Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


How to identify the right opcode???
Goto page 1, 2  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 49

PostPosted: Tue Feb 10, 2015 3:43 am    Post subject: How to identify the right opcode??? Reply with quote

Hello

How do I identify right opcode for AA script? There are always more then one and they look all very similar... Can anyone give me some hint ont this?

Example:

Code:

0BE602CF - 0F7E 86 F0000000  - movd [esi+000000F0],mm0
0BE631AD - F3 0F7E 80 F0000000  - movq xmm0,[eax+000000F0]
0BE63659 - F3 0F7E 81 F0000000  - movq xmm0,[ecx+000000F0]
0C49B26C - F3 0F7E 8A F0000000  - movq xmm1,[edx+000000F0]
0C5E5B27 - F3 0F7E 8A F0000000  - movq xmm1,[edx+000000F0]
0C61403B - F3 0F7E 80 F0000000  - movq xmm0,[eax+000000F0]
0C614047 - 66 0FD6 80 F0000000  - movq [eax+000000F0],xmm0
0C6141EA - F3 0F7E 88 F0000000  - movq xmm1,[eax+000000F0]


This is after one hit one me (hp dmg) I am trying to do godmode (it is a flash game)
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 111

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Tue Feb 10, 2015 4:53 am    Post subject: Reply with quote

Check all of them to see if any of those codes are accessing to your health only.
_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
aikoncwd
Grandmaster Cheater
Reputation: 23

Joined: 21 Dec 2012
Posts: 591
Location: Spain (Barcelona)

PostPosted: Tue Feb 10, 2015 10:41 am    Post subject: Reply with quote

Use this option:



This will show if an opcode is accessing more than 1 address at same time. Then pick the opcode with (1) access. If every opcode is accessing more than 1 address (shared code) then press "More Information" and use that info (registers or StackView) to dissect and determine the correct address

Smile

_________________
Hey Hitler
Test here your skill with CheatEngine, I coded a challenge for you. Try to beat it!
HERE
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 49

PostPosted: Tue Feb 10, 2015 1:25 pm    Post subject: Reply with quote

Well here

All of them access only health address...



opcode.jpg
 Description:
 Filesize:  232.55 KB
 Viewed:  17106 Time(s)

opcode.jpg


Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 111

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Tue Feb 10, 2015 1:59 pm    Post subject: Reply with quote

Then just pick one that you like.
_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 49

PostPosted: Tue Feb 10, 2015 2:41 pm    Post subject: Reply with quote

And can u tell me what is wrong with this script?

Code:
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
push eax //place your code here
mov eax,[_player+b8] //this is toughness
add eax,eax
add eax,#65 //max hp is (2*toughness)+65
mov [esi+000000F0],eax
pop eax

originalcode:
movd [esi+000000F0],mm0

exit:
jmp returnhere

0BE602CF:
jmp newmem
nop
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
0BE602CF:
movd [esi+000000F0],mm0
//Alt: db CC 7E 86 F0 00 00 00
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 111

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Tue Feb 10, 2015 2:56 pm    Post subject: Reply with quote

Yes, you have used wrong instructions and value type. Your value is double and you are using instructions for integers instead.

Since you are clearly not familiar with handling double values at the moment, I recommend to just force a static value instead of trying to go for the max HP (in other words, freeze the value to some fix amount).
You can do that with mov instructions and it will work, just don't forget that you have to modify 8 bytes, not only 4.

If you insist on doing it the hard way, you have to use instructions for float values and if toughness is an integer, you also have to convert it to double.

Or you can find an address where max HP is stored and copy the max HP to the current HP, which is also possible with mov instructions.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 49

PostPosted: Tue Feb 10, 2015 4:34 pm    Post subject: Reply with quote

Quote:
If you insist on doing it the hard way, you have to use instructions for float values and if toughness is an integer, you also have to convert it to double.


Toughness value is double. _player+b8 = address to double value 15...max hp is 2*x+65 where x=toughness...there is not too much about float instructions here or i didnt look in right tutorials. I found some: fld, fadd, fstp but with a little explanation what they do and how to use them...

I didnt find max hp value and when i try to freez hp it slow down game and usualy crash after a while...I dont think there is max hp value becouse if I set hp to 1000 when my actual max id 95 it will not jump back to 95 but decrease from 1000 when i get hit...
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 111

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Tue Feb 10, 2015 5:38 pm    Post subject: Reply with quote

If health will not jump back to some max HP value, then why don't you just change health to a really high amount instead of freezing it? Then you wouldn't run out of health and you don't have to freeze it.

As for float instructions, they work differently from the ones that you have used for integers.

fld will load the first value (eg toughness). Then you can use fadd to add a certain amount to it. Keep it in mind that you have to add float value to a float value, not integer and that float instructions will not accept a number as parameter, so you have to store (double)65 on an address.

When you are done, use fstp to store the value where you want it to be (eg store it on the health address).
You also have to use qword instead of dword, because your value is double.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 49

PostPosted: Tue Feb 10, 2015 6:31 pm    Post subject: Reply with quote

Quote:
If health will not jump back to some max HP value, then why don't you just change health to a really high amount instead of freezing it? Then you wouldn't run out of health and you don't have to freeze it.


Becouse hp have graphic bar and with higher value then max it goes right throught middle of the screen so u cant see things behind bar...

I changed script a little but there is still something wrong with instructions...

