 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Sep 30, 2010 7:50 am Post subject: Godmode for player units |
|
|
hi i found this aa script for age of empires 3 : the asian dynasties somewhere in the auto assemble script section, just updated the address for version 1.01a, was trying it out, when i build a lot of units, my game starts to lack like hell, which i dunno why... can anyone help me to see if there is anything wrong with the script?
| Code: |
// Age of Empires III - The Asian Dynasties
// Game Version : 1.0
// Script Version: 1.0
// CE Version : 5.4
// GodMode
// Addapted from TSearchB on 25-Jul-2008
[ENABLE]
alloc(MyCode,1024)
// Declaration session
label(_GodMode)
label(_GodM1)
label(_BackGM)
label(_ExitGM)
label(pLastOne)
label(iPlayerID)
registersymbol(MyCode)
registersymbol(pLastOne)
registersymbol(iPlayerID)
//=========================================
// Hacking Points
age3y.exe+46B67F:
jmp _GodMode
nop
_BackGM:
MyCode:
//=========================================
// God Mode
_GodMode:
mov [pLastOne],edi // Save structure address for debugging
mov edx,[edi+44] // Read ptr to Player ID
or edx,edx // Valid Ptr?
jz _ExitGM // Jump if false
mov edx,[edx] // Read Player ID
cmp edx,[iPlayerID] // Player´s?
jne _ExitGM // Jump if false
mov eax,[edi+64] // Read current HP
cmp eax,[esp+14] // Current HP <= New HP?
jle _GodM1 // Jump if true
mov [esp+14],eax // Update stack with current HP
_GodM1:
mov ecx,[esp+14] // Read new HP
_ExitGM:
mov edx,[edi+000000b4] // Original code
jmp _BackGM // Back to main code
//=========================================
// Variables
pLastOne:
dd 0
iPlayerID:
dd 1
//=========================================
// Original Codes
[DISABLE]
age3y.exe+46B67F:
mov edx,[edi+000000b4]
dealloc(MyCode)
unregistersymbol(MyCode)
unregistersymbol(pLastOne)
unregistersymbol(iPlayerID)
|
and while we are at it, can anyone tell me how to include the aobscan code in the script as well? [/code]
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Thu Sep 30, 2010 8:13 am Post subject: |
|
|
Maybe You should ask Recifense. Looks like this code is made by Him. I never played Age of Empires 3 so no clue.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Sep 30, 2010 8:20 am Post subject: |
|
|
| yup it belongs to him hahas i jut remembered it... but he's not online is he? anyway, can i ask you how do you make a script to make god mode for strategy games? it consists of checking if it's the player's unit or just ai's unit, so it's quite hard... i also thought of some ways, like check if a unit is hit; if it is hit, check if it's player's unit, and if it is, don't do the damage reduction... sorry i'm a noob in asm, please teach me how to do it, i really wanna learn...
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Thu Sep 30, 2010 10:09 am Post subject: |
|
|
Usually this is the method:
When a unit takes damage, the script is checking the unit's data structure to find a player ID. Then if the unit is belonging to the AI, it will take damage as usual and if the unit is belonging to the human player, it will not take damage or even get max health too. The player ID and other information about the unit is stored differently in almost every game, so You always need to analyze it and find it Yourself.
I don't know how to make an aob version for this table, since I don't see the original code and can't check arrays in the game this way.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Sep 30, 2010 10:44 am Post subject: |
|
|
the array of bytes for the original code is 8B 97 B4 00 00 00 89 4F, i tried using the aobscan command, like this:
| Code: |
// Age of Empires III - The Asian Dynasties
// Game Version : 1.0
// Script Version: 1.0
// CE Version : 5.4
// GodMode
// Addapted from TSearchB on 25-Jul-2008
[ENABLE]
alloc(MyCode,2048)
aobscan(aobGodMode,8B 97 B4 00 00 00 89 4F)
// Declaration session
label(_GodMode)
label(_GodM1)
label(_BackGM)
label(_ExitGM)
label(pLastOne)
label(iPlayerID)
label(pGodMode)
registersymbol(MyCode)
registersymbol(pLastOne)
registersymbol(iPlayerID)
registersymbol(pGodMode)
//=========================================
// Hacking Points
aobGodMode:
pGodMode:
jmp _GodMode
nop
_BackGM:
MyCode:
//=========================================
// God Mode
_GodMode:
mov [pLastOne],edi // Save structure address for debugging
mov edx,[edi+44] // Read ptr to Player ID
or edx,edx // Valid Ptr?
jz _ExitGM // Jump if false
mov edx,[edx] // Read Player ID
cmp edx,[iPlayerID] // Player´s?
