SunBeam wrote: ↑Tue Feb 06, 2018 6:29 am
fullaccess( ACOrigins.exe, 0x1000 )
define( Hook, ACOrigins.exe+500 )
Just in case for me and anyone else not such skilled, who might be interesting in it, question not only to SunBeam, but everyone.
I trying to make cheats for control environment values like clouds, fog and so on, but before it crash the game. After i read this and google it a bit, looks look i get it to work.
Previous version of script that cause crash:
Code: Select all
[ENABLE]
aobscanmodule(Enviro1,ACOrigins.exe,89 03 48 81 C4 90 00 00 00 5F 5E 5B C3 8B) // should be unique
alloc(newmem,$1000,"ACOrigins.exe"+84DF92)
label(code)
label(return)
newmem:
code:
//mov [rbx],eax
add rsp,00000090
jmp return
Enviro1:
jmp newmem
nop
nop
nop
nop
return:
registersymbol(Enviro1)
[DISABLE]
Enviro1:
db 89 03 48 81 C4 90 00 00 00
unregistersymbol(Enviro1)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ACOrigins.exe"+84DF92
"ACOrigins.exe"+84DF78: 0F B7 06 - movzx eax,word ptr [rsi]
"ACOrigins.exe"+84DF7B: 66 89 03 - mov [rbx],ax
"ACOrigins.exe"+84DF7E: 0F B6 46 02 - movzx eax,byte ptr [rsi+02]
"ACOrigins.exe"+84DF82: 88 43 02 - mov [rbx+02],al
"ACOrigins.exe"+84DF85: 48 81 C4 90 00 00 00 - add rsp,00000090
"ACOrigins.exe"+84DF8C: 5F - pop rdi
"ACOrigins.exe"+84DF8D: 5E - pop rsi
"ACOrigins.exe"+84DF8E: 5B - pop rbx
"ACOrigins.exe"+84DF8F: C3 - ret
"ACOrigins.exe"+84DF90: 8B 06 - mov eax,[rsi]
// ---------- INJECTING HERE ----------
"ACOrigins.exe"+84DF92: 89 03 - mov [rbx],eax
"ACOrigins.exe"+84DF94: 48 81 C4 90 00 00 00 - add rsp,00000090
// ---------- DONE INJECTING ----------
"ACOrigins.exe"+84DF9B: 5F - pop rdi
"ACOrigins.exe"+84DF9C: 5E - pop rsi
"ACOrigins.exe"+84DF9D: 5B - pop rbx
"ACOrigins.exe"+84DF9E: C3 - ret
"ACOrigins.exe"+84DF9F: 8B 06 - mov eax,[rsi]
"ACOrigins.exe"+84DFA1: 89 03 - mov [rbx],eax
"ACOrigins.exe"+84DFA3: 0F B7 46 04 - movzx eax,word ptr [rsi+04]
"ACOrigins.exe"+84DFA7: 66 89 43 04 - mov [rbx+04],ax
"ACOrigins.exe"+84DFAB: 48 81 C4 90 00 00 00 - add rsp,00000090
"ACOrigins.exe"+84DFB2: 5F - pop rdi
}
And current, that looks stable (at least i do not get crashes after 2 restarts of the game and activating/deactivating it few times):
Code: Select all
fullaccess( ACOrigins.exe, 0x1000 )
define( newmem, ACOrigins.exe+500 )
[ENABLE]
aobscanmodule(Enviro1,ACOrigins.exe,89 03 48 81 C4 90 00 00 00 5F 5E 5B C3 8B) // should be unique
alloc(newmem,0x1000,ACOrigins.exe)
label(code)
label(return)
newmem:
code:
//mov [rbx],eax
add rsp,00000090
jmp return
Enviro1:
jmp newmem
nop
nop
nop
nop
return:
registersymbol(Enviro1)
[DISABLE]
Enviro1:
db 89 03 48 81 C4 90 00 00 00
unregistersymbol(Enviro1)
dealloc(newmem)
So for now looks like i can do all the stuff inside this script, like doing compare, allocate specific outside address [myvar] and so on, right? Or that i don't get crashes for now - is just some kind of luck and i need to learn it further?