Lua Debugging - Revision history

TheyCallMeTim13 at 11:51, 19 March 2017

2017-03-19T11:51:43Z

Raijinili: /* Available variables */ That's not error flags

2016-01-21T22:56:13Z

‎Available variables: That's not error flags

Raijinili: Expanding variables section

2016-01-21T20:09:58Z

Expanding variables section

Raijinili: adding available variables

2016-01-21T17:58:53Z

adding available variables

Raijinili: /* debug_setBreakpoint() */ adding source code reference

2016-01-21T17:29:46Z

‎debug_setBreakpoint(): adding source code reference

Jgoemat: /* debug_setBreakpoint() */ removed duplicate TContinueOption

2011-12-14T12:04:10Z

‎debug_setBreakpoint(): removed duplicate TContinueOption

Jgoemat: /* Lua Debugging */

2011-12-14T12:03:32Z

‎Lua Debugging

Dark Byte: debug_continueFromBreakpoint takes an integer

2011-12-12T06:17:16Z

debug_continueFromBreakpoint takes an integer

Jgoemat: Created page with '== Lua Debugging == There are functions exposed to LUA that enable scripts to control the debugger: * '''openProcess(name)''' - Open a running process * '''debugProcess()''' - …'

2011-12-11T23:15:41Z

Created page with '== Lua Debugging == There are functions exposed to LUA that enable scripts to control the debugger: * '''openProcess(name)''' - Open a running process * '''debugProcess()''' - …'

New page

== Lua Debugging ==

There are functions exposed to LUA that enable scripts to control the debugger:

* '''openProcess(name)''' - Open a running process
* '''debugProcess()''' - Start debugging the open process
* '''debug_setBreakpoint(address)''' - Add a breakpoint at an address
* '''debug_continueFromBreakpoint(method)''' - Continue execution, methods are "co_run", "co_stepinto" and "co_stepover"
(and possibly "co_runtill" which is in TContinueOption but not shown in main.lua).

In addition, you can create the event function '''debugger_onBreakpoint()''' that will
be called by Cheat Engine whenever a breakpoint is hit.

Here's an example for Space Pirates and Zomies that tracks ships that have their armor decreased.
By debugging I found that at 0x406002, ECX has a pointer to a structure with the armor float at 0x60.
This code will track those values in the armors table with the key being the address and the value
being the actual armor value:

<pre>
if not armors then
armors = { }
end

function debugger_onBreakpoint()
if (EIP ~= 0x00406002) then return 0 end -- ignore user-set breakpoints
armors[ECX] = readFloat(ECX+0x60) -- store armor in table
debug_continueFromBreakpoint(":co_run") -- continue execution
return 1 -- let CE know we handled breakpoint, no need to update debugger form
end

openProcess("SpazGame.exe")
debugProcess()
debug_setBreakpoint(0x00406002)
</pre>

← Older revision		Revision as of 11:51, 19 March 2017
Line 1:		Line 1:
		+	[[Category:Lua]]
	== Lua Debugging ==		== Lua Debugging ==

@@ Line 66: / Line 66: @@
 ** [https://en.wikipedia.org/wiki/Streaming_SIMD_Extensions#Registers XMM] registers: <code>XMM0</code>, <code>XMM1</code>, <code>XMM2</code>, <code>XMM3</code>, <code>XMM4</code>, <code>XMM5</code>, <code>XMM6</code>, <code>XMM7</code>
 ** If CE 64-bit: <code>XMM8</code>, <code>XMM9</code>, <code>XMM10</code>, <code>XMM11</code>, <code>XMM12</code>, <code>XMM13</code>, <code>XMM14</code>, <code>XMM15</code>
-* Error flags: <code>EFLAGS</code>
+* <code>EFLAGS</code>

