Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


QSP Engine

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions
View previous topic :: View next topic  
Author Message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 47

PostPosted: Wed Jan 11, 2017 2:39 pm    Post subject: QSP Engine Reply with quote

Hello

I want to ask if there is a way in cheat engine to do table that will search game for variable and not base addresses because game is still in development and code changes a lot. Game use QSP engine (game is file loaded into QSP player) so I can find fixed base pointers just fine (when hex search address there is already base address for pointer) but when developers changes code (when first time is variable mentioned in code has changed place for example) I need to find address and pointer again.

So I wonder if there is way to go around pointers and somehow go after variable names or whatever...
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3528

PostPosted: Wed Jan 11, 2017 3:23 pm    Post subject: Reply with quote

AOB injection?
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 47

PostPosted: Wed Jan 11, 2017 3:59 pm    Post subject: Reply with quote

I dont think aob will work. Function for every address is same. Only difference is in registers.


1.png
 Description:
 Filesize:  73.63 KB
 Viewed:  3533 Time(s)

1.png


Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3528

PostPosted: Wed Jan 11, 2017 4:10 pm    Post subject: Reply with quote

That has nothing to do with AOB injection or how CE determines where to inject. If all available instructions access multiple addresses, then you'll need to filter them out. In your case, a proper identifier might be stored in one of the registers.

AOB injection is exactly what you need, as it will scan for hex data to determine where to inject (or what to manipulate). You can incorporate wildcard variables for bytes that are dynamic and are prone to change during updates/patches.
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 47

PostPosted: Wed Jan 11, 2017 5:08 pm    Post subject: Reply with quote

Well I still dont know how to make it work. I have different versions of that game and same variable have different registers in same function. ECX register is same as address (example - variable "minute" have address "01234567" and that address access code "mov [ecx+ebp*8],edx" where ECX is "01234567" (same as address) EBP is always 0 and EDX in old is 2 and in new is 3...)

And I should probably tell that I am not too good with assembly yet... Embarassed
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3528

PostPosted: Wed Jan 11, 2017 5:24 pm    Post subject: Reply with quote

If EBP is always 0 for the address of the value that you are trying to manipulate, and only that address, then you can use that as your identifier to filter out unwanted addresses.

Having different versions of the game doesn't matter - that's what the AOB signature is for. You find a solid signature that can be used across all versions. You can incorporate wildcard entries as needed.

You don't have to be good at assembly, since CE can auto-generate the script for you. All you have to do is know what to change and how to filter out what you don't want to change.

If you haven't done so already, I would recommend completing the CE tutorial. You can follow guides and videos that will help you understand along the way.
Back to top
View user's profile Send private message
liledition
Cheater
Reputation: 0

Joined: 12 Sep 2014
Posts: 47

PostPosted: Wed Jan 11, 2017 5:44 pm    Post subject: Reply with quote

EBP is always 0 for all addresses.

Auto generated script for AOB injection is same every for version I have because all addresses use same code.

I did do tutorial long time ago. It help greatly at start of using CE but it info is rarely useful for new games/java games/emulated games...


Problem with this game is that it is emulated. Program that runs game only reading values from game file and it loads values in order they are used in game... So when variables have different addresses when they are listed in different order (variable A done first is address X but when variable B is done first (before A) then variable B is address X...)
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 72

Joined: 29 Oct 2010
Posts: 3528

PostPosted: Wed Jan 11, 2017 6:02 pm    Post subject: Reply with quote

AOB injection is probably your best bet. You can use an LUA script or AOBScanRegion if finding a unique and reliable AOB signature is not possible. Finding reliable identifiers for your filters can be daunting at first, but are usually necessary for emulated code.

Some methods for finding a unique identifier for filtering purposes:

++METHOS wrote:
  • You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
  • You can use pointer trees inside of the data structure to find something viable.
  • You can shift the data structure (+ or -) and/or expand its size to find something useful.
  • You can use the structure spider to find workable strings and/or for comparative analysis.
  • You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
  • You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
  • You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
  • You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
  • Et al.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites