 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
Magnum200 How do I cheat?
Reputation: 0
Joined: 26 Jul 2017 Posts: 4 Location: Earth
|
Posted: Sat Jul 29, 2017 7:47 pm Post subject: what is the use of knowing a games array of bytes |
|
|
I found the array of bytes for a game called murder miners and don't know what they are used for can anyone tell me.
|
|
Back to top |
|
 |
OldCheatEngineUser Whateven rank
Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Sat Jul 29, 2017 7:57 pm Post subject: |
|
|
Magnum200 wrote: | I found the array of bytes for a game |
im not sure what do you mean with this, here is an example to clear aob (a.k.a. array of byte)
is a byte
is array of byte
so array of byte means a group of bytes, so two or more bytes can be called aob.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
 |
FreeER Grandmaster Cheater Supreme
Reputation: 53
Joined: 09 Aug 2013 Posts: 1091
|
Posted: Sun Jul 30, 2017 8:46 am Post subject: |
|
|
An Array of Bytes is nothing more than a consecutive sequence of bytes. Just like in programming an array could be a length of 1 (though it's pretty rare) so 55 could be an AOB, 55 is the opcode for "push ebp" which tends to be the first instruction for functions (assuming they use stack frames, it's becoming a bit more common to find programs that don't).
However since it can be used in other places (eg. push 55, which is 6A 55) it's not entirely reliable to say that any 55 in the code refers to a push ebp let alone that it's the start of a function (push ebp may also be used elsewhere to save the value in ebp because more registers are needed to perform a calculation).
However if you look at more functions you'll find another instruction always comes directly after push ebp, "mov ebp, esp" with the bytes 89 E5. With these 3 bytes you can be much more confident that it's the start of a function. Many (but not all) functions will also modify esp directly after copying it into ebp, however some might use "sub esp, XX" and others (like the tutorial) might use "lea esp, [esp - XX]", and others could use "add esp, -XX". So AOBS for those could be used as an additional "sanity" check to see if a found result is a function (just because none of those exist doesn't mean it's not however).
Combine that with only scanning memory that is executable to filter out any that are purely data and couldn't be run and you have something like the core functionality of CE's "Reference Functions" window by finding the functions in the game. Study the opcodes for how functions are called and you can find where each function is called using an AOB (assuming the address is hard coded and not only available at runtime, eg. call eax, or call [ebx+20])
Find a sequence of bytes that only appear in a single function, aka are unique, and you have a way to find those same instructions within that exact function again later by scanning for those bytes.
Once you've found the location of those bytes you can copy them, or change them or whatever you want.
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|