I need help understanding movss and movd

Memory scanning, code injection, debugger internals and other gamemodding related discussion
Post Reply
TheByteSize
Expert Cheater
Expert Cheater
Posts: 293
Joined: Sat Mar 04, 2017 7:28 am
Reputation: 232

I need help understanding movss and movd

Post by TheByteSize »

here is snip set.

Code: Select all

  movdqu dqword [xmm_backup1],xmm1 // save it
  xorps xmm1,xmm1
  movss xmm1,[esi+00000124]
  addss xmm1,[more_speed]
  movss [eax],xmm1
  movdqu xmm1,dqword [xmm_backup1] // restore it
this will crash at

Code: Select all

movss [eax],xmm1
I changed that line to this and works fine

Code: Select all

movd eax,xmm1
couple line above where Injection occur the game have code like this and works fine.

Code: Select all

mov eax,[edi+000004B4]
mov edx,[ebp-0C]
movss [eax],xmm1
mov ecx,[edi+00000384]
Last edited by TheByteSize on Tue Aug 13, 2019 3:47 pm, edited 1 time in total.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: I need help understanding movss and movd

Post by SunBeam »

First up, let's use google. Search for "movss assembly" and you find this: [Link] -> "Moves a scalar single-precision floating-point value from the source operand (second operand) to the destination operand (first operand)". That means FLOAT. Then let's use google again. Search for "movd assembly" and you find this: [Link] -> "Copies a doubleword from the source operand (second operand) to the destination operand (first operand)." That means DWORD.

Your code crashes because you operate with a FLOAT and write it as a DWORD (check what EAX is supposed to actually store as a value). If it's not that, then check that EAX isn't used in other functions/calculations (that it's hit only when you do that injection), as I have a feeling that's your actual reason for the crash.

Google powa!

BR,
Sun

TheByteSize
Expert Cheater
Expert Cheater
Posts: 293
Joined: Sat Mar 04, 2017 7:28 am
Reputation: 232

Re: I need help understanding movss and movd

Post by TheByteSize »

SunBeam wrote:
Mon Aug 12, 2019 8:52 pm
Sorry, I wasn't clear on this. I did search for answer before posting here but I couldn't understand . What I don't understand is that why would the game crash when I use movss that is same instruction the game use couple lines above.
It would crash at that line before hitting below code.

Code: Select all

movdqu xmm1,dqword [xmm_backup1] // restore it
jmp return
Any way, I'm pretty sure eax was 0x0 when I and did stepping if F7 but I'll check again. Maybe it has some address there and I'm trying to override value like you said.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: I need help understanding movss and movd

Post by SunBeam »

You do realize you don't need to store xmm1 and restore it. You can work with either MMX (use xmm11 if you want, as long as it's not used in the calculus). "movdqu" assumes your code is 16-bytes unaligned. "movss" should not be impacted by that.

EDIT: Can you actually post the whole function you're trying to hook in? I have a feeling your EAX is 16-bytes aligned. Do you see any "movaps"?

TheByteSize
Expert Cheater
Expert Cheater
Posts: 293
Joined: Sat Mar 04, 2017 7:28 am
Reputation: 232

Re: I need help understanding movss and movd

Post by TheByteSize »

Well, I have figured out my dumb ass mistakes. movss [eax] works when eax is actually acting as a pointer which mean that it is holding an address instead of a value. Since, I'm trying move hex value directly from xmm to eax(eax was 0x0), I need to use movd. DOH :oops:

As for method of saving xmm. I copied it from [Link].
I got a question though. Since xmm is a register consist of 4 set of aligned 32 bits floating point, can I assume it's always aligned and can I always use movdqa to save xmm value?

I do want to learn a sure way to save xmm.

Thanks for the hints.

User avatar
Chucky
Expert Cheater
Expert Cheater
Posts: 76
Joined: Thu Mar 08, 2018 4:01 pm
Reputation: 29

Re: I need help understanding movss and movd

Post by Chucky »

TheByteSize wrote:
Tue Aug 13, 2019 1:34 am
Well, I have figured out my dumb ass mistakes. movss [eax] works when eax is actually acting as a pointer which mean that it is holding an address instead of a value. Since, I'm trying move hex value directly from xmm to eax(eax was 0x0), I need to use movd. DOH :oops:

As for method of saving xmm. I copied it from [Link].
I got a question though. Since xmm is a register consist of 4 set of aligned 32 bits floating point, can I assume it's always aligned and can I always use movdqa to save xmm value?

I do want to learn a sure way to save xmm.

Thanks for the hints.

