Advanced Course of Cheating Engine: gtutorial-i386 Breaks Level 3 [Sprinkling Flowers]

Cheating Engine gtutorial-i386: Level 1.

The cheating engine gtutorial-i386 broke through Level 2.

The author continues the abnormal style of the last level, and the game still can't pass without modifying the third level of gtutorial (at least I can't! ): The white villain in the lower left corner is the player, and the three hedgehogs on the screen are moving obstacles, and the player will die if he touches them. The game prompt is: turn all red platforms into green and open the door.

The whole game has two difficulties: difficulty 1. If you don't modify the game, players can't jump from platform A to platform B, let alone the hedgehog on the ground, which will affect the game! Difficulty 2: At the moment of opening the door, three hedgehogs flew to the door, posing as a door-to-door debt collector and blocking the door. Players will fail to pass customs when they meet hedgehogs, and players can't get in at all.

Now let's get down to business and talk about how to get through customs. Inspired by this article to create a cheat sheet-coordinates, my idea is to modify the player's coordinates so that it can reach any position on the screen. Because there are two difficulties, this paper is divided into two parts.

Let's start with the difficulty 1. How to open the door: In the whole game, except the player can move up and down (jump), both the player and the obstacle can move horizontally, so it is easier to locate the player's Y coordinate than the X coordinate. At first, I jumped back and forth on several lower platforms to change and locate the player's Y coordinate, but due to the influence of hedgehog, the game ended before the Y coordinate was determined.

So I re-examined the game: the author said that all platforms should be green before opening the door. I calculated that there are 12 platforms on the ground under the player's feet. Is it possible for the author to set a global variable in the program to record the number of green platforms? Let's have a try. At the beginning of the game, the ground has changed color, so enter 1 in the value editing box of CE. Select Exact Value for Scan Type; Select "4 Bytes" as the value type, and then press "First Scan" for the first scan. Then jump to the platform-scan, repeat several times, and immediately locate the platform variable with color change:

After locating the variable, it is simple. Just change the variable value to 12 directly, and the door on the right side of the screen will open immediately, but at the same time, the plot in the second half of the game will start immediately (see the villain's expression, it is clearly WTF):

2. After the hedgehog blocked the door, because there was no interference, the coordinates of the search player became Ma Pingchuan instead. Search for the X coordinate first, let the player return to the lower left corner of the screen, click "New Scan" on CE, set the Scan Type to "Unknown Initial Value" and the Value Type to "Floating Point", and then click "First Scan".

After that, control the player to move slowly to the right. Every time you move-pause, set the "Scan Type" to "Added Value" in CE and click "Next Scan" to locate the X coordinate several times. Finally, the reader will find that the x coordinate changes in the range of [- 1, 1]:

With the address of the variable storing the X coordinate, it is estimated that the address of the variable storing the Y coordinate must be nearby. Since sizeof(float)=4, the y coordinate may be 4 bytes away from the x coordinate. We need to copy and paste the x-coor item from the Cheat table twice. Set the value of "Adjust Address Basis" to 4 for the first time ("Adjust Address Basis" refers to the offset of the address of the copied item relative to the source item), and set the description of the new item in the CT table to "Y-coor (+4)"; Set the value of "Address Adjustment Basis" to -4 for the second time, and set the description of the newly added entry in the CT table to "y-coor(-4)":

Of course, the two CT items just added are not necessarily Y coordinates, and their correctness needs to be verified by jumping up and down. Press the "P" key in the game to make the game tentative. We record the original data when the athletes take off, record the data again after the athletes take off and record the data for the third time after landing. Through the above steps, the address of x coordinate+sizeof (float) = the address of y coordinate can be found. With these two coordinate variables, you can change the player's position at will, such as floating (to achieve the effect of floating, remember to freeze the two variables of X coordinate and Y coordinate), as shown below:

At this point, customs clearance is not a problem. However, I always feel that something is missing. Yes, there is no plug-in! Well, what does this plug-in do? It seems that the process of locating the player's coordinates in the whole game is the most complicated, so make a locating plug-in to locate the base address of the player's coordinates ~

First, locate the instruction to access the Y coordinate, select the y-coor item in the ct table, and right-click "Find out what this address is written".

Go back to the game and move the player. At this time, CE's "Write the following operation code" window will list the instruction to modify the Y coordinate and the base address of the structure that stores the player's coordinates (in Extra Info? "The pointer value needed to find this address may be 0 1905980"):

The extra information window shows that the pointer to the base address of the access coordinate is stored in edx. Ok, let's write an AA script to write edx into globally accessible memory. The script is as follows:

After activating the script, you need to create a coorbase item in the CT table of CE-click "Add Address Manually" and fill in the contents of the "Add Address" window:

Coorbase stores pointers, through which we will eventually access the x/y coordinates respectively, so we need to add two addresses at hand respectively and drag these items under Step3 to form a group. Right-click menu Group Configuration-Hide Children When Deactivating Step 3:

The reason for choosing this option is that coorbase is created in the Step3 script. When this script is disabled, coorbase is released, and it is unreasonable to read the player's coordinates from the released address, so it is handled this way.

This is an entry in the final CT table:

When you enter this level again, you can get the player's coordinates immediately by applying this script ~

Original link: /thread-24955 1.htm

Read more information:

X Encryption-Debugging -DumpDex- Repair Instruction-Repackaging

Brief introduction to common vulnerabilities of AOSP

XCTF attack and defense world anti-sprouting new pit third question IgniteMe finishing

Analysis and Utilization of Prototype Pollution Attack of Node.js