Cheat Engine

SteveFlanders2 · How do I cheat? Reputation: 0 Joined: 22 Mar 2024 Posts: 2

So. I know that Cheat Engine has the "Find out what writes to this memory address" feature, which is useful for finding, disabling, or changing what writes to a memory address.
But that is only useful for finding scripts in memory that write to other addresses in memory.

What I'm looking to do, is try and find the script in memory, that writes to my hard drive. (Basically I'm looking for the script that writes save files, so I can write my own script to forge them).

Unfortunately I don't think this is possible, but before I completely give up I'm here to ask you guys.

If It changes anything, I know exactly where the save files are written to (their path) and they're written to a .sav, but they contain just plain text, so I can just open it with notepad no problem. (I can't edit it though, there's a checksum or something. Hence why I need to find the code that writes to the save file).

ParkourPenguin · Posted: Fri Mar 22, 2024 1:49 pm Post subject:

The kernel is the thing that actually modifies the bytes on the hard disk. You'd have to hook the relevant API. Maybe NtOpenFile is a good place to start.

There might be some program out there that does it for you. strace is for linux; I don't know of any windows equivalent.

SteveFlanders2 · How do I cheat? Reputation: 0 Joined: 22 Mar 2024 Posts: 2

ParkourPenguin · Posted: Fri Mar 22, 2024 3:02 pm Post subject:

Set a conditional breakpoint at some API that will break when the file you're interested in is written to. Then, go up the callstack and start reverse engineering the checksum algorithm from there.

Or you could try ultimap / code filter to search for code.

kulik_alex · How do I cheat? Reputation: 0 Joined: 19 Mar 2024 Posts: 9

I recently tried something similar. In my case, the game was loading from memory, not from a file, a separate code was responsible for reading and writing to disk. Too difficult.