Kaidohishida
24th April 2007, 07:22
The following is a old tutorial given by Fangor from CEF.
Well... I've seen one or two people wondering how to use pointers in a script, and I'm bored, so here it is. With pointers, you can't just put the address in a script like with a normal address, because there is a base and an ofset. Instead, you have to use registers. here's an example of an Auto-DC script that uses the People Scanner pointer:
Code:
[enable]
alloc(check,32)
check:
mov eax,[7d421c]
mov eax,[eax+18]
cmp eax,0
jne 0
and eax,7fff
ret
71723d:
call Check
[disable]
71723d:
and eax,7fff
dealloc(Check)
In the script, the first thing we do is move the value of the pointer base(7d421c) into the EAX register. Notice the square brackets around the address, it tells the script to move the value at the address 7d421c into the EAX register. If the brackets weren't there, it would move the number 7d421c into the EAX. Other registers can be used, but we're using EAX here. Next, you move the register + the pointer offset into itself, with those brackets around the register + offset. You have to do it this way, because doing mov eax,[7d421c+18] just won't work. Now we have the pointer's value in the EAX register. Next the script compares the pointer's value to 0, and if it's not 0(there are people on the map), it executes a code to crash the game. Here's a script that uses multiple pointers and registers, dICE Vac:
Code:
[enable]
alloc(dICE,64)
alloc(right,4)
alloc(left,4)
registersymbol(right)
registersymbol(left)
label(return)
dICE:
pushad
mov edx, [7d4d88]
mov ebx, [edx+57c]
mov ecx,[edx+580]
add ebx, [right]
sub ebx, [left]
mov eax,[7d4214]
mov [eax+C],ebx
mov [eax+14],ebx
mov [eax+10],ecx
mov [eax+18],ecx
popad
mov [ebx], eax
mov edi,[ebp+10]
jmp return
right: //Set right to 0.
db 00 00
left: //Set left to 0.
db 00 00
6B621B:
jmp dICE
return:
6B8B7D:
db 0f 84
6B266A:
db 75
6B2906:
db 0f 85
[disable]
6B621B:
mov [ebx], eax
mov edi,[ebp+10]
6B8B7D:
db 0f 85
6B266A:
db 74
6B2906:
db 0f 84
dealloc(dICE)
dealloc(left)
dealloc(right)
unregistersymbol(left)
unregistersymbol(right)
At the part labeled "dICE", the first thing it does is push all of the registers onto the stack using "pushad". This is necessary when using multiple registers like this script does. Then it moves the Character Coordinate base address into the EDX register, and moves the offsets for Char X and Y into separate registers. Then it does the same for the four wall pointers, and moves Character X into Wall Left and Right, and Character Y into Wall Top and Bottom. After manipulating the registers, it uses "popad" to pop them back onto the stack. After pushing any register, you have to pop it. So... now you (hopefully) know how to use pointers in registers. And... may the 1337 h4x force be with you...
I'm pretty noob so i need to ask a few question regarding the formats. The codes are from a section of dICE. Please answer my 5 questions.
1.)
mov edx, [007DDA80] // Character Code
The value for character "007DDA80" is moved into the place-holder called edx, so whenever we have edx henseforth, we are actually calling the value "007DDA80" ???
If i'm right say YES / NO (Why ?) .
2.)
mov ebx, [edx+590] // Char X
This means we are moving 007DDA80 + 590 (Cordinate of char on x-axis) into the place-holder ebx???
If i'm right say YES / NO (Why ?) .
3.)
mov ecx,[edx+594] // Char Y
This means we are moving 007DDA80 + 590 (Cordinate of char on y-axis) into the place-holder ecx???
If i'm right say YES / NO (Why ?) .
4.)
add ebx, 46
What does this mean??? It means that we are adding to the value of ebx (007DDA80 + 590 ) with another 46? So its coordinate is something like (007DDA80 + 590 + 46) so watever that is, it'll appear on the right of the char X coordinate???
If i'm right say YES / NO (Why ?) .
5.)
mov [ebx], eax
I am lost on this one, what does it do? Cause the format is different from the above ones.
a.) Move value of eax into the place-holder ebx?
b.) Move value of ebx into the place-holder eax?
