50as_df wrote: ↑Sun Jul 16, 2023 10:33 pm
a11b20 wrote: ↑Sun Jul 16, 2023 8:28 am
i find equip script working on v1.12 by steam
copy and change script
[ENABLE]
aobscanmodule(Equip,WoLong.exe,8B 08 E8 F2 9F C3 FF) // should be unique
alloc(newmem,$128,Equip)
alloc(Pequip,4)
label(code return)
registersymbol(Equip Pequip)
newmem:
mov [Pequip],rax
code:
mov ecx,[rax]
call WoLong.exe+BF3400
jmp return
Equip:
jmp newmem
nop 2
return:
[DISABLE]
Equip:
db 8B 08 E8 F2 9F C3 FF
unregistersymbol(*)
dealloc(*)
Newbee here, may I ask how you find it? I'm using gamepass version so steam one does not work.
I found the original pattern in comment in Memory viewer, what should be my next step here? Thanks.
I'm new to cheat engine so I don't know if this will help. And Google Translate.
Here's how I did it.
First, run change script in equip to check the script.
At the bottom, the same code format as the original code is searched.
Enter the disassemble memory option of the shortcut ctrl+D and search for the assemble code in the search item.
(ex.
add rsp,30
pop rdi
ret
mov ecx,[rax])
If you search, you can find codes in which all other code types match the original code, except for the code that refers to the address, such as the form of WoLong.exe+000000.
The point to check is this part of the original code.
// ---------- INJECTING HERE ----------
WoLong.exe+FB8667:
8B 08 - mov ecx,[rax]
// ---------- DONE INJECTING ----------
WoLong.exe+FB8669:
E8 22 A7 C3 FF - call WoLong.exe+
BF2D90
Check the corresponding part in your code window and in the script I wrote
The HEX part of the first line.
[ENABLE]
aobscanmodule(Equip,WoLong.exe,
8B 08 E8 F2 9F C3 FF)
The address portion of the code in the middle line.
code:
mov ecx,[rax]
call WoLong.exe+
BF3400
jmp return
The HEX part of the last line.
[DISABLE]
Equip:
db
8B 08 E8 F2 9F C3 FF
You can modify and apply this detail to the part shown in your assemble code window.
same color is same change parts.