Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Cheat Engine Forum Index
PostGo back to topic
panraven
Grandmaster Cheater
Reputation: 55
Joined: 01 Oct 2008
Posts: 943

PostPosted: Sun Apr 03, 2016 9:16 pm    Post subject:

In CEDIR/autorun directory, the monoscript.lua has this related lua function
Code:
function mono_method_getSignature(method)
...
  return result, parameternames, returntype;
end


The 'result' is a string list of input parameter type/class name, which should be unique for each overloaded function of same name.
The 'method' parameter is a integer/number to identify the method/function. But if we already have this number, and the goal is to get the jit-address of the method, we don't need to call the signature function.
So to identify the target overloaded function, we need to enumerate every function/method in the target class and paired each function with its signature. Then compare a matching signature pattern of the method name to return the target method number, and get the jit-address by calling mono_compile_method(method).

That should be one of the possible approaches.

If you like, you may try my implementation.

The attached ct is a very wip Master-of-Orion table, which include my latest lua script about mono thing in table files. The lua will be ready to use by clicking the script '(click 1st: load Scripts)'.

After attached to a mono game process, then click '(click 2nd: Global Storage)'

In aa script, this line will get the function address to a define symbol (local, not registered symbol).

Code:
eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus')

'Backend.Civilizations' is namespace,
'Civilization' before 1st ':' is class name,
'GetBonus' is the method name.
In most mono game, game logic related class don't need a namespace.

The equivalent define symbol with CE address symbol is like this:
Code:
define(bonus,"Backend:Civilizations:Civilization:GetBonus")


---
"Does the assert AA function force jitting of a Mono method? If not - what does?"

'define' above will not jit the method, since the aa command 'define' alone just assign a (local) symbol to the textual pattern .
But when the symbol used in anywhere that force ce to eval the textual pattern, and it match the right method, the ce symbol-handler will call some function in monoscript.lua , and should jit the mono function.

eg:
someaddress:
dq bonus
equivalent:
someaddress:
dq "Backend:Civilizations:Civilization:GetBonus"


or

bonus:
jmp mycave
equivalent:
"Backend:Civilizations:Civilization:GetBonus":
jmp mycave
etc.

---


Now in case of overloaded methods.
Suppose we have these overloaded methods signature:
Code:

1) public float GetBonus(float amount)
2) public float GetBonus(float amount, BuildingType b)
3) public float GetBonus(float amount, EquipType e)
4) public float GetBonus(int amount, BuildingType b, boolean restore)
5) public float GetBonus(float amount, EquipType e, boolean restore)
6) public float GetBonus(float amount, BuildingType b, boolean restore)

Then the following is the aa command to define the target method address:
Code:

1) eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus(1)')
2) eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus(2-2-Building)')
3) eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus(2-2-Equip)')
4) eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus(3-1-int)')
5) eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus(3-2-Equip)')
6) eval(bonus,$MONO'Backend.Civilizations.Civilization::GetBonus(3-2-Build)')

Since the 1st approaches need more typo, I use an alternative one. The rule are:

1) If number of parameter count can uniquely identify the target method, add '(count)' after method name;
Check example 1)

2) otherwise add '(count-<1st_position_of_unique_parameter_type>-<typename_at_that_position>)' ;
Check example 2)-6)

3) the last 'typename' inside '()', if used, need not be full text as long as no ambitious. it is a lua pattern match.

For instance method, the 1st parameter in assembler code (ie. this pointer) is not count as parameter (seems implied ).

--
NOTE:
The scripts are badly code and badly/no maintained, inconsistent and buggy.

Also, when mono feature is ON, no debug function is accessible; Conversely when there is debug function ON, the mono feature cannot be launch. They seems currently cannot be co-exist.
There is way to OFF mono feature, ie. monopipe.Destroy();monopipe=nil;
but there seems no way to detach an attached debugger (ie. removing all breakpoint still cannot re-launch mono feature)

oops, last thing, the script need ce 6.5

bye~
_________________
- Retarded.
Back to top
View user's profile Send private message
Post reviews:   Approve 1
Author Review
FauDrei
Review: Approve
Post reference:
ReviewPosted: Mon Apr 04, 2016 6:56 am

Knowledgeable, prompt, patient and willing to help... thanks panraven Cool
Back to top
View user's profile Send private message
Display:  
Cheat Engine Forum Index


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites