Cheat Engine

wizzar · How do I cheat? Reputation: 0 Joined: 19 Oct 2015 Posts: 7

So I found a base pointer (green address 005D75C0) which is 4th level pointer. So, to make it point to where I want, I must add 4 offsets: 8, d0, 1c8c and 2. The first two, 8 and d0, never changes. However, 1c8c changes whenever the game is restarted. It is an array index (eax*ebx*4+A4). Does this mean it is not ppossible to find a constant path to the information I want?

Gniarf · Posted: Mon Oct 19, 2015 2:24 pm Post subject:

The game knows the path to your object, so it is always possible to find a path to it. It may however be a damn friggin' pain...

Currently CE has no support for variable offsets, so the best you could do if you don't want to make some assembly coding is make a lua script that would find the array index, compute the 3rd offset, and add a proper pointer to the cheat table. But of course you'd have to figure out where the index comes from.

An usually simpler method is to find out what access your variable, pick a function that doesn't access any other, and modify it so that it overwrites your variable or logs its address at a known location.

Modding the game is also an option to consider (especially in rpgmaker/renpy games).

wizzar · How do I cheat? Reputation: 0 Joined: 19 Oct 2015 Posts: 7

Wouldn't the function be on a random address? Also, how can I make sure a function does not access anything other than my variable?

Gniarf · Posted: Mon Oct 19, 2015 3:24 pm Post subject:

wizzar · How do I cheat? Reputation: 0 Joined: 19 Oct 2015 Posts: 7

I found a function that deals with the variable, I restarted several times and the function address didn't change (Game.004F5CE4).

Inside the function, the 11th instruction stores the offset in EAX.

This function is executed when player enters the game.

Can't I track that?

Gniarf · Posted: Tue Oct 20, 2015 3:50 am Post subject:

Given what you found, the least bad solution I see is to make an assembler script that would slightly modify the function at Game.004F5CE4 to store the offset at a known location and a lua script (embedded inside a separate assembler script) that would read this offset, and update the offset of your pointer in the table.

Cheat engine does not understand [[[game.exe+1234]+4]+[game.exe+5678]].

Dark Byte · Posted: Tue Oct 20, 2015 5:07 am Post subject:

You can always use lua to fill in the offset part (or update it with a timer)

wizzar · How do I cheat? Reputation: 0 Joined: 19 Oct 2015 Posts: 7

The perfect solution would be to write a piece of code that would store the values of edx and edc at address 0x004F0186 in variables in my program.

I'm still learning asm, I don't know a "clean" way to do that, and I can't modify the *.exe, so I came up with another solution.

I wrote a debugger in C and attached it to the process thread and set a breakpoint at 0x004F0186. From there I read edx and edc to my program, then I detach the debugger (DebugActiveProcess/DebugActiveProcessStop).

If I could just __asm__ something inline it would be a solution too, but I don't know how to do that, and injection is very easy to be detected.

Thank you guys.

panraven · Posted: Tue Oct 20, 2015 9:15 pm Post subject:

hi,
I've made a script to simulate debug break point and log register (rcx here) using code cave, hopefully would be an alternative solution for the problem of this thread.
It should work as expected.

However, the DEALLOC command in lua-assemble-call seems not work.
If I copy the print output of the lua-assemble-call into a memory record, the memory deallocate properly.

Would DarkByte please check what's the problem?
Thank you~

ADDED:
sorry, somehow there was typo, it is fixed ~_~

wizzar · How do I cheat? Reputation: 0 Joined: 19 Oct 2015 Posts: 7

Cool!

Can this be ran from my C application?
Does it inject new instructions in the exe?

Sorry for my ignorance, I've only started fiddling with asm, cheat engine, olly etc 2 days ago Embarassed

I think I made great progress though Very Happy

panraven · Posted: Wed Oct 21, 2015 4:03 am Post subject:

Dark Byte · Posted: Wed Oct 21, 2015 4:31 am Post subject:

dealloc just won't work with the autoAssemble() command. (dealloc only works when inside a cheat table entry)

If you wish to reuse a block of memory every time, use globalalloc instead

panraven · Posted: Wed Oct 21, 2015 4:59 am Post subject: