Shared opcode, weirdness when comparing
Posted: Tue Jul 02, 2019 1:14 pm
I've got an opcode which handles both the health address and the energy address of the player and I need to separate them both into their own pointer.
The script "works" but it occasionally doesn't seem to separate properly and both the health and energy pointers will point to the energy address.
Here's what happens:
1. Activate script
2. Start using energy before script finishes grabbing any addresses.
3. Now both HP and Ene pointers have the same addresses
I don't understand why this happens since I'm comparing r13 which is always 0/1 depending on if its hp or ene.
I've done some testing with breakpoints and no matter if I'm spending my energy, when R13==1, RDX+44 always contains hp.
I'd be very grateful if someone could help me figure out whats wrong with my script.
Also while I'm at it, this code is being run at a place in memory which is being accessed multiple times a second and yet it takes 5+ seconds for the pointers to start working, why is this ?
Here's the script:
EDIT: The game is Deus Ex Mankind Divided, I should've mentioned that, sorry.
The script "works" but it occasionally doesn't seem to separate properly and both the health and energy pointers will point to the energy address.
Here's what happens:
1. Activate script
2. Start using energy before script finishes grabbing any addresses.
3. Now both HP and Ene pointers have the same addresses
I don't understand why this happens since I'm comparing r13 which is always 0/1 depending on if its hp or ene.
I've done some testing with breakpoints and no matter if I'm spending my energy, when R13==1, RDX+44 always contains hp.
I'd be very grateful if someone could help me figure out whats wrong with my script.
Also while I'm at it, this code is being run at a place in memory which is being accessed multiple times a second and yet it takes 5+ seconds for the pointers to start working, why is this ?
Here's the script:
Code: Select all
[ENABLE]
aobscanmodule(GetHPAndEnergyAddress,DXMD.exe,0F 2F 73 44 40 0F 96 D6) // should be unique
alloc(newmem,$1000,"DXMD.exe"+3B71F84)
alloc(ptrEne,8)
alloc(ptrHP,8)
alloc(ptrPlayer,8)
label(code)
label(return)
label(setPtrEne)
label(setPtrHP)
registersymbol(ptrHP)
registersymbol(ptrEne)
registersymbol(ptrPlayer)
newmem:
push rdi
lea rdi,[rbx]
mov [ptrPlayer],rdi
pop rdi
cmp r13,0
je setPtrEne
cmp r13,1
je setPtrHP
setPtrHP:
push rdi
lea rdi,[rbx+44]
mov [ptrHP],rdi
pop rdi
jmp code
setPtrEne:
push rdi
lea rdi,[rbx+44]
mov [ptrEne],rdi
pop rdi
jmp code
code:
comiss xmm6,[rbx+44]
setbe sil
jmp return
ptrHP:
dd 0
ptrEne:
dd 0
ptrPlayer:
dd 0
GetHPAndEnergyAddress:
jmp newmem
nop
nop
nop
return:
registersymbol(GetHPAndEnergyAddress)
[DISABLE]
GetHPAndEnergyAddress:
db 0F 2F 73 44 40 0F 96 D6
unregistersymbol(ptrHP)
unregistersymbol(ptrEne)
unregistersymbol(ptrPlayer)
unregistersymbol(GetHPAndEnergyAddress)
dealloc(newmem)
dealloc(ptrEne)
dealloc(ptrHP)
dealloc(ptrPlayer)
{
// ORIGINAL CODE - INJECTION POINT: "DXMD.exe"+3B71F84
"DXMD.exe"+3B71F60: 48 FF CF - dec rdi
"DXMD.exe"+3B71F63: 75 F4 - jne DXMD.exe+3B71F59
"DXMD.exe"+3B71F65: 48 8B 03 - mov rax,[rbx]
"DXMD.exe"+3B71F68: 48 89 D9 - mov rcx,rbx
"DXMD.exe"+3B71F6B: FF 90 E0 00 00 00 - call qword ptr [rax+000000E0]
"DXMD.exe"+3B71F71: 48 8B 06 - mov rax,[rsi]
"DXMD.exe"+3B71F74: 48 89 F1 - mov rcx,rsi
"DXMD.exe"+3B71F77: 0F 28 F0 - movaps xmm6,xmm0
"DXMD.exe"+3B71F7A: FF 90 D0 00 00 00 - call qword ptr [rax+000000D0]
"DXMD.exe"+3B71F80: F3 0F 59 F0 - mulss xmm6,xmm0
// ---------- INJECTING HERE ----------
"DXMD.exe"+3B71F84: 0F 2F 73 44 - comiss xmm6,[rbx+44]
"DXMD.exe"+3B71F88: 40 0F 96 D6 - setbe sil
// ---------- DONE INJECTING ----------
"DXMD.exe"+3B71F8C: 48 89 D9 - mov rcx,rbx
"DXMD.exe"+3B71F8F: E8 FC F8 FF FF - call DXMD.exe+3B71890
"DXMD.exe"+3B71F94: 84 C0 - test al,al
"DXMD.exe"+3B71F96: 75 12 - jne DXMD.exe+3B71FAA
"DXMD.exe"+3B71F98: 48 8B 03 - mov rax,[rbx]
"DXMD.exe"+3B71F9B: 48 89 D9 - mov rcx,rbx
"DXMD.exe"+3B71F9E: FF 90 38 01 00 00 - call qword ptr [rax+00000138]
"DXMD.exe"+3B71FA4: 0F 2F 43 4C - comiss xmm0,[rbx+4C]
"DXMD.exe"+3B71FA8: 73 25 - jae DXMD.exe+3B71FCF
"DXMD.exe"+3B71FAA: 48 8B 03 - mov rax,[rbx]
}