What i want to do:
For the game heroes of hammerwatch II the game mainly runs off angelscript. At this point i wanted to to hook into the angelscript functions to dump the data. For this i prepared angelscript function offsets and inject into them. The final goal is to hook into setArg() and prepare() functions
inside of prepare() i get the the asIScriptFunctionObject pointer which i can than use to call asIScriptFunction::GetName() this all already works.
Spoiler

Code: Select all
{ Game : HWR2.exe
Version:
Date : 2025-04-02
Author : eggs
Angelscrit SetArgDword https://www.angelcode.com/angelscript/sdk/docs/manual/classas_i_script_context.html#a14cac831c1b419f552ca62a239dfcf45
Function as follows:
__int64 __fastcall setArgInt(__int64 engineCtxPtr, unsigned int argnumber, int value)
}
[ENABLE]
aobscanmodule(INJECTint,HWR2.exe,48 89 6C 24 ?? 56 48 83 EC 20 83 79 18 04 41 8B E8 44 8B CA 48 8B F1 74 10 B8 ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 20 5E C3 48 8B 91 ?? ?? ?? ?? 44 3B 8A ?? ?? ?? ?? 72 17 C7 41 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 20 5E C3) // should be unique
alloc(newmem,$1000,INJECTint)
label(code)
label(return)
label(set_r8)
newmem:
cmp r8,1 // Check if r8 == 1
je set_r8
cmp r8,-1 // Check if r8 == -1
je set_r8 /
jmp code // If neither, continue execution
set_r8:
mov r8,5 // Set r8 to 5 this is just a small test
jmp code // Continue execution
code:
// < ========= HERE I WANT TO DUMP R8 (value) and RDX(arguementnumber) somewhere into a console
mov [rsp+18],rbp
jmp return
INJECTint:
jmp newmem
return:
registersymbol(INJECTint)
[DISABLE]
INJECTint:
db CC 89 6C 24 18
unregistersymbol(INJECTint)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: HWR2.asGetLibraryVersion+7A50
HWR2.asGetLibraryVersion+7A43: 48 83 C4 20 - add rsp,20
HWR2.asGetLibraryVersion+7A47: 5F - pop rdi
HWR2.asGetLibraryVersion+7A48: C3 - ret
HWR2.asGetLibraryVersion+7A49: CC - int 3
HWR2.asGetLibraryVersion+7A4A: CC - int 3
HWR2.asGetLibraryVersion+7A4B: CC - int 3
HWR2.asGetLibraryVersion+7A4C: CC - int 3
HWR2.asGetLibraryVersion+7A4D: CC - int 3
HWR2.asGetLibraryVersion+7A4E: CC - int 3
HWR2.asGetLibraryVersion+7A4F: CC - int 3
// ---------- INJECTING HERE ----------
HWR2.asGetLibraryVersion+7A50: 48 89 6C 24 18 - mov [rsp+18],rbp
// ---------- DONE INJECTING ----------
HWR2.asGetLibraryVersion+7A55: 56 - push rsi
HWR2.asGetLibraryVersion+7A56: 48 83 EC 20 - sub rsp,20
HWR2.asGetLibraryVersion+7A5A: 83 79 18 04 - cmp dword ptr [rcx+18],04
HWR2.asGetLibraryVersion+7A5E: 41 8B E8 - mov ebp,r8d
HWR2.asGetLibraryVersion+7A61: 44 8B CA - mov r9d,edx
HWR2.asGetLibraryVersion+7A64: 48 8B F1 - mov rsi,rcx
HWR2.asGetLibraryVersion+7A67: 74 10 - je HWR2.asGetLibraryVersion+7A79
HWR2.asGetLibraryVersion+7A69: B8 FC FF FF FF - mov eax,FFFFFFFC
HWR2.asGetLibraryVersion+7A6E: 48 8B 6C 24 40 - mov rbp,[rsp+40]
HWR2.asGetLibraryVersion+7A73: 48 83 C4 20 - add rsp,20
}
So at this point, instead of writing and compiling my own cpp console application for debugging is there a best-practise to dump the returned functionnames and than the passed arguements into an console-like ui using just cheatengine?