Cheat Engine

[SadisticRage]

Okay, so here i am so impressed with myself for accomplishing something ive been trying to do for awhile now. I found a pointer and knew what the heck i was doing while i found it.

So Thanks and props to the tuturial for this program. Its helped me cross the river into an entirely new area ive been trying to get to.


Now while across the river ive ran into a problem with some pointers and offsets. Ill provide all the info i know. Hopefully this will be enough.


First of all I am attempting to change the amount of troops in ready stance. This is done by selecting the arrow next to the unit and pressing up then pressing save. My goal for the time being is to just change the amount im getting ready to load without having to use the arrow. So lets say i create a trainer later with a text box id enter the number of troops to load then press the load. And all done. Instead of having to wait 2 hours while i attempt to load all my troops.

So basically i want to increase a number by changing the amount through the program. Now i can find the adress to change the value just fine. However i dont want to have to keep looking for it everytime because it moves around everytime you reload the troops screen or relog. So obviously i need to find the pointers. Heres where i run into the problems. I find the first pointer no sweat. But the 2nd pointer is in what is my opinion extremly complex.

Here is the example.

Troops : 2000

Hex = 20A192C4 (4 bytes)

Address = 20A19 2C4
So then i proceed to find out what writes to this address (finding the pointer) I then run into this problem..

"The following opcodes changed the selected adress"

00bc32ae -89 74 9F 0C - move [edi+ebx*4+0C], esi

(then i click more info and it reads as follows)




00BC32A5 - cmp ebx, [edi+08]
00BC32A8 - jae 00BC3F30
>>00BC32AE - mov [edi+ebx*4+0C], esi
00BC32B2 - mov esi, [ebp+0C]
00BC32B5 - mov ecx, [esi+0000011C]

"copy memory"
The value of the pointer needed to find this address is probably 20a192b.

eax = 00001103
ebx = 00000002
ecx = 0320F980

edx = 0000000F
esi = 00001103
edi = 20A192B0

esp = 0320F9A8
ebp = 0320FA10
eip = 00BC32B2

Now the problem is with the [calculation of offset] i simply dont have the foggiest how to do that. In the tutorial it gave an example of a very simple one...however this is a bit more complex looking than the one in the tutorial.


Again, wonderful program. Has helped me understand alot. Hopefully you guys/gals/experts/-insert more sucking up words of your preference here please-, can help me out with this.

[XTrinityX]

Taking a shot in the dark here...try searching the hex value under 4 bytes 20a192b0. You have to check the 'hex' box next to it. What it looks like to me is, once you get the base address (should be in green once you search the value) the offset will be 0C. This is how I would go about it...but it may not work.

[Dark Byte]

value the pointer held was 20A192B0
offset is (8+c=)14

[SadisticRage]

Ty Dark Byte as well as xTrinityx. The answer you provided allowed me to determine how to calculate the offset. I can find it everytime now.

However ive ran into some more problems of which i could use some assistance.

I keep running into problems trying to figure out "what writes to this pointer"

Any tips?


Everytime I try to use that on a pointer it never gives me any values...ive tried using the what accesss this pointer feature instead but i resolve 1 pointer further into the solution and then get stuck with about 10 possible accessee's. Most of the time they are all leading to the same address.