[HELP] Calling same function two times causing crash

[Strigger]

Let's say for example i want to call this function i registered with registersymbol (aob_getsafefloat), this is what i did

Code: Select all

//get SafeFloat
xor edx,edx
lea rcx,[rax+10]
reassemble(aob_getsafefloat)		//  call someaddress
movss [combat_maxhp],xmm0

But when i call it two times, the game crash immediately

Code: Select all

//get SafeFloat				//
xor edx,edx				//
lea rcx,[rax+10]			// WORKS
reassemble(aob_getsafefloat)		//
movss [combat_maxhp],xmm0		//

//get SafeFloat
xor edx,edx				//
lea rcx,[rax+20]			//
reassemble(aob_getsafefloat)		// CRASH HERE
movss [combat_hp],xmm0			//

I checked with break & trace 1st function works normally, but the second one causing crash
however i can call many function in the script as long as they are a different function

this is the script, as you can see i'm trying to do a godmode with conditional hp, i'm hooking the original check attack-able function

Spoiler

Code: Select all

aobscanmodule(aob_godmode,GameAssembly.dll,48 89 5C 24 57 57 48 83 EC 20 48 8B 05 47 38 A7 07)
registersymbol(aob_godmode og_godmode set_godmode set_godconditional)
alloc(newmem_godmode,2000,aob_godmode)
alloc(og_godmode,10)
alloc(set_godconditional,4)
alloc(set_godmode,4)
alloc(save1,40)
alloc(save2,40)
alloc(combat_maxhp,20)
alloc(combat_hp,20)
alloc(value,4)
alloc(invert,4)
label(return_godmode quit_godmode)

newmem_godmode:
  push rdi
  sub rsp,20

  //backup
  mov [save1],rcx
  mov [save2],rdx

  //get EntityManager
  reassemble(aob_entitymanager)
  reassemble(aob_entitymanager+1)

  //get AvatarEntity
  xor edx,edx
  mov rcx,rax
  reassemble(aob_avatarentity)
  mov [localavatar],rax

  cmp [save2],rax
  jne not_god

  cmp [set_godmode],0
  je god

  //get Combat
  reassemble(aob_combatmethod)
  mov rcx,rax
  reassemble(aob_combat)
  mov rax,[rax+148]

  //get SafeFloat
  xor edx,edx
  lea rcx,[rax+10]
  reassemble(aob_getsafefloat-5)
  movss [combat_maxhp],xmm0
  
  //get SafeFloat
  xor edx,edx
  lea rcx,[rax+20]
  reassemble(aob_getsafefloat-5)
  movss [combat_hp],xmm0

  movss xmm0,[combat_hp]
  divss xmm0,[combat_maxhp]
  mulss xmm0,[value]
  mulss xmm0,[invert]
  addss xmm0,[value]
  mulss xmm0,[invert]
  addss xmm0,[value]

  comiss xmm0,[set_godconditional]
  ja not_god
  jmp god

god:
  //restore
  mov rcx,[save1]
  mov rdx,[save2]
  xor al,al
  jmp end

not_god:
  //restore
  mov rcx,[save1]
  mov rdx,[save2]
  jmp original_god

original_god:
  call quit_godmode
  
end:
  add rsp,20
  pop rdi
  ret

quit_godmode:
  reassemble(aob_godmode)
  jmp return_godmode

og_godmode:
  readmem(aob_godmode,5)

set_godmode:
  dd 0
set_godconditional:
  dd (float)100

aob_godmode:
  jmp newmem_godmode
return_godmode:

[DISABLE]
aob_godmode:
  readmem(og_godmode,5)

unregistersymbol(*)
dealloc(*)

my guess is the stacking problem, but i haven't figure that out yet, please help and thank you in advance

[DarkThinkHuman]

The first call probably changes the value of RAX
that causes that lea rcx,[rax+20] RCX does not have a valid pointer = crash if the function is called a second time.