opcode int 3 crash anti-cheat??

Memory scanning, code injection, debugger internals and other gamemodding related discussion
Post Reply
mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

opcode int 3 crash anti-cheat??

Post by mlengka93 »

Image
tried some script for RPGmaker game RGSS104E.dll
it's for pokemon rejuv, what i did is : create AOB for that eviv and then even with only original code (unmodified) the game crash and pointed out at this int 3 memory location. Is it somekind of anti cheat debug or did i do something wrong? help me :?: :?:
Last edited by mlengka93 on Thu Nov 28, 2019 2:25 pm, edited 2 times in total.

mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

Re: opcode int 3 crash anti-cheat??

Post by mlengka93 »

with the same kind method it's working for Pokemon reborn tho..

mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

Re: opcode int 3 crash anti-cheat??

Post by mlengka93 »

the idea is when accessing inventory this mov eax,[eax+ecx*4] get eax address for the item

Code: Select all

[ENABLE]

aobscanmodule(aob_itemedit,RGSS104E.dll,8B 04 88 5D C3) // should be unique
alloc(newmem,$1000)

label(code)
label(return)
globalalloc(p_isSome,4)
newmem:
  mov [p_isSome],eax
code:
  mov eax,[eax+ecx*4]
  pop ebp
  ret
  jmp return

aob_itemedit:
  jmp newmem
return:
registersymbol(aob_itemedit)

[DISABLE]

aob_itemedit:
  db 8B 04 88 5D C3
unregistersymbol(aob_itemedit)
unregistersymbol(p_isSome)
dealloc(newmem)

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 871
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 1475

Re: opcode int 3 crash anti-cheat??

Post by cfemen »

Looks like you return to the INT3 coz you are using the overriden ret in your allocated memory.

easiest solution : Inject at 8B 4D 0C/+2A2C3 = ret stays and will jump correctly back.

mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

Re: opcode int 3 crash anti-cheat??

Post by mlengka93 »

cfemen wrote:
Thu Nov 28, 2019 2:23 pm
Looks like you return to the INT3 coz you are using the overriden ret in your allocated memory.

easiest solution : Inject at 8B 4D 0C/+2A2C3 = ret stays and will jump correctly back.
hehehe it works. By any chance do you know why this one cause the game crash, its for filtering, next step of finding the base address. Anyway, thanks a lot for your help :D :D

Code: Select all

push ebx
mov ebx,[health]
cmp [eax+ecx*4],ebx
pop ebx
jne evive_orig
crash point at cmp [eax+ecx*4],ebx part/line

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 871
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 1475

Re: opcode int 3 crash anti-cheat??

Post by cfemen »

mlengka93 wrote:
Thu Nov 28, 2019 3:03 pm
cfemen wrote:
Thu Nov 28, 2019 2:23 pm
Looks like you return to the INT3 coz you are using the overriden ret in your allocated memory.

easiest solution : Inject at 8B 4D 0C/+2A2C3 = ret stays and will jump correctly back.
hehehe it works. By any chance do you know why this one cause the game crash, its for filtering, next step of finding the base address. Anyway, thanks a lot for your help :D :D

Code: Select all

push ebx
mov ebx,[health]
cmp [eax+ecx*4],ebx
pop ebx
jne evive_orig
crash point at cmp [eax+ecx*4],ebx part/line
mh you could try something like:

Code: Select all

push edx
mov edx, [eax+ecx*4]
cmp edx, ebx
pop edx
if its still crash then use a breakpoint and check the values of eax and ecx

mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

Re: opcode int 3 crash anti-cheat??

Post by mlengka93 »

Spoiler
cfemen wrote:
Thu Nov 28, 2019 3:10 pm
mlengka93 wrote:
Thu Nov 28, 2019 3:03 pm
cfemen wrote:
Thu Nov 28, 2019 2:23 pm
Looks like you return to the INT3 coz you are using the overriden ret in your allocated memory.

easiest solution : Inject at 8B 4D 0C/+2A2C3 = ret stays and will jump correctly back.
hehehe it works. By any chance do you know why this one cause the game crash, its for filtering, next step of finding the base address. Anyway, thanks a lot for your help :D :D

Code: Select all

push ebx
mov ebx,[health]
cmp [eax+ecx*4],ebx
pop ebx
jne evive_orig
crash point at cmp [eax+ecx*4],ebx part/line
mh you could try something like:

Code: Select all

push edx
mov edx, [eax+ecx*4]
cmp edx, ebx
pop edx
if its still crash then use a breakpoint and check the values of eax and ecx
[/quote]

Image

still crash at the part mov ebx, [eax+ecx*4] can't i even do anything with [eax+ecx*4] code haha, can't even cmp them and mov

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 871
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 1475

Re: opcode int 3 crash anti-cheat??

