Reputation: 72
I'm using Cheat Engine to create AOB Injection script for single player game.
I have the following memory view:
The main goal is to modify xmmo,xmm1,xmm2 to update [rdx+offset] values. The modification is quite simple - declare a multiplier and multiply each of xmm.
I created a script that should do it:
[ENABLE]
aobscan(INJECT,48 89 6C 24 10 * * * * 40 * * * * 50) // should be unique
alloc(newmem,$1000,INJECT)
label(code)
label(return)
label(h)
registersymbol(h)
newmem:
vmulsd xmm0, xmm0,[h]
vmulsd xmm1, xmm1,[h]
vmulsd xmm2, xmm2,[h]
code:
mov [rsp+10],rbp
jmp return
h:
dd (float)0.5
INJECT:
jmp newmem
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 48 89 6C 24 10
unregistersymbol(INJECT)
dealloc(newmem)
unregistersymbol(h)
{
// ORIGINAL CODE - INJECTION POINT: 1E09CB59EA7
1E09CB59E7D: 00 00 - add [rax],al
1E09CB59E7F: 00 44 8B 52 - add [rbx+rcx*4+52],al
1E09CB59E83: 08 49 C1 - or [rcx-3F],cl
1E09CB59E86: E2 03 - loop 1E09CB59E8B
1E09CB59E88: 49 3B C2 - cmp rax,r10
1E09CB59E8B: 0F 85 0F BE DB FC - jne 1E099915CA0
1E09CB59E91: 66 66 90 - nop 3
1E09CB59E94: 66 0F 1F 44 00 00 - nop word ptr [rax+rax+00]
1E09CB59E9A: 66 0F 1F 44 00 00 - nop word ptr [rax+rax+00]
1E09CB59EA0: 48 81 EC 18 00 00 00 - sub rsp,00000018
// ---------- INJECTING HERE ----------
1E09CB59EA7: 48 89 6C 24 10 - mov [rsp+10],rbp
// ---------- DONE INJECTING ----------
1E09CB59EAC: C5 FB 11 42 40 - vmovsd [rdx+40],xmm0
1E09CB59EB1: C5 FB 11 52 50 - vmovsd [rdx+50],xmm2
1E09CB59EB6: C5 FB 11 4A 48 - vmovsd [rdx+48],xmm1
It actually works, but it always multiply at 0 even though I specified 0.5 in the scipt. Here is a newmem view:
What am I doing wrong? Why h symbol does not have any value? Maybe there is a better way to do it?
Upvotes: 0
Views: 24