Cheat Engine

[thenic]

Hey there,

I'm trying to hack a kids game (more than 20 years old and offline, just for nostalgic reasons for a friend of mine and myself so no doubt that it's anti-cheat free) and thanks to this forum and the Wiki examples, I thought I wrote a working code.

But I was wrong.
I found a reliable pointer for in-game fuel but I fail at Auto Assembly implementation.

Data type is float (default 25.0, needed 100.0).
My assumption was that it's enough to redirect the original line "fstp dword ptr [esi+00000198]" to a new allocation where float 100 is written to the (cleared) st(0) register and after that I can go on with overriding the value of esi+offset by using the original fstp pointer command. But the game crashes as soon as I enter the area in-game where the value is accessed.

Do you know what may cause the crash on access? Wrong memory sizes? Have absolutely no idea ...

[ParkourPenguin]

You're still executing the original code. This means your code injection is popping two values off the FPU stack - one more than the original code at the injection point.

Comment the original code out or remove it entirely.

[thenic]

Alright, thank you ParkourPenguin, I just tried it with

[ParkourPenguin]

Your understanding is correct.

Does that instruction access other addresses? Right click the original instruction in the disassembler and select "Find out what addresses this instruction accesses". If it does, see step 9 of the CE tutorial.

[thenic]

Thank you very much.

I still stuck at Level 9 (managed to pass until 8 without skip) but I got a working code for my problem now:

I missed the code template feature before but it is great.

Rewriting the esi+198 value isn't helpful apparently but the corresponding ebp+198 later in the code is much better to replace.

[thenic]

Hello once again, my last goal is to multiply the flight speed by a predefined value (e. g. 2).

I already found the pointer and I found an opcode where I think I can inject the operation without being ignored or crashing the game:

[ParkourPenguin]

[thenic]

Thanks, yes, already thought that [3] can't reference a value but must name an address to get it's value from.

The game crashes again when I operate this code.
Then I alternated it a bit but it still crashes.

[ParkourPenguin]

The original code isn't being executed. This leaves the fpu stack imbalanced as the original code was pushing a value on it but you don't. Also that mov instruction was probably doing something important.
Are you sure that fld instruction was part of the original code? From your previous post it looks like it should've been `fmul dword ptr [ebx+64]`.

You're storing data in the middle of code you're trying to execute. This will almost certainly crash the game.

The align pseudoinstruction inserts as many bytes as is necessary to put the next address at a certain alignment.

[thenic]

Thank your for your patience, much appreciated. It's a steep learning curve and huge respect for everyone who has (that much of) a clue of assembler code. Assembler was always sth like "the supreme power" of computer programming for me.

Oh I get it, an unaligned value may get split into two cache lines (if it's coincidentally at "the end" of the first) and this should be avoided.

You mean storing the multiplier using an operation during the jump isn't clean and it's better to store it before and just reference to it when the specific opcode (that I need/want to manipulate) gets executed? This sounds reasonable to me.

Okay and injection copy looks like I have to mov the base address ([ebx]) right before it gets used/written by the code into a newly allocated memory address that I can monitor (with offset attached). Also I won't remove the original operation. Will have a try asap.

I used the 'full injection' template now but now my code doesn't have any impact.
I will investigate!

(Yes, I messed up the fsp/fmul line in my previous post - sorry for that!)

[ParkourPenguin]