Cheat Engine

[Culinary]

First and foremost since I am new to this forum I would like to thank Dark_byte for Cheat engine. I use this tool for anything and everything even just plain debugging.

Yesterday for the first time, I was able to inject code into a process (a dll) using the CreateRemoteThread/Loadlibrary technique. Not that I havent been capable of that, Ive just been taking my time learning as much as a I can and then slowly progressing into tougher things and my learning scope broadens.

Also I wanted a change from the old out of process methods such as WPM/RPM(read/writeprocessmemory)

My goal was to call an internal function inside of a test application, I used the __cdecl calling convention, GetModuleHandle(NULL) + functionoffset for the function pointer. It worked fine.

However with certain games I expirament with, it dosent work properly. It just ejects the library, I used the MessageBox api inside of DLLmain to let me know it was injected, and it pops up, but it still kicks out the library.

So I did some googling and read about looking over the assembly and making sure I have the function params correct. That is when I noticed cheat engine shows in the debugger the funtion params after a breakpoint is reached, but it seemed to me those parameters were totally incorrect.

Could someone tell me the best way to analyze and go about doing this?

[atom0s]

Not all functions will have the same calling convention. __cdecl will work on some, but not all functions depending on how they are compiled. You'll need to ensure that before creating a typedef of the function, that you know the proper calling convention it uses.

Here are some links to help you identify the proper calling convention:
http://en.wikipedia.org/wiki/X86_calling_conventions
http://www.codeproject.com/KB/cpp/calling_conventions_demystified.aspx
http://www.cs.cornell.edu/courses/cs412/2001sp/resources/microsoft-calling-conventions.html

If you need to, you can also handle converting __thiscall style class members to __stdcall typedefs and hooks. Check out this project:
http://www.gamedeception.net/threads/8375-Function-Detouring-and-Class-Detouring