jne _ExitGM // Jump if false
mov eax,[edi+64] // Read current HP
cmp eax,[esp+14] // Current HP <= New HP?
jle _GodM1 // Jump if true
mov [esp+14],eax // Update stack with current HP
_GodM1:
mov ecx,[esp+14] // Read new HP
_ExitGM:
mov edx,[edi+000000b4] // Original code
jmp _BackGM // Back to main code
//=========================================
// Variables
pLastOne:
dd 0
iPlayerID:
dd 1
//=========================================
// Original Codes
[DISABLE]
pGodMode:
mov edx,[edi+000000b4]
dealloc(MyCode)
unregistersymbol(MyCode)
unregistersymbol(pLastOne)
unregistersymbol(iPlayerID)
|
but it keeps having the error "Error in line 9 (pGodMode):This address specifier is not valid"... can you help to point out what did i do wrong in the script? and also, can you tell me how you find out the base address (hacking point) in the first place? by searching in the cheat engine or by disassembler?[/code]
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Thu Sep 30, 2010 11:15 am Post subject: |
|
|
First You need to check that 8B 97 B4 00 00 00 89 4F is not pointing to other addresses too. The best is if You have only 1 search result if You search for this array. Also make sure to click on "Also scan read-only memory" when You search for codes.
CE 5.6.1 has a bug which prevents You to change scripts which are using aobscans. Try adding Your script to the table as a new script instead of modifying the previous one.
| Quote: | | and also, can you tell me how you find out the base address (hacking point) in the first place? by searching in the cheat engine or by disassembler? |
The hacking point can be found by checking what writes to the address of a unit's health when it takes damage.
The base address of the unit's data structure can be figured by checking the code which is changing the address. Most likely (but not always) the base address is the register in the code.
mov edx,[edi+000000b4]
In this case the base address is EDI. And the unit structure's base address + B4 = the address of the unit's health.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Sep 30, 2010 12:41 pm Post subject: |
|
|
| thank you, i went to add the script as a new one and it worked.... lol.. but for strategy games, like AOE and Civilization, the health pointer don't only points to your unit, but the enemies' as well, so how do you make it such that it points only to your own? sort of like nullifying damage done to the units you own...
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Thu Sep 30, 2010 1:14 pm Post subject: |
|
|
| lalala1990 wrote: | | thank you, i went to add the script as a new one and it worked.... lol.. but for strategy games, like AOE and Civilization, the health pointer don't only points to your unit, but the enemies' as well, so how do you make it such that it points only to your own? sort of like nullifying damage done to the units you own... |
I don't know AOE but here is an example about god mode and what can You do with codes that are reading from a memory address.
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles/87-basic-assembly-instructions-opcodes-and-examples
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Thu Sep 30, 2010 11:30 pm Post subject: |
|
|
| thank you, i would like to ask, normally, when you search for resources, what do you search for? byte, 2 byte, 4 byte or float? i can't seem to find the value....
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Thu Sep 30, 2010 11:50 pm Post subject: |
|
|
All of them. If You can't find it with exact value search with any type, You need to use unknown initial value search.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Fri Oct 01, 2010 12:59 am Post subject: |
|
|
| i tried using unknown initial value search, but i can't seem to find any too... and also, how do you search for cooldown values? if i found one address that has the opcode: fstp dword ptr [esi+08] what does it means?
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Fri Oct 01, 2010 9:48 am Post subject: |
|
|
| lalala1990 wrote: | | i tried using unknown initial value search, but i can't seem to find any too... and also, how do you search for cooldown values? if i found one address that has the opcode: fstp dword ptr [esi+08] what does it means? |
In some games, as in Starcraft 2 too, the unit health is stored as "how much damage did the unit take". So You need to search for max health-current health.
Cooldown values and timers can be increasing or decreasing values too. Try unknown search again. If it is a unit's ability, narrow down the search range to the unit's data structure.
fstp dword ptr [esi+08] will write a float value from the stack to [esi+08].
