 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
gid2525
Expert Cheater
![]() Reputation: 2
Joined: 21 Oct 2013
Posts: 103
|
 Posted: Thu Jun 01, 2017 12:58 pm Post subject: AOB Script help for signature offset |
 |
|
Hi, so when I use the basic AOBscan template what do I change if I want to jump and alter code of an AOB signature with an offset?
like here:
| Code: |
[ENABLE]
aobscanmodule(buyany,StarpointGeminiWarlords.exe,44 88 B8 01 03 00 00 E8 4E) // should be unique
alloc(newmem,$1000,"StarpointGeminiWarlords.exe"+1A68D6)
label(code)
label(return)
newmem:
code:
mov [rax+00000301],0
jmp return
buyany:
jmp newmem
nop
nop
return:
registersymbol(buyany)
[DISABLE]
buyany:
db 44 88 B8 01 03 00 00
unregistersymbol(buyany)
dealloc(newmem)
|
That is the script cheat engine generated. I don't want it to jump at "StarpointGeminiWarlords.exe"+1A68D6 because that may change when it gets patched. But I want a more unique AOB signature that will (hopefully)work with patches. I came up with this signature:
| Code: |
48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0 ?? ?? ?? ?? ?? ?? ?? jump and edit code here--->48 8B CF 44 88 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0
|
The above signature is unique works on two different versions of the game so its a good one.
I need it to jump at the part shown above so I know I need an offset and I guess take out the "StarpointGeminiWarlords.exe"+1A68D6
part. I know I have to add an offset in hex like "buyany+32" but not sure how to format the script above properly. Thanks for the help!
|
|
| Back to top |
|
 |
Rudo
Advanced Cheater
 Reputation: 2
Joined: 27 Jun 2015
Posts: 80
|
| Posted: Thu Jun 01, 2017 6:11 pm Post subject: |
|
|
| Code: |
[ENABLE]
aobscanmodule(buyany,StarpointGeminiWarlords.exe,<your long aob here> )
alloc(newmem,$1000) // may want to remove "StarpointGeminiWarlords.exe"+1A68D6
label(code)
label(return)
newmem:
code:
mov [rax+00000301],0
jmp return
buyany+32: // <==== here
jmp newmem
nop
nop
return:
registersymbol(buyany)
[DISABLE]
buyany+32: // <=== and here
db 44 88 B8 01 03 00 00
unregistersymbol(buyany)
dealloc(newmem)
|
Also you may want to use readmem and/or reassemble so the script will still work after an update if the offset changes.
P/s: I didn't calculate the right offset, just used 32 to demonstrate how to modifiy the script.
|
|
| Back to top |
|
|
gid2525
Expert Cheater
![]() Reputation: 2
Joined: 21 Oct 2013
Posts: 103
|
| Posted: Thu Jun 01, 2017 7:57 pm Post subject: |
|
|
| Rudo wrote: | | Code: |
[ENABLE]
aobscanmodule(buyany,StarpointGeminiWarlords.exe,<your long aob here> )
alloc(newmem,$1000) // may want to remove "StarpointGeminiWarlords.exe"+1A68D6
label(code)
label(return)
newmem:
code:
mov [rax+00000301],0
jmp return
buyany+32: // <==== here
jmp newmem
nop
nop
return:
registersymbol(buyany)
[DISABLE]
buyany+32: // <=== and here
db 44 88 B8 01 03 00 00
unregistersymbol(buyany)
dealloc(newmem)
|
Also you may want to use readmem and/or reassemble so the script will still work after an update if the offset changes.
P/s: I didn't calculate the right offset, just used 32 to demonstrate how to modifiy the script. |
Looks like the offset is buyany+19 (25 bytes). It looks like its not working properly though.