@@ Line 43: / Line 43: @@
 ** bptWrite: break when memory in the area is written to
-Types from debuggertypedefinitions.pas[https://github.com/cheat-engine/cheat-engine/blob/fa7b398f653bbafb3c32b4b5ca6108df3c63f2e6/Cheat%20Engine/debuggertypedefinitions.pas#L27]:
+Types from debuggertypedefinitions.pas[https://github.com/cheat-engine/cheat-engine/blob/master/Cheat%20Engine/debuggertypedefinitions.pas#L27]:
 <pre>
 type
@@ Line 55: / Line 55: @@
 == Available variables ==
-:''INCOMPLETE: Needs someone who hasn't just read a handful of examples.''
+These variables can be used in your <code>debugger_onBreakpoint()</code> event function.
-These variables can be used in your <code>debugger_onBreakpoint()</code> event function.
+Changes to these variables will only take effect if the process is break'd and there's no (other) current <code>debug_setBreakpoint</code> method running.
-'''Assembly registers:''' Holds the current value of the registers.
+'''Assembly registers:'''<sup>[[https://github.com/cheat-engine/cheat-engine/blob/21393be5766a4787ea6d58a9240820212dd4e944/Cheat%20Engine/LuaHandler.pas#L590 source]]</sup> Holds the current value of the registers.
-* <code>EFLAGS</code>(?)
+* (All CE versions:) <code>EAX</code>, <code>EBX</code>, <code>ECX</code>, <code>EDX</code>, <code>EDI</code>, <code>ESI</code>, <code>EBP</code>, <code>ESP</code>, <code>EIP</code>
-* (32-bit target process:) <code>EAX</code>, <code>EBX</code>, <code>ECX</code>, <code>EDX</code>, <code>EDI</code>, <code>ESP</code>, <code>EBP</code>, <code>ESP</code>, <code>EIP</code>
+* (CE 64-bit only:) <code>RAX</code>, <code>RBX</code>, <code>RCX</code>, <code>RDX</code>, <code>RDI</code>, <code>RSI</code>, <code>RBP</code>, <code>RSP</code>, <code>RIP</code>, <code>R8</code>, <code>R9</code>, <code>R10</code>, <code>R11</code>, <code>R12</code>, <code>R13</code>, <code>R14</code>, <code>R15</code>
-* (64-bit target process:) <code>RAX</code>, <code>EBX</code>, <code>RBX</code>, <code>RDX</code>, <code>RDI</code>, <code>RSP</code>, <code>RBP</code>, <code>RSP</code>, <code>RIP</code>, <code>R8</code>, <code>R9</code>, <code>R10</code>, <code>R11</code>, <code>R12</code>, <code>R13</code>, <code>R14</code>, <code>R15</code>
+* If <code>extraregs</code>(?):

← Older revision		Revision as of 17:58, 21 January 2016
Line 51:		Line 51:
	TBreakpointTrigger = (bptExecute=0, bptAccess=1, bptWrite=2);		TBreakpointTrigger = (bptExecute=0, bptAccess=1, bptWrite=2);
	</pre>		</pre>
		+
		+
		+	== Available variables ==
		+
		+	:''INCOMPLETE: Needs someone who hasn't just read a handful of examples.''
		+
		+	These variables can be used in your <code>debugger_onBreakpoint()</code> event function.
		+
		+	'''Assembly registers:''' Holds the current value of the registers.
		+	* <code>EFLAGS</code>(?)
		+	* (32-bit target process:) <code>EAX</code>, <code>EBX</code>, <code>ECX</code>, <code>EDX</code>, <code>EDI</code>, <code>ESP</code>, <code>EBP</code>, <code>ESP</code>, <code>EIP</code>
		+	* (64-bit target process:) <code>RAX</code>, <code>EBX</code>, <code>RBX</code>, <code>RDX</code>, <code>RDI</code>, <code>RSP</code>, <code>RBP</code>, <code>RSP</code>, <code>RIP</code>, <code>R8</code>, <code>R9</code>, <code>R10</code>, <code>R11</code>, <code>R12</code>, <code>R13</code>, <code>R14</code>, <code>R15</code>

@@ Line 43: / Line 43: @@
 ** bptWrite: break when memory in the area is written to
-Types from debuggertypedefinitions.pas:
+Types from debuggertypedefinitions.pas[https://github.com/cheat-engine/cheat-engine/blob/fa7b398f653bbafb3c32b4b5ca6108df3c63f2e6/Cheat%20Engine/debuggertypedefinitions.pas#L27]:
 <pre>
 type

@@ Line 50: / Line 50: @@
 type
    TBreakpointTrigger = (bptExecute=0, bptAccess=1, bptWrite=2);
 </pre>

@@ Line 5: / Line 5: @@
 * '''openProcess(name)''' - Open a running process
 * '''debugProcess()''' - Start debugging the open process
-* '''debug_setBreakpoint(address)''' - Add a breakpoint at an address
+* '''debug_setBreakpoint(address)''' - Add a breakpoint at an address, optional parameters are size and type
 * '''debug_continueFromBreakpoint(method)''' - Continue execution, methods are "co_run", "co_stepinto" and "co_stepover"
-(and possibly "co_runtill" which is in TContinueOption but not shown in main.lua).
+("co_runtill" is in TContinueOption but not shown in main.lua, probably because it needs to know what address to run to).
 In addition, you can create the event function '''debugger_onBreakpoint()''' that will
@@ Line 32: / Line 32: @@
 debugProcess()
 debug_setBreakpoint(0x00406002)
 </pre>

@@ Line 25: / Line 25: @@
           if (EIP ~= 0x00406002) then return 0 end -- ignore user-set breakpoints
           armors[ECX] = readFloat(ECX+0x60) -- store armor in table
-          debug_continueFromBreakpoint(":co_run") -- continue execution
+          debug_continueFromBreakpoint(co_run) -- continue execution
           return 1 -- let CE know we handled breakpoint, no need to update debugger form
 end