Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Im in the root function that changes unit stances. But...

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
LongBeardedLion
Expert Cheater
Reputation: 0

Joined: 10 Apr 2020
Posts: 173

PostPosted: Wed Jun 17, 2020 7:07 am    Post subject: Im in the root function that changes unit stances. But... Reply with quote

(Image below)

So i successfully reversed all the functions and arrived at the "Boss" function 58AAA0 Laughing feels good.
I was able to inject code and call this function, after many tries. And the whole day working in it.

My questions are:

1. Is there any other function below this one in the supposed hierarchy?
I search for references and there are none. And i opened IDA and it shows the xrefs to my function. I went back all the way to function 58AAA0, tracing back what are the registers the pass the values that i need.
So is there anything that is behind this function 58AAA0 that i should also reverse to get to the root of what changes the stance of my units? Or thats it?

2. I cant understand from where are the values getting plugged in in my function 58AAA0 if there is nothing happening before it? What calls this function?
Its a thiscall function that only has switch cases and it seems to loop constantly.

3. The function getting an ECX address that is my player object, and a value in the stack that is an address that is randomly generated (and changes everytime) , that contains the values that then will be used in a much later function to change the stance of the unit.
How and where does my function get these arguments from if there is nothing before it? How can i find this out?
It is very important if i could get a way to know what is writting this argument that changes everytime the function is called, but has always the same values in it that change my unit stance.

In IDA still shows the r.data 0062AAEC before my boss function 58AAA0
Does this have an influence in my function? Can i do anything with it?

The more i learn the more i feel like a damn noob. Laughing
Thank you so much for all the support.



xref1.jpg
 Description:
 Filesize:  261.87 KB
 Viewed:  1244 Time(s)

xref1.jpg


Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1

PostPosted: Wed Jun 17, 2020 1:31 pm    Post subject: Reply with quote

Based on the graphic, that looks like your function is part of a class and the top-most ref is the VTable entry that it's located within. The call using ECX is due to being a class-call, which is considered a '__thiscall' (calling convention wise) where ECX holds the class objects 'this' pointer when called.

In order to find where that is called, you would need to set a breakpoint at the start of the function and traceback, via the call stack, to where it was called from.

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
LongBeardedLion
Expert Cheater
Reputation: 0

Joined: 10 Apr 2020
Posts: 173

PostPosted: Wed Jun 17, 2020 10:09 pm    Post subject: Reply with quote

Thank you.

You were absolutely right.
There is yet another function that calls my function.
But its calling through an address that changes everytime too.
Call [edx+c].
So i have more material to work.

Thank you. Smile
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites