Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Chicken Invaders 3 problem

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
zirkhaki
Cheater
Reputation: 0

Joined: 10 Dec 2008
Posts: 44
Location: Iran

PostPosted: Sun Dec 14, 2008 4:54 am    Post subject: Chicken Invaders 3 problem Reply with quote

Hey guys
I'm a noob and i had made some trainers for some games before but all of them were easy to hack

this game I mean chicken invaders 3 has made some problems for me

i found some addresses for options like Gun power and Gun health. and make them freeze by aas

another option is the "life"
i found its address and i freezed it and it didn't freez. i chose what writes to this address and a code is find
Code:
Code :00489c48 - 89 87 54 22 00 00 - mov [edi+00002254],eax

then i replaced it whith code that does nothing again no result

then i went to auto assembly and find this
Code:
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

00489c48:
jmp newmem
nop
returnhere:

newmem: //this is allocated memory, you have read,write,execute access
//place your code here


originalcode:
mov [edi+00002254],eax

exit:
jmp returnhere
 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat


I wrote some commands like add or sub and changed the value "eax" to 5 and again no good result
If anyone can help it would be appreciated
Back to top
View user's profile Send private message Yahoo Messenger
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6301

PostPosted: Sun Dec 14, 2008 2:31 pm    Post subject: Reply with quote

scroll up in memory above that address you found and see if you see dec or sub.
Alter that instruction and you might have it.

Also that AA you posted is default one when going to AA in memory view.
Back to top
View user's profile Send private message
zirkhaki
Cheater
Reputation: 0

Joined: 10 Dec 2008
Posts: 44
Location: Iran

PostPosted: Sun Dec 14, 2008 2:58 pm    Post subject: Reply with quote

Thanks, I'll try that

EDIT:

first i want to say that the code that i put in my first post is the default and i changed it to somthing like
Code:
add [edi+00002254],5
or
sub [edi+00002254],5


and it didn't make any changes

now i put the addresses before and after that addres whick no one started with dec or sub
Code:
00489C3A - 8d bc 01 f0 03 00 00       - lea edi,[ecx+eax+000003f0]
00489C41 - 8b ce                      - mov ecx,esi
00489C43 - e8 68 ee 00 00             - call 00498ab0
00489C48 - 89 87 54 22 00 00          - mov [edi+00002254],eax
00489C4E - a1 2c d5 55 00             - mov eax,[0055d52c] : 00C00048
00489C53 - 5f                         - pop edi
00489C54 - 8b 90 fc 5b 01 00          - mov edx,[eax+00015bfc]
00489C5A - 88 9a 61 02 00 00          - mov [edx+00000261],bl


If youcan understand anything from these addresse please make me aware of that
Back to top
View user's profile Send private message Yahoo Messenger
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6301

PostPosted: Mon Dec 15, 2008 7:38 pm    Post subject: Reply with quote

Change:
00489C48 - 89 87 54 22 00 00 - mov [edi+00002254],eax
To:
00489C48 - 90
00489C49 - 90
00489C4A - 90
00489C4B - 90
00489C4C - 90
00489C4D - 90

See if it freezes for you. Also this could have weird effects like enemies health as well. But worth a try.

Another way is to change the value of eax before mov [edi+00002254],eax is executed.

mov eax,64 <----- moves 100 decimal to eax
mov [edi+00002254],eax
-------------------------------------------------
64 hexadecimal = 100 decimal "What you see in game"
Back to top
View user's profile Send private message
zirkhaki
Cheater
Reputation: 0

Joined: 10 Dec 2008
Posts: 44
Location: Iran

PostPosted: Sat Jan 03, 2009 2:06 pm    Post subject: Reply with quote

I did both of them. but for the first method i have a question!
Should I do it by the "Fill Memory" option and change the value to 90 for 00489C48 to 00489C4D?
because when i choose what writes to to address a code is found and when i replace it with code that does nothing, it also nop all the addresses you said and change them to 90
although I did both of them and still no result
---------------------------------------------------
EDIT:

Any help yet?
I continued my search with other methods like chandeg & unchanged options until i got 4 addresses which are dynamic but i can't find the pointer because when i search for the value of the pointer needed to find this addresses i get a blank board. (no result)

so tried to nop the address or do a code injection.
here is what I found:

4 addresses for the number of life.
after closing an reopening the game the addresses and even the values will change, so i can't do an exact value search. so what you are seeing here are all dynamic
i brought them here for you to see the similarities between the values:

the addresses for 1 life (as you see the difference between first and second one and also the difference between third and forth one is just 1 value)
Code:
0285BFF4        4byte     771509522
0285C078        4byte     771509523
028E443C        4byte     3485192703
028E44C0        4byte     3485192702


when I try to find what writes to this address i get these:

for the first and the third address i get this
Code:
00498aeb - 89 b3 80 00 00 00 - mov [ebx+00000080],esi


but for the second one and the forth one i get this
Code:
00498af4 - 89 b3 04 01 00 00 - mov [ebx+00000104],esi


as i said i couldn't find the pointer so i tried to do a code injection:

Code:
mov [ebx+00000080],esi   to  mov [ebx+00000080],2DFC4D12 or(2DFC4D13 or CFBBD1FF or CFBBD1FE or even 5)
or
mov [ebx+00000104],esi   to  mov [ebx+00000104],2DFC4D12 or(2DFC4D13 or CFBBD1FF or CFBBD1FE or even 5)


but after doing a code injection i will get a negative mark behind the number of lives.

as i checked later i found that for another option(chicken foot) there is 2 addresses which have situation of life addresses. i mean they are also dynamic.
the same thing among them is the opcode which are the above mentioned

so what should i do now?

--------------------------------
At last I did it

wow
at last i made it
i did a code injection for both opcodes and move them to two different values such as 100 and 5 so the result was 95 lives adn also other options like missile and chicken foot.
operation finished
Back to top
View user's profile Send private message Yahoo Messenger
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6301

PostPosted: Sun Jan 04, 2009 5:52 am    Post subject: Reply with quote

Now if you would, write a tutorial on your scans and assembly.
There are 2 or 3 other people asking about this very game in this section and wanting help on hacking it.
Back to top
View user's profile Send private message
samse
Grandmaster Cheater
Reputation: 0

Joined: 02 Aug 2006
Posts: 760
Location: Look Back! But remember that I won't be there~ JackAss

PostPosted: Sun Jan 04, 2009 1:23 pm    Post subject: Reply with quote

I'm not wanting to hack it .. I want to learn how to hack so I'm trying to hack this random game .. Very Happy
_________________
mooglekiller wrote:
If i get him auto banned if there a chance that he'll get back on the rankings and if it's possible, how do i get him auto banned?

samse wrote:
Its like you wanna save dying person by shooting him in the head. If possible, where do you get guns from?
Back to top
View user's profile Send private message
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6301

PostPosted: Sun Jan 04, 2009 3:24 pm    Post subject: Reply with quote

samse wrote:
I'm not wanting to hack it .. I want to learn how to hack so I'm trying to hack this random game .. Very Happy

And you don't think a tutorial on how to hack the same game you are attempting to learn on will work for you?
That happens to be the craziest reply I have seen in a while.
Back to top
View user's profile Send private message
zirkhaki
Cheater
Reputation: 0

Joined: 10 Dec 2008
Posts: 44
Location: Iran

PostPosted: Sun Jan 04, 2009 6:12 pm    Post subject: Reply with quote

Good idea
I'll try to do that if i had enough time
Back to top
View user's profile Send private message Yahoo Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites