Cheat Engine :: View topic (2025)

The script for code injection is below. There was instruction that was writing decreased health value and I just skipped it if [ebx+10] = 1 (where ebx+10 stores team id):

Then I've met the same crash on code injection in graphical tutorial level 2.
Code injection script is below. Similar concept - I check if [rax+60] (which is max health of the entity) equals 0x64 (=100 health) and jump to exit right away instead of subtracting the damage from entity's health.

I'm farily new to this, can you please help me understand:
1) How do I investigate those types of crashes to know why they happen?
2) What causes them?

3) A bit of a side question. Noticed that sometimes when you attach a debugger (when you do something like "Find out what writes to this address"), it shows you instructions and then you close appeared window without clicking "Stop". Then if you open it again it stops showing new instructions that used that address. Is it because because previous debugger is still running somewhere in background? Can I somehow stop after window is closed or retrieve it's window?

Thanks.

1) If you don't know what the code you're writing does, you won't know right from wrong. Learn more about assembly. Look through a basic tutorial on x86 assembly to get started. Read an instruction set reference for more details. e.g.:
https://www.felixcloutier.com/x86/

2) You did something wrong. There's really no way to be more specific than that for such a generic question.
In the first script, your code injection screws with the x87 stack. One path, it loads 0 onto the stack; the other does nothing. Eventually, this will probably result in an x87 stack underflow or overflow.
In the second script, you jump back past the end of the original function, effectively jumping to garbage that probably isn't even valid code (at least not code that was suppose to be executed).
Don't screw with the original code if you don't know what it does.

3) Works fine for me. Go to "Memory Viewer -> View -> Breakpoint list" to see all the active breakpoints.
The game must actually access / write to the address for the respective breakpoint to trigger.

I don't know where I'm going, but I'll figure it out when I get there.

The main problem in both cases was that I assumed that it's safe just to replace all instructions overridden by code injection `jmp newmem` with my code but turn out there were some instructions overridden that must be executed from my code too (in first case it was fldz, in second - ret) , I'll post both solution below just for the reference.

Solutions:
1) Step 9 tutorial. The problem was that for the player it was jumping to `exit` label and `fldz` instruction was never executed in that case resulting in crash.
Why it worked on x64 - on x64 it was overridding just 1 instruction `movss [rbx+08],xmm0` so there were no need to reuse any overridden instructions in `newmem` code.

Solution:

2) Problem with graphic tutorial code was that in case player taking damage it was jumping to `returnhere` and never executing `ret`, so the solution was: