Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


A couple questions about auto assembler

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Evlesoa
Expert Cheater
Reputation: 0

Joined: 26 Oct 2006
Posts: 126

PostPosted: Wed Jan 21, 2015 3:40 pm    Post subject: A couple questions about auto assembler Reply with quote

Hi,

I'd like to ask how you use pointers instead of addresses in auto assembly, and why certain things used here.

For example, I see this in one of the tuts here:

01002FF5: <--- this is an addy, but where's the offset?
MineSweeper
jmp WhatNowMinesweeper
nop <--- why do you need to use this here?
ReturnHere: <--- why not put this below the "mov [0100579c],eax" line, right above [disable] (is the next line that I excluded from here)

WhatNowMinesweeper:
push eax
mov eax,[ChiliDog
mov [0100579C],eax <--- no offset either?

[disable]
blablabla

My last question is "ret." What exactly is it and how is it used? I understand it means to return, but I'm still confused. Thanks.
Back to top
View user's profile Send private message MSN Messenger
Evlesoa
Expert Cheater
Reputation: 0

Joined: 26 Oct 2006
Posts: 126

PostPosted: Fri Jan 30, 2015 9:09 am    Post subject: Reply with quote

Bump. Can anyone help, please?
Back to top
View user's profile Send private message MSN Messenger
Pingo
Grandmaster Cheater
Reputation: 8

Joined: 12 Jul 2007
Posts: 571

PostPosted: Fri Jan 30, 2015 2:11 pm    Post subject: Reply with quote

01002FF5: <--- this is an addy, but where's the offset?
The address is static. It doesn't need an offset unless the game codeshifts.

nop <--- why do you need to use this here?
Because the original instruction at 01002FF5 is 6 bytes long.
Jumping to a codecave only requires 5 bytes, so we nop that last byte.
All the extra bytes will be nopped.

ReturnHere: <--- why not put this below the "mov [0100579c],eax"
ReturnHere takes of the value of your next instruction address.
So ReturnHere = 01002FFB. It just makes it easier for some people, DB is nice that way.

Heres a small example
Code:
0031038D - FF 81 4C010000        - inc [ecx+0000014C]
00310393 - 8B B1 44010000        - mov esi,[ecx+00000144]


You wouldn't need to create a script like this since changing 1 byte will have the same result, I'm just using it as an example.

Code:
[Enable]
alloc(newmem,2048)
label(returnhere)

0031038D:
jmp newmem
db 90
returnhere://<-Now equals 00310393

newmem:
dec [ecx+0000014C]
jmp returnhere//<- Jump to 00310393

[Disable]
0031038D:
inc [ecx+0000014C]
dealloc(newmem)


Is the same as doing this
Code:
[Enable]
alloc(newmem,2048)

0031038D:
jmp newmem
db 90

newmem:
dec [ecx+0000014C]
jmp 00310393

[Disable]
0031038D:
inc [ecx+0000014C]
dealloc(newmem)


I might not be 100% in explaining it. I'm crap at explaining things, I just do stuff without thinking.

_________________
Back to top
View user's profile Send private message
Evlesoa
Expert Cheater
Reputation: 0

Joined: 26 Oct 2006
Posts: 126

PostPosted: Sat Jan 31, 2015 2:48 am    Post subject: Reply with quote

That works. Helps a lot. Thank you!!
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites