Cheat Engine

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

I am attempting to fix a script, which I've attached a screenshot of.

Obviously the AOB is not working in my favour, and I know that the opcode "Meta.Missions.ItemFilter.GetItemQuantity" still exists, but I have no idea how to search for it (using mono + ctrl G doesn't find it as an address, and I did try searching assembly code....but even being left on over night for 10 hours it didn't finish so it was a bit slow, and I'm not sure how to speed that process up).

I am not sure which part of the code I should try and use wildcards for as I am still very new to learning how to do this.

All I am 100% certain about is that the object in question does use "2090000001" as it's "item type".

ParkourPenguin · Posted: Mon May 06, 2024 11:20 am Post subject:

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

ParkourPenguin · Posted: Mon May 06, 2024 12:44 pm Post subject:

Oh, that was a script generated from an older version of the game. I see now.

A lot of stuff could've changed. Offsets, registers, instruction sizes (e.g. REX prefixes), the order of instructions, etc. There isn't an easy guaranteed way to find the new injection point.

That first call looks like a decent place to start from. Try this pattern:
E8 ?? ?? ?? ?? 83 F8 01 0F 84 ?? ?? 00 00 8B

That `je` is annoying because the offset isn't that far away. It could be using a `je rel8` opcode instead of `je rel32` opcode.

Maybe the couple calls below the injection point could be good too.
E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 45 33 C0 48 8B D0 E8

If that fails, you could try methodically searching for that call to Meta.Missions.ItemFilter.GetItemQuantity. An easy way is to run "Memory Viewer -> Tools -> Dissect code" on that dll. That might take a while (roughly an hour or two) depending on how big the dll is. When you're done, you can select File -> Save in the dissect code window so you don't have to do that again next time.
After that completes, just go to Meta.Missions.ItemFilter.GetItemQuantity in the disassembler and see what calls that address. You can use Lua to help:

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

ParkourPenguin · Posted: Mon May 06, 2024 1:23 pm Post subject:

Yes, that looks as close to it as you can get. The calls, static addresses, memory accesses, etc. are all in the same place. It's just the registers and offsets that have changed.

The instruction you want to inject at is at dll+32D0A1A - `mov rbx,[r12+60]`. Open a new AA window and make a new AOB injection template at that address.
You'll need to change the injected code too: obviously change r15 to r12, but as for the offsets the injected code uses, I'm not certain. You'll need to dissect data and figure it out. Since the new offset in the original code is 8 bytes after the old offset, perhaps it's the same for those other offsets: I'd check the values at the offsets 78, 80, and 84 first.

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

ParkourPenguin · Posted: Mon May 06, 2024 1:44 pm Post subject:

Yes, but I'd try dissect data first.

Find out what addresses the instruction `mov rbx,[r12+60]` accesses (right click it in the disassembler), let the game run for a little while and do whatever you need to do to trigger that code to run, select everything that comes up, and right click -> Open dissect data with selected addresses

Then just visually inspect what's around offset 70 through 90. Maybe you'll see something that sticks out, or maybe you won't. Changing random values can also be effective- just make sure you have a backup of your save somewhere.

Also, make sure you generate a new AOB injection template. Don't reuse the old script. The original code obviously changed, and you'll want to keep a copy of the instructions around the new injection point.

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

ParkourPenguin · Posted: Mon May 06, 2024 2:16 pm Post subject:

Good, there's debug/reflection info available for fields too.

It's probably 78, 80, and 84. Offset 7C looks interesting too, but do whatever you want.

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

ParkourPenguin · Posted: Mon May 06, 2024 2:40 pm Post subject:

You probably have that the other way around. `call rel32` instructions can't trigger "Find out what addresses this instruction accesses".

Anyway, post the script you're using.

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

ParkourPenguin · Posted: Mon May 06, 2024 3:00 pm Post subject:

Rubyelf · Cheater Reputation: 0 Joined: 08 Mar 2013 Posts: 29

I fixed it! Thank you so much for all the help!

I messed up somewhere along the way when swapping it over and got it fixed!

Now I need to figure out this one.

In the past I could search "<>c.<ToServerConfig>b__158_0" with mono, but it no longer exists, and the ones that have similar names don't appear to look anything like it anymore.