14, 2016 2:58 am Post subject: |
|
|
@peter4d5
I have re-read all of this post from beginning, and I have released that I have miserenstanding something......
The problem: on three different computer (each also incorporate a virtual machine with another system emulate) i have different installation, version (also beta ) of CE, with any lua script in autorun (some of these take care about AOB template).
In other way:......... a total caos!!!!
So I have take a fresh installation of CE 6.5.1 (last official version), with no add-on, and the AOB template who is generated is as your last post:
-> jmp newmem
-> the comment tell us: newmem: //place your code here
So it is ok, right?
But your original post was different....
Maybe that any of us (expert or newbie like me) reading your post have not released that the version they are actually use may be influenced by lua-script/beta version, etc. so IMO I thik that is better for a newbie only utilize the base official version with no-adds, at least in the beginning..
If I'm wrong let me know...
I'm 60 years old, btw here I'm a newbie and with zero possibility to learn more, but the young people must be supported.... I agree with you that Geri was not only a great expert but also a splendid human person.
|
|
Back to top |
|
|
hhhuut Grandmaster Cheater Reputation: 6
Joined: 08 Feb 2015 Posts: 607
|
Posted: Wed Sep 14, 2016 3:13 am Post subject: |
|
|
The default AOB injection template of the latest CE public release (6.5.1) codes a "jmp code" and not a "jmp newmem".
About two days ago that has been changed in the SVN, so if you download and compile the source yourself, you'll get the "jmp newmem" coded by default, but in the public release, you still have the "jmp code".
|
|
Back to top |
|
|
mgr.inz.Player I post too much Reputation: 218
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Sep 14, 2016 5:20 am Post subject: |
|
|
For a very long time we only had "Code Injection" template.
Code: | newmem:
...
originalcode:
...
exit:
jmp returnhere
XXXXXXXX:
jmp newmem
{zero or few nops here}
returnhere: |
With few jgoemat's suggestions, DB added those:
- "AOB Injection"
- "Full Injection"
Code: | newmem:
code:
...
jmp return
usersymbolOrAddress:
jmp code
{zero or few nops here}
return: |
_________________
Last edited by mgr.inz.Player on Wed Sep 14, 2016 5:31 am; edited 2 times in total |
|
Back to top |
|
|
danrevella Master Cheater Reputation: 2
Joined: 11 Jun 2008 Posts: 290
|
Posted: Wed Sep 14, 2016 5:24 am Post subject: |
|
|
As I told:>In other way:......... a total caos!!!!
I have just released this is not only true in my computers, but also in my mind....
Ok, so in the end
jmp newmem is the right way.
|
|
Back to top |
|
|
|