FreeER
Grandmaster Cheater Supreme
![]() Reputation: 53
Joined: 09 Aug 2013
Posts: 1091
|
 Posted: Thu Mar 23, 2017 8:18 am Post subject: |
 |
|
Here's 3 examples for step 4 of the tutorial (i386/x86 v3.3, ce 6.6)
This changes the values that the tutorial is checking against so that they match the starting values
| Code: | [ENABLE]
"Tutorial-i386.exe"+1A2798:
dd (float)100
"Tutorial-i386.exe"+1A27A0:
dq (double)100
[DISABLE]
"Tutorial-i386.exe"+1A2798:
dd (float)5000
"Tutorial-i386.exe"+1A27A0:
dq (double)5000
|
This changes the actual values to the desired values based on pointers
| Code: | [ENABLE]
// set addresses based on pointers
["Tutorial-i386.exe"+1FC600]+494:
dd (float)1000
["Tutorial-i386.exe"+1FC600]+498:
dq (double)1000
[DISABLE]
// set to passing value on disable, because why not? This is just a demo after all
["Tutorial-i386.exe"+1FC600]+494:
readmem("Tutorial-i386.exe"+1A2798,4)
["Tutorial-i386.exe"+1FC600]+498:
readmem("Tutorial-i386.exe"+1A27A0,8) |
And this nops the jmps that are normally taken when the comparisons with the current and desired/passing values fail, essentially making the tutorial believe that the comparisons were passed and that the values were equal.
| Code: | [ENABLE]
//7A 43 72 41 DD 05 D0 D7 5D 00) // should be unique
aobscanmodule(step4,Tutorial-i386.exe,?? ?? ?? ?? dd 05 ?? ?? ?? ?? dd 83)
step4:
// nop health float jumps
db 90 90 90 90
step4+15:
// nop ammo double jumps
db 90 90 90 90
registersymbol(step4)
[DISABLE]
step4:
db 7A 43 72 41
step4+15:
db 7A 2E 72 2C
unregistersymbol(step4)
{
Tutorial-i386.exe+24744 - 7A 43 - jp Tutorial-i386.exe+24789
Tutorial-i386.exe+24746 - 72 41 - jb Tutorial-i386.exe+24789
Tutorial-i386.exe+24748 - DD 05 A0275A00 - fld qword ptr [Tutorial-i386.exe+1A27A0] { [5000.00]
Tutorial-i386.exe+2474E - DD 83 98040000 - fld qword ptr [ebx+00000498]
Tutorial-i386.exe+24754 - DED9 - fcompp
Tutorial-i386.exe+24756 - DFE0 - fnstsw ax
Tutorial-i386.exe+24758 - 9E - sahf
Tutorial-i386.exe+24759 - 7A 2E - jp Tutorial-i386.exe+24789
Tutorial-i386.exe+2475B - 72 2C - jb Tutorial-i386.exe+24789
}
|
I already had the first and last in my cheat table.
As you can probably see, it's just a matter of giving CE two addresses and values to write instead of just one. You can do the same with aobscans (just use different names/labels)
Chris Fayte has a video where he combines two aob scripts into one so that both are done at the same time:
https:
//youtu.
be/1nsy9pb3sQY
?t=13m45s
You can start at 13 minutes and 45 seconds in (specified by the last line) if you want to skip seeing the two scripts created in the first place
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
