You will have to use the internal FName::FName function to feed a static string and get the FName id associated to it by the Engine.
This function: public: __cdecl FName::FName(wchar_t const * __ptr64,enum EFindName) __ptr64
Code: Select all
00007FF6D4F5F6E0 | 40:53 | PUSH RBX
00007FF6D4F5F6E2 | 48:83EC 30 | SUB RSP,30
00007FF6D4F5F6E6 | 48:8BD9 | MOV RBX,RCX
00007FF6D4F5F6E9 | 48:85D2 | TEST RDX,RDX
00007FF6D4F5F6EC | 74 21 | JE pumpkinonline-win64-shipping.7FF6D4F5F70F
00007FF6D4F5F6EE | 45:8BC8 | MOV R9D,R8D
00007FF6D4F5F6F1 | C74424 28 FFFFFFFF | MOV DWORD PTR SS:[RSP+28],FFFFFFFF
00007FF6D4F5F6F9 | 45:33C0 | XOR R8D,R8D
00007FF6D4F5F6FC | C64424 20 01 | MOV BYTE PTR SS:[RSP+20],1
00007FF6D4F5F701 | E8 7AE9FFFF | CALL <pumpkinonline-win64-shipping.private: void __cdecl FName::Init(wchar_t const * __ptr64,int,enum EFindName,bool,int) __ptr64>
00007FF6D4F5F706 | 48:8BC3 | MOV RAX,RBX
00007FF6D4F5F709 | 48:83C4 30 | ADD RSP,30
00007FF6D4F5F70D | 5B | POP RBX
00007FF6D4F5F70E | C3 | RET
00007FF6D4F5F70F | 33C0 | XOR EAX,EAX
00007FF6D4F5F711 | 48:894424 40 | MOV QWORD PTR SS:[RSP+40],RAX
00007FF6D4F5F716 | 48:8901 | MOV QWORD PTR DS:[RCX],RAX
00007FF6D4F5F719 | 48:8BC3 | MOV RAX,RBX
00007FF6D4F5F71C | 48:83C4 30 | ADD RSP,30
00007FF6D4F5F720 | 5B | POP RBX
00007FF6D4F5F721 | C3 | RET
Code: Select all
PumpkinOnline-Win64-Shipping.exe+52F6E0 - 40 53 - push rbx
PumpkinOnline-Win64-Shipping.exe+52F6E2 - 48 83 EC 30 - sub rsp,30 { 48 }
PumpkinOnline-Win64-Shipping.exe+52F6E6 - 48 8B D9 - mov rbx,rcx
PumpkinOnline-Win64-Shipping.exe+52F6E9 - 48 85 D2 - test rdx,rdx
PumpkinOnline-Win64-Shipping.exe+52F6EC - 74 21 - je PumpkinOnline-Win64-Shipping.exe+52F70F
PumpkinOnline-Win64-Shipping.exe+52F6EE - 45 8B C8 - mov r9d,r8d
PumpkinOnline-Win64-Shipping.exe+52F6F1 - C7 44 24 28 FFFFFFFF - mov [rsp+28],FFFFFFFF { -1 }
PumpkinOnline-Win64-Shipping.exe+52F6F9 - 45 33 C0 - xor r8d,r8d
PumpkinOnline-Win64-Shipping.exe+52F6FC - C6 44 24 20 01 - mov byte ptr [rsp+20],01 { 1 }
PumpkinOnline-Win64-Shipping.exe+52F701 - E8 7AE9FFFF - call PumpkinOnline-Win64-Shipping.exe+52E080
PumpkinOnline-Win64-Shipping.exe+52F706 - 48 8B C3 - mov rax,rbx
PumpkinOnline-Win64-Shipping.exe+52F709 - 48 83 C4 30 - add rsp,30 { 48 }
PumpkinOnline-Win64-Shipping.exe+52F70D - 5B - pop rbx
PumpkinOnline-Win64-Shipping.exe+52F70E - C3 - ret
PumpkinOnline-Win64-Shipping.exe+52F70F - 33 C0 - xor eax,eax
PumpkinOnline-Win64-Shipping.exe+52F711 - 48 89 44 24 40 - mov [rsp+40],rax
PumpkinOnline-Win64-Shipping.exe+52F716 - 48 89 01 - mov [rcx],rax
PumpkinOnline-Win64-Shipping.exe+52F719 - 48 8B C3 - mov rax,rbx
PumpkinOnline-Win64-Shipping.exe+52F71C - 48 83 C4 30 - add rsp,30 { 48 }
PumpkinOnline-Win64-Shipping.exe+52F720 - 5B - pop rbx
PumpkinOnline-Win64-Shipping.exe+52F721 - C3 - ret
Note that the code below is written for CE 7.1, as assigning a wchar param directly in executeCodeEx didn't work fine. There was some bug in the source-code, which was fixed in 7.2. So feel free to adjust the code to 7.2, if you like, by removing the allocateMemory+writeString+writeBytes+deAlloc at the bottom.