Post by cfemen »

use breakpoint to check eax and ecx to see the values, looks like eax does not have a correct address.

Edit : you do this compare in aob_itemedit?
if yes:
Before or after:
mov eax,[eax+ecx*4]
?

mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

Re: opcode int 3 crash anti-cheat??

Post by mlengka93 »

cfemen wrote:
Thu Nov 28, 2019 3:26 pm
use breakpoint to check eax and ecx to see the values, looks like eax does not have a correct address.

Edit : you do this compare in aob_itemedit?
Image
edx is right but ebx is 0, and
yes, i mean its aobeviv but share the same code, i put the wrong one there
here is the script
is it a bad idea do a cmp in aob?

Code: Select all

[ENABLE]

aobscanmodule(aob_eviv,RGSS104E.dll,8B 4D 0C 8B 04 88) // should be unique
alloc(newmem,128,RGSS104E.dll)

label(code)
label(return)
label(findEvivPointer) //Find EV & IV Pointer
label(findEvivPointer_status)
registersymbol(findEvivPointer_status)
label(health) //HP
registersymbol(health)
label(attack) //Attack
registersymbol(attack)
label(defense) //Defense
registersymbol(defense)
label(specialAttack) //Special Attack
registersymbol(specialAttack)
label(specialDefense) //Special Defense
registersymbol(specialDefense)
label(speed) //Speed
registersymbol(speed)
globalalloc(p_isEviv,4) //EV & IV Pointer
//---------------------//
newmem:
cmp [findEvivPointer_status],1
je findEvivPointer
jmp code
//--------------------//
findEvivPointer:
push edx
push ebx
mov edx,[health]
mov ebx,[eax+ecx*4]
cmp edx,ebx
pop edx
pop ebx
jne code
push edx
mov edx,[attack]
cmp [eax+ecx*4],edx
pop edx
jne code
push edx
mov edx,[defense]
cmp [eax+ecx*4],edx
pop edx
jne code
push edx
mov edx,[speed]
cmp [eax+ecx*4],edx
pop edx
jne code
push edx
mov edx,[specialAttack]
cmp [eax+ecx*4],edx
pop edx
jne code
push edx
mov edx,[specialDefense]
cmp [eax+ecx*4],edx
pop edx
jne code

mov [p_isEviv],eax
mov ecx,[ebp+0C]
mov eax,[eax+ecx*4]
mov [findEvivPointer_status],0
jmp return

findEvivPointer_status:
dd 0

health:
dd 0

attack:
dd 0

defense:
dd 0

specialAttack:
dd 0

specialDefense:
dd 0

speed:
dd 0

code:
  mov ecx,[ebp+0C]
  mov eax,[eax+ecx*4]
  jmp return

aob_eviv:
  jmp newmem
  nop
return:
registersymbol(aob_eviv)

[DISABLE]

aob_eviv:
  db 8B 4D 0C 8B 04 88

unregistersymbol(aob_eviv)
dealloc(newmem)

unregistersymbol(findEvivPointer_status)
unregistersymbol(health)
unregistersymbol(attack)
unregistersymbol(defense)
unregistersymbol(specialAttack)
unregistersymbol(specialDefense)
unregistersymbol(speed)
unregistersymbol(p_isEviv)

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 871
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 1475

Re: opcode int 3 crash anti-cheat??

Post by cfemen »

Code: Select all

is it a bad idea do a cmp in aob?
no its ok, it would only be a problem(if you dont restore the flags) when you using a cmp if there is an conditial jump after the Inject.

i cant tell why its crashing.

but you have a logic error in your script:

Code: Select all

pop edx
pop ebx
its the wrong order ^^
first pop ebx then edx, coz you pushed edx first.

like i said, i cant tell why its crashing without debugging it myself :/

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 871
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 1475

Re: opcode int 3 crash anti-cheat??

Post by cfemen »

Wait i maybe see the problem

mov ebx,[eax+ecx*4]

ecx cant have the right value.

do a mov ecx,[ebp+0C] before

mlengka93
Noobzor
Noobzor
Posts: 9
Joined: Mon Nov 25, 2019 4:55 pm
Reputation: 0

Re: opcode int 3 crash anti-cheat??

Post by mlengka93 »

cfemen wrote:
Thu Nov 28, 2019 3:54 pm
Wait i maybe see the problem

mov ebx,[eax+ecx*4]

ecx cant have the right value.

do a mov ecx,[ebp+0C] before
Well well well, finaly!!!! YEAAAAHH!!! THANK YOU :D :D :D :D
phew, now i can rest hehehehehehehe

Post Reply

Who is online

Users browsing this forum: No registered users