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Fri Oct 01, 2010 11:22 am Post subject: |
|
|
ok i found the health hacking point, but i still dun quite understand the whole structure lol.. i'm very new in asm... but anyway, i tried to find the resource hacking point for aoe3, when i was searching, i couldn't find the exact value of the resource (food, gold or wood).. i can only find a pointer value that's always changing... meaning that when i change the value, the amount of the resource i was trying to change will jump randomly, sometimes negative value and sometimes positive value... when i try to find out what accesses the code, i was brought to the main hacking point for resources... but i don't know what it meant... here's part of it:
| Code: |
005B6410 - 33 04 8a - xor eax,[edx+ecx*4]
005B6413 - 89 44 24 04 - mov [esp+04],eax
005B6417 - d9 44 24 04 - fld dword ptr [esp+04]
005B641B - 83 c4 08 - add esp,08
005B641E - c2 04 00 - ret 0004
|
why did i know that was the hacking point? i figure it out from Recifense's resource script... here it is. i tried to update it to the newer version, but when i disable it, the game crashes... so i dunno what to do:
| Code: |
// Age of Empires III - The Asian Dynasties
// Game Version : 1.0
// Script Version: 1.0
// CE Version : 5.4
// Resources (based on a Dark Byte´s script)
// 25-Jul-2008
[ENABLE]
alloc(MyCode1,1024)
// Declaration session
label(_Resource)
label(_MonPlayer)
label(_Res0)
label(_Res1)
label(_BackR)
label(_BackMP)
label(_ExitR)
label(_ExitMP)
label(iPlayerID1)
label(pResource)
label(pPlayer)
registersymbol(MyCode1)
registersymbol(iPlayerID1)
registersymbol(pResource)
registersymbol(pPlayer)
//=========================================
// Hacking Points
age3y.exe+3cef8:
jmp _Resource
nop
nop
_BackR:
age3y.exe+4337d:
jmp _MonPlayer
nop
_BackMP:
MyCode1:
//=========================================
// Minimum Resource = 5000
_Resource:
push ebx // Save EBX
cmp edx,[pResource] // Is it the player´s?
jne _Res1 // Jump if false
cmp ecx,7 // Is it Export?
je _Res0 // Jump if true
cmp ecx,3 // Is it coin, wood or food?
jge _Res1 // Jump if false
_Res0:
mov ebx,eax // Save encription
xor eax,[edx+ecx*4] // Decript resource
cmp eax,459c4000 // Greater the 5000?
jge _ExitR // Jump if true
mov eax,459c4000 // Make eax = 5000
xor eax,ebx // Encript resource
mov [edx+ecx*4],eax // Update resource
mov eax,ebx // Restore encription
_Res1:
xor eax,[edx+ecx*4] // Decript resource
_ExitR:
pop ebx // Restore EBX
mov [esp+14],eax // Original code
jmp _BackR // Back to main code
//=========================================
// Monitor player structure address
_MonPlayer:
mov ecx,[edx] // Read ID
cmp ecx,[iPlayerID1] // Is it the player´s?
jne _ExitMP // Jump if false
mov ecx,[edx+00000230] // Read ptr to resource
mov [pResource],ecx // Save ptr to further use
mov [pPlayer],edx // Save player struct address for debugging
mov ecx,[edx] // Read ID
_ExitMP:
mov edx,[esp+20] // Original code
jmp _BackMP // Back to main code
//=========================================
// Variables
iPlayerID1:
dd 1
pResource:
dd 0
pPlayer:
dd 0
//=========================================
// Original Codes
[DISABLE]
age3y.exe+3cef8:
xor eax,[edx+ecx*4]
mov [esp+14],eax
age3y.exe+4337d:
mov ecx,[edx]
mov edx,[esp+20]
dealloc(MyCode1)
unregistersymbol(MyCode1)
unregistersymbol(iPlayerID1)
unregistersymbol(pResource)
unregistersymbol(pPlayer)
|
the code above gave me all the resources set at 5000, but i want to be able to set each of them... how can i do that?
|
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Fri Oct 01, 2010 11:44 am Post subject: |
|
|
Ah I see from the script that the value is encrypted. The script is decrypting it, check and change the value as float and encrypt it again. You can changed the value You want to get in these points:
cmp eax,459c4000 // Greater the 5000?
mov eax,459c4000 // Make eax = 5000
That is the easies way. Or You can make it customizable by registering a symbol for the value and add it to Your table and You can change it anytime after that.
_________________
|
|
| Back to top |
|
 |
low_density Expert Cheater
Reputation: 1
Joined: 08 Aug 2009 Posts: 156
|
Posted: Fri Oct 01, 2010 11:58 am Post subject: |
|
|
| sorry pardon me but i don't get what you mean... if i wan to change the values of the resources independently and not change all of it at one go, how do i do it? what you mean is the value of the resource are encrypted? that's why i cannot find the value with cheat engine? and by the way, how do you make instant build, instant train and other stuff? when i'm training a villager, i tried to search for the cooldown timer, when i'm beginning to train, i search for an unknown value, after that, as the timer goes down, i search for decreased, and when i managed to train the villager and the timer disappears, i search for decreased also, then i start to train another villager and i search for increased, then decreased again, but i will end up with no values... what did i do wrongly?
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|