Code: Select all
local FName_FName = getAddressSafe( "FName_FName" )
if FName_FName ~= 0x0 then
local p = allocateMemory( 256 )
local s = p + 0x8
writeString( s, key, true )
writeBytes( s + #key * 2, 0 )
local FName_id = executeCodeEx( 0, nil, FName_FName, p, s, 1 )
if readInteger( FName_id ) ~= 0x0 then
writeInteger( ConsoleKeys_Array_addr, readInteger( FName_id ) )
end
deAlloc( s )
end
1) Find FName::FName by aob. Unfortunately, you can't do it in the traditional way, as there are 2 such functions and the ASM looks identical. So even if you were to use wildcards in the aob, you'd still get two of them. In the current build you may say "yeah, but out of the two results, the function I want is always the first result". So when the game updates and the order is switched, for some reason, by the compiler.. what will you do then? So.. you'll have to use Lua:
--> aob: 41B101488D15????????41B801000000488D0D????????E9
You will find about 1200 results, all identical in form, pointing to wrappers like this:
You want the function appointed by the JMP, so from the result of the scan, you will have to do +0x17, then compute the destination of the JMP:
Code: Select all
function aobScanEx( aob )
-- thanks panraven for this function!
-- https://forum.cheatengine.org/viewtopic.php?t=577536
-- simplified for my needs
local p, a, n, s, e = nil or '*X*W', nil or fsmNotAligned, nil or '0', getAddress( process ) or 0x0, ( getAddress( process ) + getModuleSize( process ) ) or 0xffffffffffffffff
local ms = pb and createMemScan( pb ) or createMemScan()
local fl = createFoundList( ms )
ms.firstScan( soExactValue, vtByteArray, nil, aob, nil, s, e, p, a, n, true, false, false, false )
ms.waitTillDone()
fl.initialize()
local result = nil
if fl ~= nil and fl.getCount() > 0 then
result = createStringlist()
for i = 1, fl.getCount() do result.add( fl.getAddress( i - 1 ) ) end
end
fl.destroy()
ms.destroy()
return result
end
local aob_getFNameFName = "41B101488D15????????41B801000000488D0D????????E9"
local sl = aobScanEx( aob_getFNameFName )
local t = tonumber( sl[0], 16 ) -- we get the first occurrence from the scan list
t = t + 0x17 -- increment cursor to what was shown in the pic
t = t + readInteger( t + 0x1, true ) + 0x5 -- calculation of the JMP destination
unregisterSymbol( "FName_FName" )
registerSymbol( "FName_FName", t, true )
Now this:
Code: Select all
[00008373] Tiger_Prawn
Code: Select all
local name = "Tiger_Prawn"
local FName_FName = getAddressSafe( "FName_FName" )
if FName_FName ~= 0x0 then
local p = allocateMemory( 256 ) -- from here, we start converting char to wchar
local s = p + 0x8
writeString( s, name, true )
writeBytes( s + #name * 2, 0 ) -- till here
local FName_id = executeCodeEx( 0, nil, FName_FName, p, s, 1 )
if readInteger( FName_id ) ~= 0x0 then
print( string.format( "id: 0x%08X", readInteger( FName_id ) ) )
end
deAlloc( s )
end
Here's the run-down in my case:
The id is 0x8370, as you can see.
BR,
Sun
How to use this cheat table?
- Install Cheat Engine
- Double-click the .CT file in order to open it.
- Click the PC icon in Cheat Engine in order to select the game process.
- Keep the list.
- Activate the trainer options by checking boxes or setting values from 0 to 1
