Cheat Engine

[ello154]

Credits to me for this tutorial!
Well I found this site and it helps alot
It's a tutorial on writing a trainer in delphi 7
http://www.f ree w eb s.com/fragmentfilehost/camf2.html <-- Erase the spaces
Credits to Camtasia Studio 5 for making the video

Around the middle or something he's gonna say you have to copy it all down the WriteMemoryProcedures but I copied it down and you guys can copy and paste!

[Virus]

Lol wow i never thought you played warrock

do you have a msn?

[blurgash]

Hello, i know this is a old thread ,
But i think its better to continue on this one ..

anyway how can you find those adresses ? ik know you can't with ce because its detected long ago , and even in kernel mode it doesent work .

Did you make you're own program to find adresses ?

[XSV]

COPIED AND PASTED FROM GOOGLE
http://warrockhacks.wordpress.com/2008/01/29/tutorial-finding-warrock-address-for-hacking/
No i did not make/do any of this.


First of all, you either need a UCE (undetected cheat engine) or CE (cheat engine). Cheat engine can be downloaded here : http://www.cheatengine.org/ . When using CE you will need a bypass so you don’t get banned because the program itself is detected. You should have done the cheat engine tutorial before moving on to finding addresses. The addresses will be getting harder and harder as you move down the list of addresses shown here.

(Hint : Search “MHS Memory Hacking System” in Google. Attempt to use the newest version of that for a UCE)

Finding Stamina

First search : 4 Bytes , unknown initial value.

Second search : Setup cheat engine for decreased value but do not actually search it. You are doing this to be able to search quickly when you switch back to cheat engine. Run around until you have no stamina left and quickly switch back to cheat engine and search decreased value.

Third Search : Then after that is done, search increased value. If your stamina is still increasing after the search is complete, search increased value again.

Repeat searches 2 and 3 over and over until you have one address. Freeze it when your stamina is fully charged.

Finding Crosshair/Scope

These two are done very close to the same way.

Crosshair :

First Search : Take out fists. Search 2 bytes, value 0.

Second Search : Take out a gun with a crosshair. Search exact value, value 1.

Repeat steps 1 and 2 over and over until you have 1 address.

Freeze at 1.

Scope: Same thing as crosshair, except get a gun with scope and zoomed out value is 0, and zoomed in value is 1.

Set to 1 for scope on. Set to 0 for scope off.

Finding 5th Slot

Go to the item shop to start.

First Search : Pop out your 4th slot. Search 4 bytes, exact value of 3 (notice how it’s 3 and not 4. This is because programing works 0,1,2,3. Not 1,2,3,4).

Second Search : Then pop out your third slot and search exact value 2.

Repeat searches 1 and 2 over and over. If necessary, open another slot and search for that value. Remember that if it’s slot 2 out, you are searching for a value of 1.

Freeze/set final address you get to 4 for fifth slot.

Finding No Spawn Wait

Go to where you are supposed to spawn and choose your class where the numbers are ticking.

First Search : 2 bytes, unknown initial value AND when you search notice where the number is when it’s ticking down.

Second Search : This can either be increased value or decreased value depending on where you searched first. Increased value if the number reset and went back up, decreased value if the number is still ticking down.

Repeat step 2 compared to the previous step over and over untill you have 1-3 addresses. The values should be ticking along with whats on your screen.

Freeze all addresses to 0.

Finding No Spread/No Recoil

Have 2 weapons on you with crosshairs and switch back and forth between the both to see when the crosshair grows/shrinks.

First Search : Take out the weapon with the crosshair that is the closest together. Search 2 bytes, unknown initial value.

Second Search : Take out the weapon with the crosshair that grows. Search increased value.

Third Step : Take out the weapon you had first and search decreased value.

Repeat steps 2 and 3.

You should find 1-15 addresses total for no spread/no recoil. Freeze all at 0.

Finding the base address for weapons, superjump, and XYZ coordinates.

This address is going to get a bit more complicated. So follow closely.

Start anywhere with a colt and your fists handy. This example will show you the weapons pointer.

First Search : Take out your colt and search 2 Bytes, exact value 2.

Second Search : Take out your fists and search exact value 1.

Repeat steps 1 and 2 until you have a few addresses.

With the few addresses you have, one will most likely start with 00. Don’t choose that address for the following steps. Choose the one that is not 00. If there are multiple, you may have to do these next steps a few times to get the base address.

Move all the possible addresses found into the code list at the bottom (yes all of them).

Finding the pointer and base address

Before moving on we have to make sure that you’re CE settings are correct and won’t end up closing when you try a step later. Click ‘settings’ in the top right of CE. Set the following settings as shown below. Be sure to match each page exactly.





Once you have the addresses in the list, right click the top most one to start with and click “Find out what writes to this address”… if you don’t understand, there’s a picture below.



This window we will be calling the debugger. If warrock closed when you tried this step, then you did not set you’re cheat engine to the correct settings as shown above. Once this is open, go back to warrock and switch to a different weapon. Once done with that, switch back to cheat engine and you should see something like below… (not the same exact thing as this is a different case for me)


Now just as the picture says above, double click what is shown in the list. A new window will pop up. We are going to need to pick 2 things out of this window to use for future scanning and setting. In the picture below, I will show you what exactly you need to pick out.


Where 1 is pointing to is the offset we will be needing later. Where 2 is pointing is the address we need to find the base address of the pointer. So copy down somewhere the offset number (in the picture it’s 24, it is probably different for you) and the address where 2 is pointing to (different for you also). You can now close that window and the debugger. Now you are back to the main screen.

Now it’s time to find the base address. On the main site check the ‘Hex’ box to the left of the search box. Type in the address you found earlier and hit search. At the end of the search, there should be a green address at the top of the list. Double click that address to add it to the code list. There’s a picture of all this below.


Once this has been added, you now have the base address for weapons, superjump, XYZ, and a few others. You still need the offset for your weapons to work though. Each effect has a different offset. So if you want superjump you will need the Z value. But we are not looking for the Z value, we are looking for a weapons pointer. So read on.

You have the base address. You have the offset from earlier that you wrote down/saved somewhere. Now it’s time to combine them. Double click the address you just added. This will bring up a window. Check the box ‘Pointer’ and the window should drop down a bit asking for some more information. Type in the base address you found and then type in the pointer. Picture below of the offset I found earlier and the address I ended up finding for another program.


Then click ok.
There. You have just made a static address for weapon changing. From here you could also figure out other pointers related to this base address. Just think about it.