Here is the original script (but from a different version):
| Code: |
[ENABLE]
aobscanmodule(buyanyship,StarpointGeminiWarlords.exe,44 88 B8 01 03 00 00 E8 7E) // should be unique
alloc(newmem,$1000,"StarpointGeminiWarlords.exe"+1A5D86)
label(code)
label(return)
newmem:
code:
mov [rax+00000301],0
jmp return
buyanyship:
jmp newmem
nop
nop
return:
registersymbol(buyanyship)
[DISABLE]
buyanyship:
db 44 88 B8 01 03 00 00
unregistersymbol(buyanyship)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "StarpointGeminiWarlords.exe"+1A5D86
"StarpointGeminiWarlords.exe"+1A5D5A: E8 81 A0 2B 00 - call StarpointGeminiWarlords.exe+45FDE0
"StarpointGeminiWarlords.exe"+1A5D5F: 48 8B CF - mov rcx,rdi
"StarpointGeminiWarlords.exe"+1A5D62: 3B D8 - cmp ebx,eax
"StarpointGeminiWarlords.exe"+1A5D64: 0F 8E 0C 01 00 00 - jng StarpointGeminiWarlords.exe+1A5E76
"StarpointGeminiWarlords.exe"+1A5D6A: 45 33 C0 - xor r8d,r8d
"StarpointGeminiWarlords.exe"+1A5D6D: 48 8D 15 04 9A 43 00 - lea rdx,[StarpointGeminiWarlords.exe+5DF778]
"StarpointGeminiWarlords.exe"+1A5D74: E8 97 D2 0D 00 - call StarpointGeminiWarlords.exe+283010
"StarpointGeminiWarlords.exe"+1A5D79: 45 33 C0 - xor r8d,r8d
"StarpointGeminiWarlords.exe"+1A5D7C: 48 8D 15 F5 99 43 00 - lea rdx,[StarpointGeminiWarlords.exe+5DF778]
"StarpointGeminiWarlords.exe"+1A5D83: 48 8B CF - mov rcx,rdi
// ---------- INJECTING HERE ----------
"StarpointGeminiWarlords.exe"+1A5D86: 44 88 B8 01 03 00 00 - mov [rax+00000301],r15l
// ---------- DONE INJECTING ----------
"StarpointGeminiWarlords.exe"+1A5D8D: E8 7E D2 0D 00 - call StarpointGeminiWarlords.exe+283010
"StarpointGeminiWarlords.exe"+1A5D92: 45 33 C0 - xor r8d,r8d
"StarpointGeminiWarlords.exe"+1A5D95: 48 8D 15 DC 99 43 00 - lea rdx,[StarpointGeminiWarlords.exe+5DF778]
"StarpointGeminiWarlords.exe"+1A5D9C: 48 8B CF - mov rcx,rdi
"StarpointGeminiWarlords.exe"+1A5D9F: 44 89 B8 04 02 00 00 - mov [rax+00000204],r15d
"StarpointGeminiWarlords.exe"+1A5DA6: E8 65 D2 0D 00 - call StarpointGeminiWarlords.exe+283010
"StarpointGeminiWarlords.exe"+1A5DAB: 48 8D 0D 9E FA 44 00 - lea rcx,[StarpointGeminiWarlords.exe+5F5850]
"StarpointGeminiWarlords.exe"+1A5DB2: 4C 8B C8 - mov r9,rax
"StarpointGeminiWarlords.exe"+1A5DB5: 41 8B D4 - mov edx,r12d
"StarpointGeminiWarlords.exe"+1A5DB8: 4C 8D 15 11 FB 44 00 - lea r10,[StarpointGeminiWarlords.exe+5F58D0]
}
|
Here is my new script:
| Code: |
[ENABLE]
aobscanmodule(buyany,StarpointGeminiWarlords.exe,48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0 ?? ?? ?? ?? ?? ?? ?? 48 8B CF 44 88 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0 ) // should be unique
alloc(newmem,$1000)
label(code)
label(return)
newmem:
code:
mov [rax+00000301],0
jmp return
buyany+19:
jmp newmem
nop
nop
return:
registersymbol(buyany)
[DISABLE]
buyany+19:
db 44 88 B8 01 03 00 00
unregistersymbol(buyany)
dealloc(newmem)
|
It jumps at the correct place but for some reason it wipes out the next two lines after the jump:
| Code: |
"StarpointGeminiWarlords.exe"+1A5D86: 44 88 B8 01 03 00 00 - mov [rax+00000301],r15l
// ---------- DONE INJECTING ----------
"StarpointGeminiWarlords.exe"+1A5D8D: E8 7E D2 0D 00 - call StarpointGeminiWarlords.exe+283010<<---Gone!why?
"StarpointGeminiWarlords.exe"+1A5D92: 45 33 C0 - xor r8d,r8d<<<---Gone! why?
|
Then when I deactivate the scripts its all messed up and does not go back the way it was....
|
|
| Back to top |
|
|
Rudo
Advanced Cheater
Reputation: 2
Joined: 27 Jun 2015
Posts: 80
|
| Posted: Thu Jun 01, 2017 11:54 pm Post subject: |
|
|
I think it has something to do with these lines:
| Code: | buyany+19:
jmp newmem
nop
nop |
But can't troubleshoot the problem because I don't have the game
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sun Jun 04, 2017 8:58 pm Post subject: |
|
|
| Code: | [ENABLE]
aobscanmodule(buyany,StarpointGeminiWarlords.exe,48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0 ?? ?? ?? ?? ?? ?? ?? 48 8B CF 44 88 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 33 C0)
alloc(buyany_backup,7)
buyany_backup:
readmem(buyany+19,7)
registersymbol(buyany_backup)
buyany+19:
db C6 80
readmem(buyany_backup+3,4)
db 00
registersymbol(buyany)
[DISABLE]
buyany+19:
readmem(buyany_backup,7)
unregistersymbol(buyany)
unregistersymbol(buyany_backup)
dealloc(buyany_backup) |
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
