Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Finding static pointers for Byte or 2 Byte types?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Mahi
How do I cheat?
Reputation: 0

Joined: 30 Jul 2013
Posts: 1

PostPosted: Tue Jul 30, 2013 7:55 am    Post subject: Finding static pointers for Byte or 2 Byte types? Reply with quote

I'm trying to create a trainer for Duke Nukem: Manhattan Project, but I ran into a problem: some of the values/addresses (f.e. ammo) appear to be both Byte and 2 Bytes? I'm really new to CE and memory hacking etc. so try and bare with me.
If I do a search with "Value Type: All" and keep rescanning with different ammo values, I will find the following addresses:
Code:
02A6C4CC : 1
02A6C4CC : 2
0E601A04 : 1
0E601A04 : 2

By adding these to my address table, I can see that the bottom 2 addresses are not the correct ones: they change when my ammo changes, but if I change their value, it just quickly changes back.
I'm left with the top two addresses: 02A6C4CC:1 and 02A6C4CC:2. First of all, how can I have same address in two different types? Also, changing one changes the other.

Now then when I right click on either one of the two addresses and choose "Find out what writes to this address" I will get the following instruction (after shooting few times in the game):
Code:
09F6D71E - 48 - dec eax
09F6D71F - 23 C2  - and eax,edx
09F6D721 - 66 89 01  - mov [ecx],ax <<
09F6D724 - 8B C6  - mov eax,esi
09F6D726 - 5E - pop esi

EAX=00000068
EBX=1002D201
ECX=02A6C4CC
EDX=00000068
ESI=00000001
EDI=00000000
ESP=0010F004
EBP=0E61BEB8
EIP=09F6D724

Hex scan for ecx 02A6C4CC with 4 Bytes gives me 0 addresses. If I choose Byte or 2 Bytes I will get something from 500 to 200 000 addresses, each with value equal to CC.
Here's a picture: oi44.tinypic . com/27wt0s8.jpg (sorry, can't post urls yet..)

What am I doing wrong, how can I find the static pointer for these addresses?
Back to top
View user's profile Send private message
vergilganesh
Expert Cheater
Reputation: 0

Joined: 01 Jul 2013
Posts: 134
Location: India

PostPosted: Wed Jul 31, 2013 6:11 am    Post subject: Reply with quote

Try using pointerscan. Make a google search about pointerscan.
Back to top
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger
smx
Newbie cheater
Reputation: 0

Joined: 02 Sep 2012
Posts: 13

PostPosted: Mon Aug 05, 2013 10:53 am    Post subject: Reply with quote

02A6C4CC is both 1 and 2 bytes, because the size of the address is 2 bytes, but it can also contain a byte.

CE's is telling you that because at
09F6D721 - 66 89 01 - mov [ecx],ax <<

ax is involved.
ax is a 16 bits register, which means it can contain 2 bytes (16/8 -- 8 bits = 1 byte)
In this case, it's holding the value 68 (EAX=00000068), and 68 is 1 byte (here's why the double address)
68 in hex == 104 in dec

About the Hex Scanning, i don't think you need it in this moment, because there is no offset.
Pointer scanner use is when you have, instead of your instruction:
mov [eax*4+esi],ax or something similar, so you want to know where is [eax*4+esi], and you do a pointer scan to find the address.

The instruction mov [ecx],ax means:
Take the value that is stored in the ax register (our ammo), and copy that value to the address contained in ecx.
This means that this instruction updates ammo at 02A6C4CC (and you already have it in your table).

If you want to change ammo without auto-assembler, you should backtrace ax (your ammo), to see where some value is put into it. You could click on Show Disassembler, then Tools, Dissect Code, and then scroll up to find where an opcode like this:
mov ax,[something]
occurs

You should be able to find the piece of code which loads ammo from an address into memory. Then you can see if it that address is static or a pointer (which needs pointer scanning).
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites