Cheat Engine

deama1234 · Posted: Wed Sep 23, 2015 5:33 pm Post subject: repe movsd?

There's this 4 byte integer value (strength); when I look at what is "writing" to it, I go back into the game and increase the value; it comes up with some weird instruction I haven't seen, "repe movsd"; CE tells me that it "moves data from string to string"? If I try and see what accesses that instruction, nothing comes up.

So how would I modify the address this instruction is accessing?

Here's a screenshot:

Zanzer · Posted: Wed Sep 23, 2015 7:41 pm Post subject:

Are you sure the value is really 4-bytes? If your stats can't go above 255, try changing the type to 1-byte.
Also, choose what ACCESSES the address instead. Do you see a better instruction?

Have you tried changing the value of address you found?
Does it actually update the game? Change it and try increasing it by 1 again, in-game.
Did it revert back to its original value +1 or increase the value you set it to?

deama1234 · Posted: Thu Sep 24, 2015 8:19 am Post subject:

Rydian · Posted: Thu Sep 24, 2015 10:54 am Post subject:

Older Game Maker games, script interpretation thing, I don't know of any specific way to mess with it and nobody else I've seen here does either.

deama1234 · Posted: Thu Sep 24, 2015 11:08 am Post subject:

ParkourPenguin · Posted: Thu Sep 24, 2015 3:35 pm Post subject:

I don't know why CE is translating that as "repe movsd", I think "rep movsd" is a better mnemonic (and ODA translates it as that), but I'll explain both.

"movsd" as a standalone instruction moves the doubleword at the address in ESI to the address in EDI. After it does this, it increments both ESI and EDI by the size of the data you moved (4 in the case of a dword).
More info on movsd

"rep" and "repe" are very similar. They aren't instructions, but act like prefixes to a certain instruction. They repeat this instruction using ECX as a counter. ECX is decremented by 1 after each iteration, and if ECX is ever 0, it stops and goes on to the next instruction.
More info on rep/repe

The main difference is that "repe" will also exit if the zero flag isn't set. Since neither "movsd" nor "rep/repe" modify any flags, I don't think "repe" is a correct interpretation of those specific opcodes. If it was trying to check if the ZF is set initially, I think JNZ/JNE would've been preferred prior to all the setup for the "rep movsd" instruction.

(from this point on, "strength" refers to the address your strength value is stored at, not the value itself)
Anyways, in order to get what address is being read from and put into strength (or vise versa for instructions reading from strength), you have to look at ESI if the instruction is writing to strength or EDI if the instruction is reading form strength. You can tell whether that instruction is writing to / reading from strength by setting a breakpoint and looking at ECX, ESI, and EDI, which you'd need to do anyway for finding ESI/EDI.

TLDR: In all honesty, though, I wouldn't recommend trying to increase the max this way. It's not worth the effort IMO.

deama1234 · Posted: Thu Sep 24, 2015 4:12 pm Post subject:

ParkourPenguin · Posted: Thu Sep 24, 2015 5:05 pm Post subject:

deama1234 · Posted: Thu Sep 24, 2015 6:35 pm Post subject:

ParkourPenguin · Posted: Thu Sep 24, 2015 7:48 pm Post subject:

In that case, the address you found is used strictly as a means of storage, such that no useful routine directly touches that address. If a useful routine (i.e. the one that checks if it's greater than the max value) needs to read this address, it will call this subroutine that gets the value and gives it to the routine that wants it. This is more inefficient than just getting it directly, but it also makes tracking down a specific routine (i.e. the max value checker) much harder.

I don't think it's feasible to get past the max value using what instructions access that address. You'd probably have a better time searching for the max values and ruling out the hundreds of thousands of matches you'd get by hand.

There is one more thing that you might be able to try: you said that "I can also find the other stats nearby". If the stats' values are all next to each other, then the max values for these stats might also be next to each other in the same pattern, even if they aren't near the stats themselves. Turn all the max values into an AoB (in the same order that the stats are in), scan for that, and if you're lucky, you might find where the max values are stored.

Beyond that, I can't think of any easy way of getting past it.

deama1234 · Posted: Fri Sep 25, 2015 6:58 am Post subject:

Rydian · Posted: Fri Sep 25, 2015 7:17 am Post subject:

You can see if you can try to find a structure for the global variables too, if you know what they are.