TheByteSize
Expert Cheater
Expert Cheater
Posts: 293
Joined: Sat Mar 04, 2017 7:28 am
Reputation: 232

Re: I need help understanding movss and movd

Post by TheByteSize »

Chucky wrote:
Tue Aug 13, 2019 3:01 am
:?:
STN already showed that method in the other post. Are you trying to promote your channel? :lol:

EDIT: Additionally, I wouldn't trust someone that reserve 20 bytes for a 16 bytes xmm without explanation.
Last edited by TheByteSize on Tue Aug 13, 2019 4:34 pm, edited 1 time in total.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: I need help understanding movss and movd

Post by SunBeam »

TheByteSize wrote:
Tue Aug 13, 2019 1:34 am
Well, I have figured out my dumb ass mistakes. movss [eax] works when eax is actually acting as a pointer which mean that it is holding an address instead of a value. Since, I'm trying move hex value directly from xmm to eax(eax was 0x0), I need to use movd. DOH :oops:

As for method of saving xmm. I copied it from [Link].
I got a question though. Since xmm is a register consist of 4 set of aligned 32 bits floating point, can I assume it's always aligned and can I always use movdqa to save xmm value?

I do want to learn a sure way to save xmm.

Thanks for the hints.
You have xmm0 ... xmm15. I'm sure you can find one of them, at that hook spot of yours, that is not used. Really now :P Make no sense to clog the hook with "movdqu [crap],your_xmm" :) I'd use that only as a last resort; only if ALL of them are in use at that spot. You're clearly not breaking in the middle of some heavy MMX computations, so pick one.. as far away from yours as possible.

"I'm trying move hex value directly from xmm to eax(eax was 0x0), I need to use movd" - you're not making any sense here. If your "eax" is 0, both movss and movd will fail. You're not moving anything to eax, but to [eax]. That will cause an exception when eax is 0. That's because [0] == crash. Trying to read or write from 0 address never worked for anyone. Like I said.. make sure the address you write to is valid and a constant (the function you hook in is not used by other functions, thus eax changing; and perhaps being 0 from time to time).

Lastly, my point was exactly the opposite. For 'movaps' or anything with an 'a' in MMX world you'll need a 16-bytes aligned address. In short, an address that ends in 0 (xxxxxxx0). If the address is not aligned, you'll hit an exception, thus crash. Always use 'movups' (or 'u' equivalent) to move stuff around.

TheByteSize
Expert Cheater
Expert Cheater
Posts: 293
Joined: Sat Mar 04, 2017 7:28 am
Reputation: 232

Re: I need help understanding movss and movd

Post by TheByteSize »

SunBeam wrote:
Tue Aug 13, 2019 3:18 pm
Isn't xmm8~15 only available only if the executable was compiled as 64bit?

And thanks for explanation on align float part and the use of []; I totally forgot the meaning of bracket. Err, tunnel vision.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: I need help understanding movss and movd

Post by SunBeam »

Yeah, my bad. You got xmm0-xmm7. Use the latter one :P

TheByteSize
Expert Cheater
Expert Cheater
Posts: 293
Joined: Sat Mar 04, 2017 7:28 am
Reputation: 232

Re: I need help understanding movss and movd

Post by TheByteSize »

SunBeam wrote:
Tue Aug 13, 2019 4:34 pm
Yeah, my bad. You got xmm0-xmm7. Use the latter one :P
I forgot to answer your other inquiry. The reason I chose to save/restore xmm instead of simply reuse xmm register is that the hook point get called many different times and I'm lazy to check all of them to make sure xmm doesn't contain any data. So I though, it might be better idea to learn how to save xmm data and think of it as simpler way to keep xmm intact.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: I need help understanding movss and movd

Post by SunBeam »

TheByteSize wrote:
Tue Aug 13, 2019 5:05 pm
the hook point get called many different times
Exactly my point when I said it's most likely the reason for the crash :D

User avatar
Chucky
Expert Cheater
Expert Cheater
Posts: 76
Joined: Thu Mar 08, 2018 4:01 pm
Reputation: 29

Re: I need help understanding movss and movd

Post by Chucky »

TheByteSize wrote:
Tue Aug 13, 2019 3:30 am
Chucky wrote:
Tue Aug 13, 2019 3:01 am
:?:
STN already showed that method in the other post. Are you trying to promote your channel? :lol:

EDIT: Additionally, I wouldn't trust someone that reserve 20 bytes for a 16 bytes xmm without explanation.
First of all this is not my channel.
You don`t know how to use xmm regs (wtf is xmm reg) and you still can not trust him ?





User avatar
Chucky
Expert Cheater
Expert Cheater
Posts: 76
Joined: Thu Mar 08, 2018 4:01 pm
Reputation: 29

Re: I need help understanding movss and movd

Post by Chucky »

Watch some vids, read tuts and stop posting shits that you don`t understand.

Post Reply

Who is online

Users browsing this forum: No registered users