Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Godmode for player units
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Sep 30, 2010 7:50 am    Post subject: Godmode for player units Reply with quote

hi i found this aa script for age of empires 3 : the asian dynasties somewhere in the auto assemble script section, just updated the address for version 1.01a, was trying it out, when i build a lot of units, my game starts to lack like hell, which i dunno why... can anyone help me to see if there is anything wrong with the script?


Code:

// Age of Empires III - The Asian Dynasties
// Game Version  : 1.0
// Script Version: 1.0
// CE Version    : 5.4
// GodMode
// Addapted from TSearchB on 25-Jul-2008

[ENABLE]
alloc(MyCode,1024)

// Declaration session
label(_GodMode)
label(_GodM1)
label(_BackGM)
label(_ExitGM)
label(pLastOne)
label(iPlayerID)

registersymbol(MyCode)
registersymbol(pLastOne)
registersymbol(iPlayerID)

//=========================================
// Hacking Points
age3y.exe+46B67F:
 jmp _GodMode
 nop
_BackGM:

MyCode:
//=========================================
// God Mode
_GodMode:
 mov [pLastOne],edi         // Save structure address for debugging

 mov edx,[edi+44]           // Read ptr to Player ID
 or edx,edx                 // Valid Ptr?
 jz _ExitGM                 // Jump if false

 mov edx,[edx]              // Read Player ID
 cmp edx,[iPlayerID]        // Player´s?
 jne _ExitGM                // Jump if false

 mov eax,[edi+64]           // Read current HP
 cmp eax,[esp+14]           // Current HP <= New HP?
 jle _GodM1                 // Jump if true

 mov [esp+14],eax           // Update stack with current HP

_GodM1:
 mov ecx,[esp+14]           // Read new HP

_ExitGM:
 mov edx,[edi+000000b4]     // Original code
 jmp _BackGM                // Back to main code

//=========================================
// Variables
pLastOne:
 dd 0
iPlayerID:
 dd 1

//=========================================
// Original Codes
[DISABLE]
age3y.exe+46B67F:
 mov edx,[edi+000000b4]

dealloc(MyCode)
unregistersymbol(MyCode)
unregistersymbol(pLastOne)
unregistersymbol(iPlayerID)



and while we are at it, can anyone tell me how to include the aobscan code in the script as well? [/code]
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Thu Sep 30, 2010 8:13 am    Post subject: Reply with quote

Maybe You should ask Recifense. Looks like this code is made by Him. I never played Age of Empires 3 so no clue.
_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Sep 30, 2010 8:20 am    Post subject: Reply with quote

yup it belongs to him hahas i jut remembered it... but he's not online is he? anyway, can i ask you how do you make a script to make god mode for strategy games? it consists of checking if it's the player's unit or just ai's unit, so it's quite hard... i also thought of some ways, like check if a unit is hit; if it is hit, check if it's player's unit, and if it is, don't do the damage reduction... sorry i'm a noob in asm, please teach me how to do it, i really wanna learn...
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Thu Sep 30, 2010 10:09 am    Post subject: Reply with quote

Usually this is the method:

When a unit takes damage, the script is checking the unit's data structure to find a player ID. Then if the unit is belonging to the AI, it will take damage as usual and if the unit is belonging to the human player, it will not take damage or even get max health too. The player ID and other information about the unit is stored differently in almost every game, so You always need to analyze it and find it Yourself.

I don't know how to make an aob version for this table, since I don't see the original code and can't check arrays in the game this way.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Sep 30, 2010 10:44 am    Post subject: Reply with quote

the array of bytes for the original code is 8B 97 B4 00 00 00 89 4F, i tried using the aobscan command, like this:
Code:

// Age of Empires III - The Asian Dynasties
// Game Version  : 1.0
// Script Version: 1.0
// CE Version    : 5.4
// GodMode
// Addapted from TSearchB on 25-Jul-2008

[ENABLE]
alloc(MyCode,2048)
aobscan(aobGodMode,8B 97 B4 00 00 00 89 4F)

// Declaration session
label(_GodMode)
label(_GodM1)
label(_BackGM)
label(_ExitGM)
label(pLastOne)
label(iPlayerID)
label(pGodMode)

registersymbol(MyCode)
registersymbol(pLastOne)
registersymbol(iPlayerID)
registersymbol(pGodMode)

//=========================================
// Hacking Points
aobGodMode:
pGodMode:
 jmp _GodMode
 nop
_BackGM:

