Cheat Engine

janetwestonn · How do I cheat? Reputation: 0 Joined: 30 Nov 2018 Posts: 5

aobscanmodule() will not return a variable that can be used in the assembly opcodes. This would be useful for games that have anti-hacks which continuously scan for code modifications.

The following autoassemble script attempts to defeat anti-hacks by immediately overwriting the jump + NOPs that autoassemble uses to jump to new memory. But it will not work because "scannedaddress" cannot be used.

Proof of concept code:

Dark Byte · Posted: Fri Nov 30, 2018 12:57 pm Post subject:

you must tell alloc where to allocate. so alloc(newmem,4096,game.exe)

janetwestonn · How do I cheat? Reputation: 0 Joined: 30 Nov 2018 Posts: 5

Using CE 6.8.1
According to the wiki, alloc() does not require an address and does not show error window if not provided: wiki.cheatengine.org/index.php?title=Auto_Assembler:alloc
Modifying alloc() as requested still has same error.

ParkourPenguin · Posted: Fri Nov 30, 2018 2:39 pm Post subject:

The destination can't be an immediate- it doesn't make sense to move a value into another value. Put it in square brackets if you're addressing a memory location.

The third parameter to alloc specifies a region the memory should be allocated in. This is necessary because RIP-relative addressing requires the addressed memory location to be within a signed 32-bit displacement of the instruction. Even if you weren't addressing a memory location, it would still probably fail because the jmp to your code would take 14 bytes instead of 5 if it were far away.

Also, if the injection point isn't writable, you'll need to call VirtualProtect to change it back.

janetwestonn · How do I cheat? Reputation: 0 Joined: 30 Nov 2018 Posts: 5

ParkourPenguin · Posted: Fri Nov 30, 2018 4:01 pm Post subject:

I can replicate that behaviour.

Perhaps it's something to do with the syntax check and/or the order CE executes the script in.

Use a label as a workaround:

janetwestonn · How do I cheat? Reputation: 0 Joined: 30 Nov 2018 Posts: 5

Thank you for providing a workaround. Awesome!

Now, for the script to actually overwrite the jump and NOPs you need to use fullAccess(). WinAPI's VirtualProtect() is not strictly necessary.

Memory in a .exe is read+execute. We need to modify it to read+write+execute.

ParkourPenguin · Posted: Sat Dec 01, 2018 8:48 am Post subject:

You could use that, but I don't know of any analogous way to change it back. The game could detect that pretty easily. But hey, if it works, it works.