Which one is this???
Well... I've seen one or two people wondering how to use pointers in a script, and I'm bored, so here it is. With pointers, you can't just put the address in a script like with a normal address, because there is a base and an ofset. Instead, you have to use registers. here's an example of an Auto-DC script that uses the People Scanner pointer:
Code:
[enable]
alloc(check,32)
check:
mov eax,[7d421c]
mov eax,[eax+18]
cmp eax,0
jne 0
and eax,7fff
ret
71723d:
call Check
[disable]
71723d:
and eax,7fff
dealloc(Check)
In the script, the first thing we do is move the value of the pointer base(7d421c) into the EAX register. Notice the square brackets around the address, it tells the script to move the value at the address 7d421c into the EAX register. If the brackets weren't there, it would move the number 7d421c into the EAX. Other registers can be used, but we're using EAX here. Next, you move the register + the pointer offset into itself, with those brackets around the register + offset. You have to do it this way, because doing mov eax,[7d421c+18] just won't work. Now we have the pointer's value in the EAX register. Next the script compares the pointer's value to 0, and if it's not 0(there are people on the map), it executes a code to crash the game. Here's a script that uses multiple pointers and registers, dICE Vac:
Code:
[enable]
alloc(dICE,64)
alloc(right,4)
alloc(left,4)
registersymbol(right)
registersymbol(left)
label(return)
dICE:
pushad
mov edx, [7d4d88]
mov ebx, [edx+57c]
mov ecx,[edx+580]
add ebx, [right]
sub ebx, [left]
mov eax,[7d4214]
mov [eax+C],ebx
mov [eax+14],ebx
mov [eax+10],ecx
mov [eax+18],ecx
popad
mov [ebx], eax
mov edi,[ebp+10]
jmp return
right: //Set right to 0.
db 00 00
left: //Set left to 0.
db 00 00
6B621B:
jmp dICE
return:
6B8B7D:
db 0f 84
6B266A:
db 75
6B2906:
db 0f 85
[disable]
6B621B:
mov [ebx], eax
mov edi,[ebp+10]
6B8B7D:
db 0f 85
6B266A:
db 74
6B2906:
db 0f 84
dealloc(dICE)
dealloc(left)
dealloc(right)
unregistersymbol(left)
unregistersymbol(right)
At the part labeled "dICE", the first thing it does is push all of the registers onto the stack using "pushad". This is necessary when using multiple registers like this script does. Then it moves the Character Coordinate base address into the EDX register, and moves the offsets for Char X and Y into separate registers. Then it does the same for the four wall pointers, and moves Character X into Wall Left and Right, and Character Y into Wall Top and Bottom. After manipulating the registers, it uses "popad" to pop them back onto the stack. After pushing any register, you have to pop it. So... now you (hopefully) know how to use pointers in registers. And... may the 1337 h4x force be with you...
I'm pretty noob so i need to ask a few question regarding the formats. The codes are from a section of dICE. Please answer my 5 questions.
1.)
mov edx, [007DDA80] // Character Code
The value for character "007DDA80" is moved into the place-holder called edx, so whenever we have edx henseforth, we are actually calling the value "007DDA80" ???
If i'm right say YES / NO (Why ?) .
2.)
mov ebx, [edx+590] // Char X
This means we are moving 007DDA80 + 590 (Cordinate of char on x-axis) into the place-holder ebx???
If i'm right say YES / NO (Why ?) .
3.)
mov ecx,[edx+594] // Char Y
This means we are moving 007DDA80 + 590 (Cordinate of char on y-axis) into the place-holder ecx???
If i'm right say YES / NO (Why ?) .
4.)
add ebx, 46
What does this mean??? It means that we are adding to the value of ebx (007DDA80 + 590 ) with another 46? So its coordinate is something like (007DDA80 + 590 + 46) so watever that is, it'll appear on the right of the char X coordinate???
If i'm right say YES / NO (Why ?) .
5.)
mov [ebx], eax
I am lost on this one, what does it do? Cause the format is different from the above ones.
a.) Move value of eax into the place-holder ebx?
b.) Move value of ebx into the place-holder eax?
Which one is this???