MyCode:
//=========================================
// God Mode
_GodMode:
 mov [pLastOne],edi         // Save structure address for debugging

 mov edx,[edi+44]           // Read ptr to Player ID
 or edx,edx                 // Valid Ptr?
 jz _ExitGM                 // Jump if false

 mov edx,[edx]              // Read Player ID
 cmp edx,[iPlayerID]        // Player´s?
 jne _ExitGM                // Jump if false

 mov eax,[edi+64]           // Read current HP
 cmp eax,[esp+14]           // Current HP <= New HP?
 jle _GodM1                 // Jump if true

 mov [esp+14],eax           // Update stack with current HP

_GodM1:
 mov ecx,[esp+14]           // Read new HP

_ExitGM:
 mov edx,[edi+000000b4]     // Original code
 jmp _BackGM                // Back to main code

//=========================================
// Variables
pLastOne:
 dd 0
iPlayerID:
 dd 1

//=========================================
// Original Codes
[DISABLE]
pGodMode:
 mov edx,[edi+000000b4]

dealloc(MyCode)
unregistersymbol(MyCode)
unregistersymbol(pLastOne)
unregistersymbol(iPlayerID)

but it keeps having the error "Error in line 9 (pGodMode):This address specifier is not valid"... can you help to point out what did i do wrong in the script? and also, can you tell me how you find out the base address (hacking point) in the first place? by searching in the cheat engine or by disassembler?[/code]
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Thu Sep 30, 2010 11:15 am    Post subject: Reply with quote

First You need to check that 8B 97 B4 00 00 00 89 4F is not pointing to other addresses too. The best is if You have only 1 search result if You search for this array. Also make sure to click on "Also scan read-only memory" when You search for codes.

CE 5.6.1 has a bug which prevents You to change scripts which are using aobscans. Try adding Your script to the table as a new script instead of modifying the previous one.


Quote:
and also, can you tell me how you find out the base address (hacking point) in the first place? by searching in the cheat engine or by disassembler?


The hacking point can be found by checking what writes to the address of a unit's health when it takes damage.

The base address of the unit's data structure can be figured by checking the code which is changing the address. Most likely (but not always) the base address is the register in the code.

mov edx,[edi+000000b4]

In this case the base address is EDI. And the unit structure's base address + B4 = the address of the unit's health.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Sep 30, 2010 12:41 pm    Post subject: Reply with quote

thank you, i went to add the script as a new one and it worked.... lol.. but for strategy games, like AOE and Civilization, the health pointer don't only points to your unit, but the enemies' as well, so how do you make it such that it points only to your own? sort of like nullifying damage done to the units you own...
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Thu Sep 30, 2010 1:14 pm    Post subject: Reply with quote

lalala1990 wrote:
thank you, i went to add the script as a new one and it worked.... lol.. but for strategy games, like AOE and Civilization, the health pointer don't only points to your unit, but the enemies' as well, so how do you make it such that it points only to your own? sort of like nullifying damage done to the units you own...


I don't know AOE but here is an example about god mode and what can You do with codes that are reading from a memory address.

http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles/87-basic-assembly-instructions-opcodes-and-examples

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Sep 30, 2010 11:30 pm    Post subject: Reply with quote

thank you, i would like to ask, normally, when you search for resources, what do you search for? byte, 2 byte, 4 byte or float? i can't seem to find the value....
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Thu Sep 30, 2010 11:50 pm    Post subject: Reply with quote

All of them. If You can't find it with exact value search with any type, You need to use unknown initial value search.
_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Fri Oct 01, 2010 12:59 am    Post subject: Reply with quote

i tried using unknown initial value search, but i can't seem to find any too... and also, how do you search for cooldown values? if i found one address that has the opcode: fstp dword ptr [esi+08] what does it means?
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Fri Oct 01, 2010 9:48 am    Post subject: Reply with quote

lalala1990 wrote:
i tried using unknown initial value search, but i can't seem to find any too... and also, how do you search for cooldown values? if i found one address that has the opcode: fstp dword ptr [esi+08] what does it means?


In some games, as in Starcraft 2 too, the unit health is stored as "how much damage did the unit take". So You need to search for max health-current health.

Cooldown values and timers can be increasing or decreasing values too. Try unknown search again. If it is a unit's ability, narrow down the search range to the unit's data structure.

fstp dword ptr [esi+08] will write a float value from the stack to [esi+08].

