View previous topic :: View next topic |
Author |
Message |
DropSite How do I cheat?
Reputation: 0
Joined: 17 Sep 2015 Posts: 2
|
Posted: Thu Sep 17, 2015 9:59 pm Post subject: Are there any signature pattern generator plugins? |
|
|
Something similar to IDA plugin sigmaker by patrick.
Where you right click on an address in the disassembly and generate a mask with wildcards automatically.
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Sep 17, 2015 10:18 pm Post subject: |
|
|
Press CTRL+A to open Auto Assembler and choose Template > AOB Injection?
|
|
Back to top |
|
 |
atom0s Moderator
Reputation: 205
Joined: 25 Jan 2006 Posts: 8587 Location: 127.0.0.1
|
Posted: Fri Sep 18, 2015 1:26 am Post subject: |
|
|
He's looking for a way to highlight a given amount of instructions in the disassembler window and have it create a viable array of bytes with wildcards automatically. Cheat Engine does not currently have anything outside of copying all the bytes as-is for the selected instructions.
_________________
- Retired. |
|
Back to top |
|
 |
aikoncwd Grandmaster Cheater
Reputation: 23
Joined: 21 Dec 2012 Posts: 591 Location: Spain (Barcelona)
|
|
Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Fri Sep 18, 2015 2:50 am Post subject: |
|
|
That would be a very smart thing to ask from a program. You can safely wildcard some bytes e.g the call ones starting with E8, perhaps E9 but for other instructions simply assuming the bytes are going to change makes for an unnecessarily long signature or a difficult one.
For example, i have seen some people wildcard the offsets in instructions like these
mov eax, dword ptr [esi+160]
ret
int 3
int 3
With the offset(constant)160 included, the signature is perfect and sigscanning will yield the desired address but if you wildcard the offset, you will find other similar instructions because that set of instruction is too generic. Adding more bytes to the sig (above the mov instruction or the CC bytes) will make for a unique instruction but then you are relying on a major area of the function to NOT change when chances are the offset 160 will most likely never change.
My point being selecting a good signature and wildcarding is more of an intuitive decision and a program can't decide what will be a good sig.
_________________
|
|
Back to top |
|
 |
Rydian Grandmaster Cheater Supreme
Reputation: 31
Joined: 17 Sep 2012 Posts: 1358
|
Posted: Fri Sep 18, 2015 3:09 am Post subject: |
|
|
The AOB injection template will recognize and automatically wildcard certain things for code.
Aikon's tool is good for an AOB to data, which is generally when your AOB is Xbox-Huge.
_________________
|
|
Back to top |
|
 |
DropSite How do I cheat?
Reputation: 0
Joined: 17 Sep 2015 Posts: 2
|
Posted: Mon Sep 21, 2015 4:30 am Post subject: |
|
|
Couldn't find one so I made the plugin and posted it on UnknownCheats.
|
|
Back to top |
|
 |
|