UserDefinedSymbols+0x000

[NaleenWild]

Morning Everyone,

I am trying to apply a teleport method of a speed hack for a game however my ASM is a little bit on the rubbish side of bad.

in xmm0 we have X coord, xmm1 is Z and xmm2 is Y, however I am just trying to get stuff done for X (xmm0)
The Velocity is defined in another script where I got the base address of it saved to pMPlr which is registered within the script. (This script is a child of it)
I can alter the values contained in "r14+000001C8" directly and I can see movement/teleport action in game happening.

I am trying to alter xmm0 before it movups there. Not sure if this is best method.

these 3 lines (20, 21 and 22 for my AutoAssemble)

Code: Select all

movss [addSpeed], [pMPlr+4E0] //20 pMPlr defined in another autoscript and registered.
  mulss [addSpeed], [SpeedMul] //21
  addss xmm0, addSpeed //22

Are telling me they cannot be compiled.

Does anyone have any tips what I am doing wrong?

----
Below is the full AA listing I have for full injection.

Code: Select all

define(address,"PhysX3CharacterKinematic_x64.dll"+6BFE)
define(bytes,41 0F 11 86 C8 01 00 00)

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat

 
 
assert(address,bytes)
alloc(newmem,$1000,"PhysX3CharacterKinematic_x64.dll"+6BFE)

label(code)
label(return)
label(SpeedMul)
label(addSpeed)

registersymbol(SpeedMul)
newmem:
code:
  movss [addSpeed], [pMPlr+4E0] //20 pMPlr defined in another autoscript and registered.
  mulss [addSpeed], [SpeedMul] //21
  addss xmm0, addSpeed //22
  movups [r14+000001C8],xmm0
  jmp return

SpeedMul:
dd (float)1.0

addSpeed:
dd (float)0.0

address:
  jmp newmem
  nop 3
return:

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
address:
  db bytes
  // movups [r14+000001C8],xmm0

dealloc(newmem)

[aSwedishMagyar]

I think you need to spend some time looking up ASM instructions and understand what the difference is between an address vs the value stored at an address.

First Issue:
movss [addSpeed], [pMPlr+4E0]
This can't compile because movss takes either a pointer and an xmm register or two xmm registers. You need to first move it into a register and then from the register to the pointer. (This is the same issue for line 2 with the mulss)

Second Issue:
Your pMPlr is an address at which another address is stored. So even just changing it to movss xmm4, [pMPlr+4E0], wont work because the value you need is actually at [[pMPlr]+4E0]. You need to first move the value in the pointer to a register and then do your addition: mov rax, [pMPlr] then: movss xmm4, [rax+4E0]. The reason to do this is if you have a multi-level pointer, when you first enable the script CE will interpret it as the final step in that chain. For example: [[playerBase]+5E0] will be interpreted as what was in playerBase at the time of enabling + 5E0. That means if the actual address (what is stored in playerBase) changes, it won't track and your script will be wrong.

Third Issue:
addss xmm0, addSpeed
This won't compile either because addSpeed is an address. You would need to dereference it using the brackets, especially since the value you want is stored at addSpeed.
Like this: addss xmm0, [addSpeed]

Fourth Issue:
If you want to modify a movups you need to understand what the 'p' stands for in that instruction. movss is move a single, single precision value. movups is move an unaligned, packed, single precision value. The 'packed' means that it is moving four values (if single precision, 2 if double precision) at once. So, I recommend reading up on instructions before you start modifying them.

In summary, four things to leave you with:

1. Always move from address to register and then register to address
2. Pointer chains should be handled by using a register (i.e. mov rax,[pPlayer] -> mov rcx,[rax+10])
3. All floating point operations can only take either a pointer (i.e. [fPlayerSpeed]) or an xmm register
4. Make it a habit of looking up new instructions and going over their parameters and operation, it will save you time in the long run

[NaleenWild]

Thank you aSwedishMagyar,

values of the registers I will need to push and pop off the stack before I use them and after to be safe correct?

[NaleenWild]

I have found "AMD x86-64 Architecture Programmer’s Manual Volume 4: 128-Bit Media Instructions" which has been useful.