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Fri Oct 01, 2010 11:22 am    Post subject: Reply with quote

ok i found the health hacking point, but i still dun quite understand the whole structure lol.. i'm very new in asm... but anyway, i tried to find the resource hacking point for aoe3, when i was searching, i couldn't find the exact value of the resource (food, gold or wood).. i can only find a pointer value that's always changing... meaning that when i change the value, the amount of the resource i was trying to change will jump randomly, sometimes negative value and sometimes positive value... when i try to find out what accesses the code, i was brought to the main hacking point for resources... but i don't know what it meant... here's part of it:

Code:

005B6410 - 33 04 8a                   - xor eax,[edx+ecx*4]
005B6413 - 89 44 24 04                - mov [esp+04],eax
005B6417 - d9 44 24 04                - fld dword ptr [esp+04]
005B641B - 83 c4 08                   - add esp,08
005B641E - c2 04 00                   - ret 0004



why did i know that was the hacking point? i figure it out from Recifense's resource script... here it is. i tried to update it to the newer version, but when i disable it, the game crashes... so i dunno what to do:

Code:

// Age of Empires III - The Asian Dynasties
// Game Version  : 1.0
// Script Version: 1.0
// CE Version    : 5.4
// Resources (based on a Dark Byte´s script)
// 25-Jul-2008

[ENABLE]
alloc(MyCode1,1024)

// Declaration session
label(_Resource)
label(_MonPlayer)
label(_Res0)
label(_Res1)
label(_BackR)
label(_BackMP)
label(_ExitR)
label(_ExitMP)
label(iPlayerID1)
label(pResource)
label(pPlayer)

registersymbol(MyCode1)
registersymbol(iPlayerID1)
registersymbol(pResource)
registersymbol(pPlayer)

//=========================================
// Hacking Points
age3y.exe+3cef8:
 jmp _Resource
 nop
 nop
_BackR:

age3y.exe+4337d:
 jmp _MonPlayer
 nop
_BackMP:

MyCode1:
//=========================================
// Minimum Resource = 5000
_Resource:
 push ebx                   // Save EBX

 cmp edx,[pResource]        // Is it the player´s?
 jne _Res1                  // Jump if false

 cmp ecx,7                  // Is it Export?
 je _Res0                   // Jump if true

 cmp ecx,3                  // Is it coin, wood or food?
 jge _Res1                  // Jump if false

_Res0:
 mov ebx,eax                // Save encription
 xor eax,[edx+ecx*4]        // Decript resource

 cmp eax,459c4000           // Greater the 5000?
 jge _ExitR                 // Jump if true

 mov eax,459c4000           // Make eax = 5000
 xor eax,ebx                // Encript resource
 mov [edx+ecx*4],eax        // Update resource

 mov eax,ebx                // Restore encription

_Res1:
 xor eax,[edx+ecx*4]        // Decript resource

_ExitR:
 pop ebx                    // Restore EBX
 mov [esp+14],eax           // Original code
 jmp _BackR                 // Back to main code

//=========================================
// Monitor player structure address
_MonPlayer:
 mov ecx,[edx]              // Read ID
 cmp ecx,[iPlayerID1]       // Is it the player´s?
 jne _ExitMP                // Jump if false

 mov ecx,[edx+00000230]     // Read ptr to resource

 mov [pResource],ecx        // Save ptr to further use
 mov [pPlayer],edx          // Save player struct address for debugging

 mov ecx,[edx]              // Read ID

_ExitMP:
 mov edx,[esp+20]           // Original code
 jmp _BackMP                // Back to main code
//=========================================
// Variables
iPlayerID1:
 dd 1
pResource:
 dd 0
pPlayer:
 dd 0

//=========================================
// Original Codes
[DISABLE]
age3y.exe+3cef8:
 xor eax,[edx+ecx*4]
 mov [esp+14],eax

age3y.exe+4337d:
 mov ecx,[edx]
 mov edx,[esp+20]

dealloc(MyCode1)
unregistersymbol(MyCode1)
unregistersymbol(iPlayerID1)
unregistersymbol(pResource)
unregistersymbol(pPlayer)

the code above gave me all the resources set at 5000, but i want to be able to set each of them... how can i do that?
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Fri Oct 01, 2010 11:44 am    Post subject: Reply with quote

Ah I see from the script that the value is encrypted. The script is decrypting it, check and change the value as float and encrypt it again. You can changed the value You want to get in these points:


cmp eax,459c4000 // Greater the 5000?
mov eax,459c4000 // Make eax = 5000

That is the easies way. Or You can make it customizable by registering a symbol for the value and add it to Your table and You can change it anytime after that.

_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Fri Oct 01, 2010 11:58 am    Post subject: Reply with quote

sorry pardon me but i don't get what you mean... if i wan to change the values of the resources independently and not change all of it at one go, how do i do it? what you mean is the value of the resource are encrypted? that's why i cannot find the value with cheat engine? and by the way, how do you make instant build, instant train and other stuff? when i'm training a villager, i tried to search for the cooldown timer, when i'm beginning to train, i search for an unknown value, after that, as the timer goes down, i search for decreased, and when i managed to train the villager and the timer disappears, i search for decreased also, then i start to train another villager and i search for increased, then decreased again, but i will end up with no values... what did i do wrongly?
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page 1, 2, 3  Next
Page 1 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites