Алексей
Алексей

Reputation: 72

Why is AOB Injection script does not work as expected

I'm using Cheat Engine to create AOB Injection script for single player game. I have the following memory view: enter image description here

The main goal is to modify xmmo,xmm1,xmm2 to update [rdx+offset] values. The modification is quite simple - declare a multiplier and multiply each of xmm.

I created a script that should do it:

[ENABLE]

aobscan(INJECT,48 89 6C 24 10 * * * * 40 * * * * 50) // should be unique
alloc(newmem,$1000,INJECT)

label(code)
label(return)
label(h)

registersymbol(h)
newmem:
  vmulsd xmm0, xmm0,[h]
  vmulsd xmm1, xmm1,[h]
  vmulsd xmm2, xmm2,[h]

code:
  mov [rsp+10],rbp
  jmp return
h:
  dd (float)0.5
INJECT:
  jmp newmem
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 48 89 6C 24 10

unregistersymbol(INJECT)
dealloc(newmem)
unregistersymbol(h)

{
// ORIGINAL CODE - INJECTION POINT: 1E09CB59EA7

1E09CB59E7D: 00 00                 - add [rax],al
1E09CB59E7F: 00 44 8B 52           - add [rbx+rcx*4+52],al
1E09CB59E83: 08 49 C1              - or [rcx-3F],cl
1E09CB59E86: E2 03                 - loop 1E09CB59E8B
1E09CB59E88: 49 3B C2              - cmp rax,r10
1E09CB59E8B: 0F 85 0F BE DB FC     - jne 1E099915CA0
1E09CB59E91: 66 66 90              - nop 3
1E09CB59E94: 66 0F 1F 44 00 00     - nop word ptr [rax+rax+00]
1E09CB59E9A: 66 0F 1F 44 00 00     - nop word ptr [rax+rax+00]
1E09CB59EA0: 48 81 EC 18 00 00 00  - sub rsp,00000018
// ---------- INJECTING HERE ----------
1E09CB59EA7: 48 89 6C 24 10        - mov [rsp+10],rbp
// ---------- DONE INJECTING  ----------
1E09CB59EAC: C5 FB 11 42 40        - vmovsd [rdx+40],xmm0
1E09CB59EB1: C5 FB 11 52 50        - vmovsd [rdx+50],xmm2
1E09CB59EB6: C5 FB 11 4A 48        - vmovsd [rdx+48],xmm1

It actually works, but it always multiply at 0 even though I specified 0.5 in the scipt. Here is a newmem view: enter image description here

What am I doing wrong? Why h symbol does not have any value? Maybe there is a better way to do it?

Upvotes: 0

Views: 24

Answers (0)

Related Questions