Auto Assembler:CCODE - Revision history

Dark Byte at 21:27, 19 December 2021

2021-12-19T21:27:34Z

Dark Byte at 13:47, 29 November 2021

2021-11-29T13:47:42Z

Dark Byte at 13:44, 29 November 2021

2021-11-29T13:44:46Z

Dark Byte at 12:35, 29 November 2021

2021-11-29T12:35:14Z

Dark Byte at 18:05, 27 November 2021

2021-11-27T18:05:16Z

Dark Byte at 18:04, 27 November 2021

2021-11-27T18:04:21Z

Dark Byte: Created page with "CE 7.2 added {$CCODE} / {$ASM} blocks Within these blocks you can write C code which will get executed by the target process at the spot it is located You can give the {$CCO..."

2021-11-27T18:03:35Z

Created page with "CE 7.2 added {$CCODE} / {$ASM} blocks Within these blocks you can write C code which will get executed by the target process at the spot it is located You can give the {$CCO..."

New page

CE 7.2 added {$CCODE} / {$ASM} blocks

Within these blocks you can write C code which will get executed by the target process at the spot it is located

You can give the {$CCODE} block parameters so you have access to certain registers in a format you can work with. When you reach the end of the block (So no 'return') the changed variables will be applied back to the related registers.

Most of the parameters are formatted as variablename=registername seperated by spaces but there are also parameters like KERNELMODE, NODEBUG and PREFIX=something
KERNELMODE will allocate the code in kernelmode, NODEBUG will skip the generation of debug code (You won't be able to see the c-code when stepping through it with the debugger) and PREFIX=something will add the text `something.` in front of the symbols, so you can distinguish in the disassembler between symbols of scripts that use the same variable names

The following register notations are allowed:
RAX/EBX, RBX/RCX, ...: Interpret as a 8/4 byte long
RAXF,RBXF,RCXF, ... : Interpret value as float
XMM0.0 or XMM0.0F (float)
XMM0.1 or XMM0.1F (float)
....
XMM1.0
...
XMM0.0D (double)
...
If you just use XMM0 to XMM15: then the variable will be of the following typedef:
‎<syntaxhighlight lang="c">
typedef struct {
union{
struct{
float f0;
float f1;
float f2;
float f3;
};
struct{
double d0;
double d1;
};
float fa[4];
double da[2];
};
} xmmreg, *pxmmreg;
‎</syntaxhighlight>
and to access double 0 of XMM0 you'd then do varname.d0 or varname.da[0]

example: RCX contains the classinstance of the player, RBX the new health after being hit, and you know that at offset b8 the 4 byte value is 1 when it's player:
‎<syntaxhighlight lang="c" line>
{$CCODE playerbase=RCX newhealth=RBX}
int isplayer=*(*int)(playerbase+0xb8);
if (isplayer)
newhealth=100000;
else
newhealth=0;
{$ASM}
‎</syntaxhighlight>
this will change the rbx register to 100000 when it's the player, and 0 when it's not

← Older revision		Revision as of 21:27, 19 December 2021
Line 1:		Line 1:
−	CE 7.2 added {$CCODE} / {$ASM} blocks	+	CE 7.3 added {$CCODE} / {$ASM} blocks

	Within these blocks you can write C code which will get executed by the target process at the spot it is located. It's also possible to debug through these blocks while viewing the original C code and you can look up the variable values/		Within these blocks you can write C code which will get executed by the target process at the spot it is located. It's also possible to debug through these blocks while viewing the original C code and you can look up the variable values/

@@ Line 1: / Line 1: @@
 CE 7.2 added {$CCODE} / {$ASM} blocks
-Within these blocks you can write C code which will get executed by the target process at the spot it is located.  It's also possible to debug through these blocks while viewing the original C code and you can look up the variable values
+Within these blocks you can write C code which will get executed by the target process at the spot it is located.  It's also possible to debug through these blocks while viewing the original C code and you can look up the variable values/
 You can give the {$CCODE} block parameters so you have access to certain registers in a format you can work with.  When you reach the end of the block (So no 'return') the changed variables will be applied back to the related registers.

@@ Line 56: / Line 56: @@
 {$CCODE decvalue=eax}
 extern __cdecl int sprintf(char *, char *, ...);  //will likely pick ntdll.sprintf
 ‎</syntaxhighlight>

← Older revision		Revision as of 12:35, 29 November 2021
Line 51:		Line 51:
	‎</syntaxhighlight>		‎</syntaxhighlight>
	this will change the rbx register to 100000 when it's the player, and 0 when it's not		this will change the rbx register to 100000 when it's the player, and 0 when it's not
		+
		+	Example of declaring a function if the default guess is wrong: (in this case sprintf which takes a variable parameter count, so has to be cdecl)
		+	‎<syntaxhighlight lang="c">
		+	{$CCODE decvalue=eax}
		+	extern __cdecl int sprintf(char , char , ...); //will likely pick ntdll.sprintf
		+	‎</syntaxhighlight>

@@ Line 9: / Line 9: @@
 The following register notations are allowed:
-RAX/EBX, RBX/RCX, ...: Interpret as a 8/4 byte long
+  RAX/EBX, RBX/RCX, ...: Interpret as a 8/4 byte long
-RAXF,RBXF,RCXF, ... : Interpret value as float
+  RAXF,RBXF,RCXF, ... : Interpret value as float
-XMM0.0 or XMM0.0F (float)
+  XMM0.0 or XMM0.0F (float)
-XMM0.1 or XMM0.1F (float)
+  XMM0.1 or XMM0.1F (float)
-....
+  ....
-XMM1.0
+  XMM1.0
-...
+  ...
-XMM0.0D (double)
+  XMM0.0D (double)
-...
+  ...
 If you just use XMM0 to XMM15:  then the variable will be of the following typedef:
 ‎<syntaxhighlight lang="c">