Cheat Engine

hellknight99 · Cheater Reputation: 0 Joined: 27 Feb 2008 Posts: 39

so im like hacking some flash games. but the address of something keep changing. so I got the pointer made it an address now what?

It doesn't even point to the write thing o.O
( I did "What writes to this address" on the correct address)

Also what does EAX + 79 mean? for example
EAX is a bunch of numbers , like 000AB940 or something like that. What would be the offset.

Psy · Posted: Sat Mar 29, 2008 3:32 am Post subject:

hellknight99, eax is the start of a structure. 79 is the offset in that case.
So that address of EAX+79 = the value you first found.

Depending on what its for...health? ammo? xp? etc... you could either choose to nop that instruction, ie. replace the bytes with 90's to make it skip that part of the code, or you could try some code-injection, of which there are numerous tutorials floating around.

Get back to me with more info and i'll try to help you out. I take it you are using Cheat engine for this? I'll walk you through.
But first, find that address again (the one which changes), find that instruction again that writes to / accesses it, and bring up the memory view window, or 'show dissassembler'. Then take a screenshot of several lines above and below that code.
Then I can see what you can do with it.

~Psych

Symbol · Posted: Sat Mar 29, 2008 4:05 am Post subject:

If this flash game is on a website (and not an executable file on yor computer) the addresses will probably always be dynamic.

EAX+17 means the value of eax is the base address of the pointer and 17 is the offset, so add 17 to eax to get the address it points to.

hellknight99 · Cheater Reputation: 0 Joined: 27 Feb 2008 Posts: 39

Lets see , I hacked warcraft 3 single player for some practive.
I got the gold address and I got its pointer.
Now what? Is the pointer , suppose to tell me the gold address everytime I restart the game?

Psy · Posted: Sat Mar 29, 2008 11:27 am Post subject:

Yeah. You read the value of eax+17 (<-- and example) and the write to that offset.
Search for tuts on cheat engine, dma and code-injection. You'll find what you need. Good luck Smile

Labyrnth · Moderator Reputation: 10 Joined: 28 Nov 2006 Posts: 6300

[Psych]

You cant do a code injection on the dll controlling the flash. Trust me, been there tried that.
Depending on browser and flash version, you end up in one of these dll files with your instruction.

FireFox:
NPSWF32.dll

Internet Explorer: *Depending on version
Flash8.ocx
Flash9.ocx
Flash9d.ocx

You will crash the browser with any alteration. Flash games are allocated and wont have a good address after you close your browser mate.
This is why people are passing variables to the flash object on a form in VB making alterations to the action script.
"Not Memory"
If you want to try it, go ahead you will see what i mean. Need some help, hit me on MSN ill show you what im talking about. Wink

Dark Byte · Posted: Sat Mar 29, 2008 7:45 pm Post subject:

Actually, it's possible but you'll have to work a bit more high-level . Assembler only will not work
If you just do a code injection you have to write your own object parser to distinguish between objects that the code accesses.
another method is hooking into the flash activex control, you can then call the setvariable and getvariable methods and edit stuff like this

http://forum.cheatengine.org/viewtopic.php?p=1556668&highlight=#1556668 is a good example of such a usage

Psy · Posted: Sun Mar 30, 2008 4:57 am Post subject:

And in any case, I was responding to hellknight.... he was talking about Warcraft 3. I know about the flash .dlls, hehe Wink

Labyrnth · Moderator Reputation: 10 Joined: 28 Nov 2006 Posts: 6300