| View previous topic :: View next topic |
| Author |
Message |
Jaerin
How do I cheat?
![]() Reputation: 0
Joined: 09 Jul 2011
Posts: 6
|
 Posted: Mon Jul 11, 2011 5:59 pm Post subject: Spiral Knights |
 |
|
So I'm attempting to tease out some of the detailed information about this game, but I'm having some serious problems getting a consistent working static pointer for it. I'd also like to just have a script to play a sound when my health gets below a certain level. (Seems like a basic feature, but it hasn't been added yet)
First thing I need to ask is if its even possible? This game is a java game so the process is always javaw.exe. I have been successful in getting pointers that point back to javaw.exe but I don't know if that is good enough or not. I can find a specific address that consistently writes to the CurHP, but it seems to access a lot of different locations so I'm not sure if I can use that or not.
So here's what I have:
I can find my current HP without too much trouble now, usually only a couple of searches and I can find the two non-static locations:
There is always 2 and only 2 addresses that have my current HP. They are always adjacent to one another.
The same function is the only thing that I've found that writes to these addresses:
| Code: |
031EF934 - 89 04 19 - mov [ecx+ebx],eax
031EF931 - 59 - pop ecx
031EF932 - 3B 01 - cmp eax,[ecx]
031EF934 - 89 04 19 - mov [ecx+ebx],eax <<
031EF937 - E9 CB000000 - jmp 031EFA07
031EF93C - 83 F8 07 - cmp eax,07
EAX=000000FC
EBX=00000078
ECX=13D18CF8
EDX=00000000
ESI=2138585C
EDI=0789F658
ESP=0789F628
EBP=0789F648
EIP=031EF937
|
So from this it appears that CurHP is actually probably in fact 13D18CF8 + 78
From here I've tried using the pointer scanner 5, 6, and 7 levels deep and found a multitude of pointers to DLL's and a few pointing back to javaw.exe.
The javaw.exe pointers have worked for a while, but they never seem permanent. Some last through restarts of the game/computer, but eventually they have all failed.
1.) Is there a way to sort or search the pointer scanner window for a particular process?
2.) I've read in other threads that Java games can be impossible to find static pointers in, is this one of those cases?
3.) Am I going about finding the static pointers in the correct way?
Thanks in advance
BTW when the javaw.exe pointers were working I was able to easily make an Autoit script to play a sound on low health. Is this something that could be done in LUA in cheat engine or something either easier or maybe more robustly?
|
|
| Back to top |
|
 |
utherson601
How do I cheat?
![]() Reputation: 0
Joined: 09 Jul 2011
Posts: 4
|
| Posted: Mon Jul 11, 2011 7:54 pm Post subject: |
|
|
| The main problem your going to have is that the values that your looking for are on a server, and the ones that your getting are just the values that reference back to the server..... Spiral knights is a server sided game..... the only useful thing that you can do with cheat engine would be to make a speed/fly hack........ which isn't really that useful anyways
|
|
| Back to top |
|
|
Jaerin
How do I cheat?
![]() Reputation: 0
Joined: 09 Jul 2011
Posts: 6
|
| Posted: Mon Jul 11, 2011 8:03 pm Post subject: |
|
|
That's not the point. I'm not trying to make an invuln hack or gold hack or anything like that. I'm actually trying to make something similar to a addon for it.
That's why...
I know there isn't going to be anything more than probably a speed hack or fly hack and even that I doubt because I'm pretty sure its not client side trusted at all.
The game uses graphics to obfuscate exact values for a lot of things. It's hard to theorycraft which weapons/armors are the best without significant testing unless you can find exact values. I've already found a more exact value for health in memory. I'm expecting there might be a whole lot more than that if someone helps me dig a little.
|
|
| Back to top |
|
|
Jaerin
How do I cheat?
![]() Reputation: 0
Joined: 09 Jul 2011
Posts: 6
|
| Posted: Tue Jul 12, 2011 9:19 am Post subject: |
|
|
So looking around I see that it might not be that difficult to use some simple assembly to hook this function in order to save the pointer location.
So if I understand correctly essentially what you do it replace the existing instructions at those locations with a jmp to my code cave. In that code cave I'll move EAX to a location, perform the replaced instructions and then jmp back to the line after I left?
Is that essentially the gist of it?
| Code: |
jmp XXXXXXXX
pop eax
pop ecx
mov YYYYYYYY, [ecx+ebx]
cmp eax, [ecx]
mov [ecx+ebx], eax
jmp 031EFA07
|
Something like that then I could easily always hook the address I specify for Y?
I've never done anything like this before so its entirely a guess based on what I've read so far.
|
|
| Back to top |
|
|
Jaerin
How do I cheat?
![]() Reputation: 0
Joined: 09 Jul 2011
Posts: 6
|
| Posted: Tue Jul 12, 2011 5:50 pm Post subject: |
|
|
Do you guys think that I'm on the right track here?
If not can you point me to some tutorials/tools that would help? I'm willing to learn and do the work just need some help.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
