| View previous topic :: View next topic |
| Author |
Message |
podstanar
Advanced Cheater
 Reputation: 4
Joined: 02 May 2012
Posts: 82
Location: Flatland
|
 Posted: Thu May 03, 2012 7:57 pm Post subject: Code cave usage? |
 |
|
Hello,as the title states,i need help about code caves usage. I've been practicing and came up with this script(Spider Solitaire).In short,how can i implement code cave/s in it:
| Code: | [ENABLE]
alloc(code_moves,512)
alloc(code_score,512)
label(return_moves)
label(return_score)
{-------------------}
{ Moves }
{-------------------}
01004DC0:
jmp code_moves
db 90
return_moves:
code_moves:
db C7 86 50 03 00 00 00 00 00 00
jmp return_moves
{-------------------}
{ Score }
{-------------------}
010035D1:
jmp code_score
db 90
return_score:
code_score:
db 89 08 C7 00 F4 01 00 00 3B 0A 0F 8E C9 33 31 00
jmp return_score
[DISABLE]
dealloc(code_moves)
01004DC0:
db FF 86 50 03 00 00
dealloc(code_score)
010035D1:
db 89 08 3B 0A 7E 02 |
Everything i tried so far crashed the game, if someone can actually explain or give an example, it will be much appreciated.
|
|
| Back to top |
|
 |
podstanar
Advanced Cheater
Reputation: 4
Joined: 02 May 2012
Posts: 82
Location: Flatland
|
| Posted: Fri May 04, 2012 4:07 am Post subject: |
|
|
| Maybe i was not clear enough, actually i want to use code caves instead of allocating memory, the point is to be able to create trainer with CE(i guess static place in memory is needed for trainers, otherwise i will just stick with "alloc" function). I know how to find them(using CE's code cave finder) but i need to know how to properly use them in my scripts. For example, how can i use one cave for multiple injections?
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25854
Location: The netherlands
|
| Posted: Fri May 04, 2012 6:23 am Post subject: |
|
|
don't use code caves, just use alloc. CE trainers work perfectly fine with memory allocations
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
igor
Expert Cheater
![]() Reputation: 1
Joined: 04 Apr 2012
Posts: 145
|
|
| Back to top |
|
|
podstanar
Advanced Cheater
Reputation: 4
Joined: 02 May 2012
Posts: 82
Location: Flatland
|
| Posted: Sat May 05, 2012 6:51 am Post subject: |
|
|
| Thanks. On my second question, does anybody know how can i implement the code i posted above in only one cave? Instead of injecting at two places in memory can it be done on only one?
|
|
| Back to top |
|
|
igor
Expert Cheater
![]() Reputation: 1
Joined: 04 Apr 2012
Posts: 145
|
| Posted: Sat May 05, 2012 8:35 am Post subject: |
|
|
| 416c6558 wrote: | | Thanks. On my second question, does anybody know how can i implement the code i posted above in only one cave? Instead of injecting at two places in memory can it be done on only one? |
No you can't use in one cave. You have to use seperate addresses.
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 471
Joined: 09 May 2003
Posts: 25854
Location: The netherlands
|
| Posted: Sat May 05, 2012 9:07 am Post subject: |
|
|
as for your original code that you posted, that will not work, and code caves are not going to help you
First part:
| Code: |
01004DC0:
jmp code_moves
db 90
return_moves:
code_moves:
db C7 86 50 03 00 00 00 00 00 00
jmp return_moves
|
It looks like you are overwriting a 10 byte instruction and then jump back 6 bytes after the instruction, so executing 00 00 00 : which is add [eax],al
change the script to:
| Code: |
01004DC0:
jmp code_moves
nop
nop
nop
nop
nop
return_moves:
code_moves:
mov [esi+00000350],00000000
jmp return_moves
|
As for score:
| Code: |
010035D1:
jmp code_score
db 90
return_score:
code_score:
db 89 08 C7 00 F4 01 00 00 3B 0A 0F 8E C9 33 31 00
jmp return_score
|
here 3 things are wrong.
1: The number of nops, you're jumping into random code again
2: You only need to replace 2 instructions, not 4
3: 0F 8E C9 33 31 00 : Is "jng xxxxxxxx" , which is a relative instruction based on the current eip. The location of "jng xxxxxxxx" determines the bytes of that instruction
Also, this instruction is beyond the minimum number of instructions to replace, so you don't even need to do this
the correct script would be:
| Code: |
010035D1:
jmp code_score
nop
nop
nop
return_score:
code_score:
mov [eax],ecx
mov [eax],000001F4
jmp return_score
|
Tip: Use the template->code injection menu option in the auto assembler to write a functional code injection for you, it fills in the correct number of nops
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
