Cheat Engine

[ymiu]

My process is a 32-bit mono game. I'm trying to save ST(0) from the FPU Registers so I can use it to do some float math and then restore it later. I created a label in my script to store the value until I'm done with the FPU.

However, it doesn't seem to be working correctly. When I debug, ST(0) is always 0.00, but when I fstp it to my placeholder, it writes FFC00000. When I fld from my placeholder later, of course ST(0) becomes NaN.

I don't actually know if I need to preserve the FPU stack like this, but whether or not it's essential now, I'm sure it will be one day, so I'd like to learn what's going wrong.

Script below. Note that I'm not actually doing any float math yet, so that's not a factor in the problem:

[OldCheatEngineUser]

i did not read the full code nor the full post, but here are things you need to consider when working with fpu:

- the idea of loading / storing and popping fpu stack/registers is similar to stack pointer, popping a value from st(0) increments that pointer so it points to the next register at same time clears st(7) and sets it to nan value (ffc00000)

- always check status word when doing math

- always check control word especially when working with floating point values

- in order to display the correct value type you must check precision control value (stored in control word) and by default (at least in current processors) the precision control is set to extended precision

- usually when loaded value does not match the precision control field, it converts it internally

otherwise learn SSE and SSE2 and go for that.

[ParkourPenguin]

You're not using the FPU at all. Even if you were, I doubt the game is using all 8 registers at the time of this code injection, so there's no need to do that. Why back it up in the first place?

The fstp probably underflowed the fpu stack. Basically, don't worry about it; the game probably isn't using empty fpu registers anyway, so do whatever you want with the fpu. Just keep it balanced so you don't overflow it.

For more information, look at Intel SDM volume 1 chapter 8 "Programming with the x87 FPU".

[ymiu]

@OldCheatEngineUser:
Doing my best to Google what all that means, but it feels like it's a bit over-the-top the more I read. I'm not trying to do any fancy math in the end, my above example was simplified by not doing any math at all (they're commented out), proving that the FPU math instructions are unrelated to my problem.

Eventually, all I wanted to do was decrement the max-stat values by 1 and then load the results into the current-stat values. After some research, it looks like FISUB was the easiest way to do this since I'm just decrementing by 1. I have this working, but it destroys st(7) if I can't find a way to save st(0) ahead of time.

But like I said, the example doesn't actually do any of this. I'm just concerned that pushing temporary values to the FPU Stack, thus clearing st(7) as you described, may create some unwanted behavior by whatever follows my code. I don't know if st(7) is important at this time. So I wanted to pop st(0) to a safe place, do my stuff, and then restore st(0) from my safe place. I thought this would look like:

[ParkourPenguin]

If you look at documentation for the fisub instruction, you'll see that there is no instruction that takes an immediate value as an operand- only a memory location containing an integer.

You shouldn't need to back up the fpu register(s) the same way as you do the general-purpose registers. I highly doubt you'll encounter a circumstance where the game is using all 8 fpu registers at the time of the code injection. If you do find a need to backup and restore an fpu register, then what you're doing will work. Just push it into some memory location and pop it back when you're done.

The reason why it's not working for you right now is because the game isn't using any of the fpu registers at the time of this code injection. Every fpu register is marked as empty. Any attempt to access them will cause a floating point stack underflow exception and will write the relevant indefinite value (i.e. NaN) to the destination.

This behaviour is documented in Intel SDM volume 1 section 8.5.1.1 as of the current revision (order number 253665-069US / January 2019):

[OldCheatEngineUser]

ehm just noticed a mistake in your code:

- fld ...
- fisub ...

i should have mentioned this earlier, the i is used for integer operations.

fld expects a floating point value, fisub subtracts integer 1.
so you should expect an undefined behaviour.

if you are working with integers, use fild instead of fld. (otherwise use fsub instead of fisub)
and if its integer then why using fpu at all? general purpose instructions will do the job, in case you just need a copy of the st(0) integer value use FIST.



saving fpu registers:
you can save all registers and then restore them, but remember this rule FOLI. (first out last in)

but why saving when fpu registers are not used by the software, using fpu have greater overhead so dont use fpu if you cant handle it properly. (not even for simple addition/subtraction)

and stuff i mentioned about status word and control word can be found in intel-sdm vol2, try sse and sse2 extensions.

[Dark Byte]

[ymiu]

[ParkourPenguin]

Storing the value writes NaN instead of the value itself. That's the exact behaviour as is described in that section of the manual I referenced.
There's no obvious way to get that information in CE AFAIK. If you want it in AA, it should be in the structure fnsave writes to. Read the manual for more information.

I don't know what OldCheatEngineUser is talking about. fisub should work fine- it's documented that "The FISUB instructions convert an integer source operand to double extended-precision floating-point format before performing the subtraction."

[OldCheatEngineUser]

i apologize about fisub.