 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
Evlesoa Expert Cheater
Reputation: 0
Joined: 26 Oct 2006 Posts: 126
|
Posted: Wed Jan 21, 2015 3:40 pm Post subject: A couple questions about auto assembler |
|
|
Hi,
I'd like to ask how you use pointers instead of addresses in auto assembly, and why certain things used here.
For example, I see this in one of the tuts here:
01002FF5: <--- this is an addy, but where's the offset?
MineSweeper
jmp WhatNowMinesweeper
nop <--- why do you need to use this here?
ReturnHere: <--- why not put this below the "mov [0100579c],eax" line, right above [disable] (is the next line that I excluded from here)
WhatNowMinesweeper:
push eax
mov eax,[ChiliDog
mov [0100579C],eax <--- no offset either?
[disable]
blablabla
My last question is "ret." What exactly is it and how is it used? I understand it means to return, but I'm still confused. Thanks.
|
|
Back to top |
|
 |
Evlesoa Expert Cheater
Reputation: 0
Joined: 26 Oct 2006 Posts: 126
|
Posted: Fri Jan 30, 2015 9:09 am Post subject: |
|
|
Bump. Can anyone help, please?
|
|
Back to top |
|
 |
Pingo Grandmaster Cheater
Reputation: 8
Joined: 12 Jul 2007 Posts: 571
|
Posted: Fri Jan 30, 2015 2:11 pm Post subject: |
|
|
01002FF5: <--- this is an addy, but where's the offset?
The address is static. It doesn't need an offset unless the game codeshifts.
nop <--- why do you need to use this here?
Because the original instruction at 01002FF5 is 6 bytes long.
Jumping to a codecave only requires 5 bytes, so we nop that last byte.
All the extra bytes will be nopped.
ReturnHere: <--- why not put this below the "mov [0100579c],eax"
ReturnHere takes of the value of your next instruction address.
So ReturnHere = 01002FFB. It just makes it easier for some people, DB is nice that way.
Heres a small example
Code: | 0031038D - FF 81 4C010000 - inc [ecx+0000014C]
00310393 - 8B B1 44010000 - mov esi,[ecx+00000144] |
You wouldn't need to create a script like this since changing 1 byte will have the same result, I'm just using it as an example.
Code: | [Enable]
alloc(newmem,2048)
label(returnhere)
0031038D:
jmp newmem
db 90
returnhere://<-Now equals 00310393
newmem:
dec [ecx+0000014C]
jmp returnhere//<- Jump to 00310393
[Disable]
0031038D:
inc [ecx+0000014C]
dealloc(newmem) |
Is the same as doing this
Code: | [Enable]
alloc(newmem,2048)
0031038D:
jmp newmem
db 90
newmem:
dec [ecx+0000014C]
jmp 00310393
[Disable]
0031038D:
inc [ecx+0000014C]
dealloc(newmem) |
I might not be 100% in explaining it. I'm crap at explaining things, I just do stuff without thinking.
_________________
|
|
Back to top |
|
 |
Evlesoa Expert Cheater
Reputation: 0
Joined: 26 Oct 2006 Posts: 126
|
Posted: Sat Jan 31, 2015 2:48 am Post subject: |
|
|
That works. Helps a lot. Thank you!!
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|