Code:
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
label(_add)
registersymbol(_add)

newmem: //this is allocated memory, you have read,write,execute access
_add:
push eax
mov eax,db65
mov [_add],eax
fld qword [_add]
fld qword [_player+b8]
fadd [_player+b8]
fadd [_add]
fst qword [esi+000000F0]
pop eax

originalcode:
movd [esi+000000F0],mm0

exit:
jmp returnhere

0BE602CF:
jmp newmem
nop
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
0BE602CF:
movd [esi+000000F0],mm0
//Alt: db CC 7E 86 F0 00 00 00


It set hp to 15 (i guess toughness value [_player+b8]) and it crashes a game.


PS: sorry for my english...
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 111

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Tue Feb 10, 2015 6:50 pm    Post subject: Reply with quote

Code:
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem+500:
dq 4050400000000000        //this is (double)65 in hex, stored on a randomly chosen empty location in newmem

newmem: //this is allocated memory, you have read,write,execute access
movd [esi+000000F0],mm0 //this comes first, or your code is useless
fld qword ptr [_player+b8]     //load toughness
fadd qword ptr [_player+b8]   //add toughness to double it
fadd qword ptr [newmem+500]   //add 65
fstp qword ptr [esi+000000F0]     //save the value on health


originalcode:

exit:
jmp returnhere

0BE602CF:
jmp newmem
nop
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
0BE602CF:
movd [esi+000000F0],mm0
//Alt: db CC 7E 86 F0 00 00 00


But I have no idea how do you get toughness, because it's not defined in this script.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
aikoncwd
Grandmaster Cheater
Reputation: 23

Joined: 21 Dec 2012
Posts: 591
Location: Spain (Barcelona)

PostPosted: Tue Feb 10, 2015 6:50 pm    Post subject: Reply with quote

Hey, read this:

http://forum.cheatengine.org/viewtopic.php?p=5572126

Your original opcode is doing this:

Code:
movd [esi+000000F0],mm0


Then you can modify mm0, like this:

Code:

label(newvalue)

code:
movd xmm0,[newvalue]
movd [esi+000000F0],mm0
jmp return

newvalue:
dq (float)999


You need to define a new label and asign the value with dd or dq (double or quadra), then use movd or modq [label]

Smile

_________________
Hey Hitler
Test here your skill with CheatEngine, I coded a challenge for you. Try to beat it!
HERE
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 49

PostPosted: Tue Feb 10, 2015 7:44 pm    Post subject: Reply with quote

Quote:
But I have no idea how do you get toughness, because it's not defined in this script.


I have other script that define _player + table with offsets for stats

Code:
[ENABLE]
aobscan(player, 80 40 ?? ?? 03 00 00 ?? ?? ?? ?? 06 ?? ?? ?? 07 ?? 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 68 D2 ?? ?? 68 D2 ?? ?? 68 D2 ?? ?? 68 D2)
label(_player)
registersymbol(_player)

player:
_player:

[DISABLE]
unregistersymbol(_player)


I tried your script but it didnt work...

Quote:
You need to define a new label and asign the value with dd or dq (double or quadra), then use movd or modq [label]


Tried like this and it didnt work...

Code:
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem+500:
dq 408F380000000000

newmem: //this is allocated memory, you have read,write,execute access
movd xmm0,[newmem+500]
movd [esi+000000F0],mm0
jmp returnhere

originalcode:
movd [esi+000000F0],mm0

exit:
jmp returnhere

0BF3031F:
jmp newmem
nop
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
0BF3031F:
movd [esi+000000F0],mm0
//Alt: db 0F 7E 86 F0 00 00 00
Back to top
View user's profile Send private message
aikoncwd
Grandmaster Cheater
Reputation: 23

Joined: 21 Dec 2012
Posts: 591
Location: Spain (Barcelona)

PostPosted: Tue Feb 10, 2015 7:54 pm    Post subject: Reply with quote

The script works, you only need to use dq or dd in your example.

Try another thing... look some opcodes above and find where mm0 get the value, imagine this:

Code:

...
...
movd xmm0,[edi+50] //here is where mm0 get the value
movd xmm1,[edi+60]
...
...
subsd xmm0,xmm1
...
...

...
movd [esi+000000F0],mm0 //original opcode


Then do this:

Code:

...
...
mov [edi+50],(double)99999 //here is where I set my newvalue
movd xmm0,[edi+50] //here is where mm0 get the value (9999)
movd xmm1,[edi+60]
...
...
subsd xmm0,xmm1
...
...

...
movd [esi+000000F0],mm0 //original opcode "modified"


But seriusly, read the link I posted above, it works if you use dq or dd and movd or movq in your example.

=============================

Or try this:

Code:
[ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
label(newvalue)

newmem:
movd mm0,[newvalue]
jmp originalcode

originalcode:
movd [esi+000000F0],mm0
jmp returnhere

exit:
jmp returnhere

newvalue:
dd 500(float)

0BF3031F:
jmp newmem
nop
nop
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
0BF3031F:
movd [esi+000000F0],mm0
//Alt: db 0F 7E 86 F0 00 00 00

_________________
Hey Hitler
Test here your skill with CheatEngine, I coded a challenge for you. Try to beat it!
HERE
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 111

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Tue Feb 10, 2015 8:02 pm    Post subject: Reply with quote

Be more specific. What didn't work and what happens exactly?
You should also try code injection on some other codes, maybe this one is not working after all.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites