Cheat Engine

Himsly · How do I cheat? Reputation: 0 Joined: 17 Apr 2016 Posts: 3

I try to make AA using some Opcode when playing an emulated game Shinobi no Sato no Jintori Gassen (Japan) ISO but it make confuse when there are multiple register on value [], there are eax+ecx, here the code list:

1. mov [eax+ecx],ebx // for player score
2. mov [ecx+eax],bx // for player ball

here is the image on codelist and AA on attachment:

When I add that code there is another address on it inside AA, I mean, "and edx,001FFFFC" on the address, here the code injection:

alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
mov [ecx+eax],bx
and edx,001FFFFC

exit:
jmp returnhere

08DD0334:
jmp newmem
nop
nop
nop
nop
nop
returnhere:

so, my question is,

1. How to deal with multiple register inside the value [], like [ecx+eax]?
2. How to make right code injection based on above AA script? I want to add ball every it decrease?

Thank you so much, Any help will be very appreciated.

++METHOS · Posted: Sun Apr 17, 2016 10:17 pm Post subject:

You can try this:

Himsly · How do I cheat? Reputation: 0 Joined: 17 Apr 2016 Posts: 3

++METHOS · Posted: Sun Apr 17, 2016 10:44 pm Post subject:

1. That is just the instruction below your injection point. It was added as part of the originalcode because of the amount of bytes required for your injection relocation.
2. When you create your script, in the auto assembly window, there should be a template call AOB Injection. Use that and CE will build your script for you, including the AOB. If no unique signature can be found (which is common with emulators), then you'll have to expand on the signature, manually.

Himsly · How do I cheat? Reputation: 0 Joined: 17 Apr 2016 Posts: 3

++METHOS · Posted: Sun Apr 17, 2016 11:04 pm Post subject:

Are you sure that you are working from the correct injection point? If you NOP the instruction mov [ecx+eax],bx what happens?

If the desired effect does not play out after NOP'ing the instruction, then perhaps another instruction is writing to the ball address. Since it's an emulator, you'll probably have to filter out addresses, which leads back to your first question:

mov [ecx+eax],bx

In this case, ecx or eax may hold the identifier needed for your filter.

If you've found the address that alters the number of balls (without it resetting back after losing another ball), then right-click on that address to see what is writing to it. Lose two more balls to let the debugger populate. If more than one instruction shows up, then you may need to use multiple injections.

PinPoint · Posted: Mon Apr 18, 2016 1:46 am Post subject:

++METHOS · Posted: Mon Apr 18, 2016 2:42 am Post subject:

As previously mentioned, in the case of emulators, formats such as [ecx+eax] often contain the ID in one of the registers. You can check to see what the values are for those registers, for the value that you're interested in, then, write a script that will filter out everything except the 'ID' for your target value. This will help you to verify if the filter is valid or not.

Pointerscans, as well as injection (even with AOB), can be tricky with emulators.

PinPoint · Posted: Mon Apr 18, 2016 4:59 am Post subject:

sorry, i wrote it wrong on here. this was what i meant

++METHOS · Posted: Mon Apr 18, 2016 2:17 pm Post subject:

Yes, but you still have to filter out the bad addresses. If you need help with something, just ask. Once you have a reliable filter in place, you can paste your script if you need help with that.

I would start by checking to see what the value is for those two registers [eax+ecx], for your targeted address (balls remaining value?). Once you do that, you can write a filter that will filter out everything that doesn't match. For example...

Let's say that eax holds the address of your targeted value (minus ecx), and ecx holds the ID, which, when added to eax, equals your targeted value. Now, let's say that you find out ecx is 14 for your targeted value. Just write a script that will compare ecx to 14, and if it is, jumps to a section of code that is separate to everything else. In that section of code, you can right-click on it to see what addresses it accesses. If it only accesses your targeted address, then you're good to go; you know that you can use that as an ID for your filter. Once you have the ID, write your script to store the address for future manipulation, without the need to use any traditional pointers.

PinPoint · Posted: Mon Apr 18, 2016 3:13 pm Post subject:

++METHOS · Posted: Mon Apr 18, 2016 4:38 pm Post subject:

So, in this case, EAX=0000EB1C and ECX=00C379A0.

Since ECX looks like an address and EAX looks more like an offset...EAX may contain your ID, so you'll want to compare against that.

So, you would do something like this:

PinPoint · Posted: Mon Apr 18, 2016 4:58 pm Post subject:

++METHOS · Posted: Mon Apr 18, 2016 5:05 pm Post subject:

If the instruction is accessing many addresses, then you'll have to find a better filter. There are a lot of ways to find a reliable filter. I would start with the other registers: