| View previous topic :: View next topic |
| Author |
Message |
Smanettone83
Expert Cheater
 Reputation: 3
Joined: 21 Feb 2011
Posts: 146
Location: Italia
|
 Posted: Sun Mar 13, 2011 12:32 pm Post subject: how to compare addresses for god mode(shared Health routine) |
 |
|
hi guys,
i'm playing with seriuos sam 2 and i've found the health address.
0141AE80 - 89 86 80 04 00 00 - mov [esi+00000480],eax
the address is shared with enemies and i can't nop it...
i've found the health addresses of enemies with "find out what addresses this code write to".
i've used dissector to compare the addresses. i've found the offset 2C where is ID character
0 = my character
1= enemies
later i've used the code injection for increase the value on 100% only if character ID is 0...
i've tried with this code:
| Code: |
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
0141AE80:
jmp newmem
nop
returnhere:
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
cmp [esi+2C],0 // check if is enemy or mine characheter
jmp originalcode // if not 0 jump to original code
mov [esi+00000480],64 // move esi to 100 (max value)
originalcode:
mov [esi+00000480],eax
exit:
jmp returnhere
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
0141AE80:
mov [esi+00000480],eax
//Alt: db 89 86 80 04 00 00
|
does not work.... where am i wrong?
|
|
| Back to top |
|
 |
Geri
Moderator
![]() Reputation: 112
Joined: 05 Feb 2010
Posts: 5627
|
| Posted: Sun Mar 13, 2011 2:12 pm Post subject: |
|
|
| Code: | | jmp originalcode // if not 0 jump to original code |
This is not a conditional jump, the program will always jump from here to originalcode.
| Code: | | jne originalcode // if not 0 jump to original code |
This is a conditional jump. Jump if Not Equal (jne). It is easy to remember it if you know what it means.
By the way I am not sure that your player ID will work. You need to test it. Also, changing the code that you use will probably cause a crash sometimes. I have used another code to make my cheat, which proved to be more stable but still accessing to this area.
_________________
|
|
| Back to top |
|
|
Smanettone83
Expert Cheater
Reputation: 3
Joined: 21 Feb 2011
Posts: 146
Location: Italia
|
| Posted: Sun Mar 13, 2011 3:48 pm Post subject: |
|
|
ok i've tried with
mov [esi +00000480], 64 and it work fine the game not crash
i've 100% health but also the enemies.
later i've tried to replace jmp originalcode with
jne originalcode but nothing... the game not crash but i'havent god mode...
it's possible that the offeset may be wrong?
replaced code:
| Code: |
newmem:
cmp [esi +2C], 0
jne originalcode
mov [esi +00000480], 64
|
|
|
| Back to top |
|
|
Geri
Moderator
![]() Reputation: 112
Joined: 05 Feb 2010
Posts: 5627
|
|
| Back to top |
|
|
Smanettone83
Expert Cheater
Reputation: 3
Joined: 21 Feb 2011
Posts: 146
Location: Italia
|
| Posted: Mon Mar 14, 2011 8:19 am Post subject: |
|
|
i don't undestand...
first table:
| Code: |
newmem: //this is allocated memory, you have read,write,execute access
pushfd
pushad
mov ecx,[esi+012C]
cmp [ecx],79616C70
jne originalcode
mov [esi+00000470],270F
originalcode:
popad
popfd
cmp [esi+00000478],eax
|
[esi+00000470] = offset healt?
mov ecx,[esi+012C] // why ecx and what is 12C?
cmp [ecx],79616C70 // <= what is this code? why ecx?
cmp [esi+00000478],eax //<== why 478? it's the offeset of health 470?
|
|
| Back to top |
|
|
Geri
Moderator
![]() Reputation: 112
Joined: 05 Feb 2010
Posts: 5627
|
| Posted: Mon Mar 14, 2011 10:04 am Post subject: |
|
|
It is explained in that topic:
| Quote: | cmp [esi+00000478],eax is a code which is accessing to the copy of the health. The real health is just before this copy with 8 bytes, so it is on offset 470. I have used this code to avoid crashes, the game likes to crash if You use code injection at some points.
So esi+0470 is the health. There is a pointer on esi+012C which is pointing to a string: player (of course only if the structure is Sam's structure).
The script is just checking the string
| Code: | mov ecx,[esi+012C] //save address on the pointer to ecx
cmp [ecx],79616C70 //check the address where the pointer is pointing
jne originalcode //if the result is not 79616C70 (which is "play" in hex) then jump
mov [esi+00000470],270F //change health to 9999
originalcode:
popad
popfd
cmp [esi+00000478],eax //and this is the original code already |
|
Offset 478 is just the copy of health, changing that would be useless but it is right after the real health so the code which is accessing to the copy of the health can be used to manipulate the real health.
So what I have done is checked the pointer on offset 012C to see if it is pointing to the "player" string. Actually I have checked 4 bytes only so it is checking "play".
_________________
|
|
| Back to top |
|
|
boredtc
How do I cheat?
![]() Reputation: 0
Joined: 04 Dec 2010
Posts: 7
|
| Posted: Sun Apr 10, 2011 10:27 am Post subject: |
|
|
I don't know if this is the right topic to reply, but hey, i didn't want to spoil it by opening an new topic.
I've read all topics related to the mem dissect functions, but i get stuck every time.
So far:
I got the address that writes to both enemy and player health "fstp dword ptr [esi+0000032c]
Then I use "find out what addresses this instruction accesses".
I go back into the game and shoot an enemy, get shot once, and 2 addresses
are added to the window.
I put those into the mem dissect window and add an -32c to both.
Now i define a new structure, click ok a few times, now that the information is showing, I rightclick the enemy-address, change group to 1.
Now what can I do with the information that it's showing.
see url for screenshot.
http: //img228 .imageshack .us/f/37300969.jpg/
|
|
| Back to top |
|
|
Geri
Moderator
![]() Reputation: 112
Joined: 05 Feb 2010
Posts: 5627
|
| Posted: Sun Apr 10, 2011 3:45 pm Post subject: |
|
|
It is better if you compare more than 2 structure, like yourself and 2-3 enemies' structure. After that, you need to look for similarities and differencies between your and the enemies' structure. Some data that is unique to your charachter.
_________________
|
|
| Back to top |
|
|
Freiza
Grandmaster Cheater
 Reputation: 22
Joined: 28 Jun 2010
Posts: 662
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
