View previous topic :: View next topic |
Author |
Message |
omgzombie How do I cheat?
Reputation: 0
Joined: 20 Sep 2022 Posts: 7
|
Posted: Thu Sep 29, 2022 3:14 pm Post subject: [Help] getting different bytes for the same opcode |
|
|
how come I'm getting different bytes for the same opcode on two different machines?
machine 1 bytes for call KERNEL32.Sleep are FF 15 02 00 00 00 EB 08 A0 AD 27 2F FC 7F 00 00
while on machine 2 the bytes for call KERNEL32.Sleep are FF 15 02 00 00 00 EB 08 A0 AD 68 53 F9 7F 00 00
<<refer to attached image>>
I've found an address that I've been using Cheat Engine to just;
[ENABLE]
game.exe+21C05B8:
call sleep
and been trying to replicate the same thing in C#, but with my limited knowledge I've only been able to come up with the following method;
execute the script in cheat engine
watch the bytes that changed in hexview
and just write those new bytes myself using writeprocessmemory
<<refer to attached image>>
which works fine on the PC I'm writing this one, but breaks on a different PC cause instead of getting call KERNEL32.Sleep I'm getting some nonesense in the opcodes.
is there another a way for me to make it universal and work on any machine?
or a way to straight up write the opcodes I want to an address instead of going byte by byte?
sorry if what I'm asking is something that might just turn out to be obvious, but I'm just a beginner please forgive me
Description: |
|
Filesize: |
106.14 KB |
Viewed: |
2651 Time(s) |

|
Description: |
|
Filesize: |
41.19 KB |
Viewed: |
2651 Time(s) |

|
Description: |
|
Filesize: |
4.92 KB |
Viewed: |
2651 Time(s) |

|
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 467
Joined: 09 May 2003 Posts: 25701 Location: The netherlands
|
Posted: Thu Sep 29, 2022 3:45 pm Post subject: |
|
|
on machine1 the address of kernel32.sleep is at 00007ffc2f27ada0 ( A0 AD 27 2F FC 7F 00 00 )
on machine2 the address of kernel32.sleep is at 00007ff95368ada0 ( A0 AD 68 53 F9 7F 00 00 )
which is normal, as each time windows starts, the location of dll's will be changed
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
 |
omgzombie How do I cheat?
Reputation: 0
Joined: 20 Sep 2022 Posts: 7
|
Posted: Thu Sep 29, 2022 4:23 pm Post subject: |
|
|
Dark Byte wrote: | on machine1 the address of kernel32.sleep is at 00007ffc2f27ada0 ( A0 AD 27 2F FC 7F 00 00 )
on machine2 the address of kernel32.sleep is at 00007ff95368ada0 ( A0 AD 68 53 F9 7F 00 00 )
which is normal, as each time windows starts, the location of dll's will be changed |
that helped me make sense of whats going on, thank you.
does it really change with each time though? because I'm getting the exact same kernel32.sleep address every boot, its just that they are different on each machine.
is there a way for me to consistently call that function across different machines or is it a lost cause
|
|
Back to top |
|
 |
TsTg Master Cheater
Reputation: 5
Joined: 12 Dec 2012 Posts: 340 Location: Somewhere....
|
Posted: Sun Oct 02, 2022 11:28 am Post subject: |
|
|
depends on the OS you are using, some of them will have the sytem DLLs changing addresses, some others keep them fixed.
as for calling Sleep using CSharp, you can do this:
1-call LoadLibrary API for getting "kernel32.dll" base
2-call GetProcAddress API for getting the address of "Sleep"
3-store that in some temporary variable, and use that in your WriteMemory calls.
|
|
Back to top |
|
 |
|