| View previous topic :: View next topic |
| Author |
Message |
Arcansel
Cheater
![]() Reputation: 0
Joined: 04 Jun 2022
Posts: 28
|
 Posted: Fri Oct 13, 2023 5:07 pm Post subject: How to copy original opcode and use it in newmem? |
 |
|
| Hello, i am having trouble figuring out how to deal with a line like "jmp address", the address always changes when the game restarts and it is stuck to my aob script as an original code line, i tried to deleting it along with its associated bytes from aobscan but it didnt work, cheat engine is still assuming that the line is suposed to exist, so i am stuck with it and so i cant make a stable script because the address will always change and thus crash the game, i tried using readmem to copy the bytes and it did copy the bytes but the jump was not jumping to where it should be jumping. Also tried to put the readmem after the return to place it right after it jumps from newmem but for some reason it is adding 1 byte to the jmp address and thus not working cuz the address is 5 bytes and needs 64 bit register and not a 32 bit which is what it is doing when it eats 1 byte from the instruction.
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4702
|
| Posted: Fri Oct 13, 2023 7:42 pm Post subject: |
|
|
`jmp rel32` takes a relative displacement. The bytes the instruction gets assembled to depends on the address the instruction is located at. Merely copying the bytes to another address isn't going to produce the same instruction.
`reassemble` disassembles an instruction at an address and tries to assemble it elsewhere. CE has a `jmp` pseudoinstruction if the destination can't be encoded as a 32-bit relative displacement, so RIP-relative addressing won't be a concern.
Maybe you could simply inject elsewhere? e.g. one or two instructions above the `jmp`
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
Arcansel
Cheater
![]() Reputation: 0
Joined: 04 Jun 2022
Posts: 28
|
| Posted: Sat Oct 14, 2023 4:51 am Post subject: |
|
|
| ParkourPenguin wrote: | `jmp rel32` takes a relative displacement. The bytes the instruction gets assembled to depends on the address the instruction is located at. Merely copying the bytes to another address isn't going to produce the same instruction.
`reassemble` disassembles an instruction at an address and tries to assemble it elsewhere. CE has a `jmp` pseudoinstruction if the destination can't be encoded as a 32-bit relative displacement, so RIP-relative addressing won't be a concern.
Maybe you could simply inject elsewhere? e.g. one or two instructions above the `jmp` |
Thank you for the help, "reassemble" worked, i had forgotten about it, i didnt cheat for a while due to irl, but still i didnt understand how to properly use it, i used to inject the code somewhere else whenever i had a dynamic jump like this like you suggested, but i like this approach better now that i understand it, i dunno why i didnt understand it, i guess i just though it worked diferently ugh my brain so fried sometimes and overcomplicates things, anyways thank you very much.
|
|
| Back to top |
|
|
Csimbi
I post too much
 Reputation: 97
Joined: 14 Jul 2007
Posts: 3325
|
| Posted: Sun Oct 15, 2023 3:46 am Post subject: |
|
|
I used my customAOBInstructionTemplate and picked a random instruction in TotalCommander.
I copied here the 'core' of the code only.
As you can see, we are replacing a 'call' here:
| Code: | ...
lblJustARandomInstruction:
//Alt: call TOTALCMD64.EXE+1A890
//db E8 AF FF FF FF
readmem(aobJustARandomInstruction,5)
...
|
You know it's a relative call so you'll want to use reassemble instead.
Replace readmem with reassemble and take off the count parameter and you are done:
| Code: | ...
lblJustARandomInstruction:
//Alt: call TOTALCMD64.EXE+1A890
//db E8 AF FF FF FF
//readmem(aobJustARandomInstruction,5)
reassemble(aobJustARandomInstruction)
...
|
Makes sense?
You should use reassemble for all instructions with relative address - this means most call and jmp instructions.
A call or a jump using register does not need reassembly.
E.g...
call [eax+18]
jmp ebx
etc.
|
|
| Back to top |
|
|
Arcansel
Cheater
![]() Reputation: 0
Joined: 04 Jun 2022
Posts: 28
|
| Posted: Tue Oct 17, 2023 6:03 pm Post subject: |
|
|
| Csimbi wrote: | I used my customAOBInstructionTemplate and picked a random instruction in TotalCommander.
I copied here the 'core' of the code only.
As you can see, we are replacing a 'call' here:
| Code: | ...
lblJustARandomInstruction:
//Alt: call TOTALCMD64.EXE+1A890
//db E8 AF FF FF FF
readmem(aobJustARandomInstruction,5)
...
|
You know it's a relative call so you'll want to use reassemble instead.
Replace readmem with reassemble and take off the count parameter and you are done:
| Code: | ...
lblJustARandomInstruction:
//Alt: call TOTALCMD64.EXE+1A890
//db E8 AF FF FF FF
//readmem(aobJustARandomInstruction,5)
reassemble(aobJustARandomInstruction)
...
|
Makes sense?
You should use reassemble for all instructions with relative address - this means most call and jmp instructions.
A call or a jump using register does not need reassembly.
E.g...
call [eax+18]
jmp ebx
etc. |
Yea, thank you for the elaborate response, i figured it out when the other person reply talked about "reassemble".
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
