Cheat Engine

[SwaggaJackin']

I've got an address (Enemy's life) that is being written to. However, the code that writes to it is used by several other items and is constantly being used.

The life of the enemy is stored in EAX and is written to [ECX+EBX]. I've tried using a trace to find out when EAX gets its value but this address is used so constantly that using a break and trace crashes the game before the enemy can have more damage dealt to it to force a break.

Any ideas how to trace back and find out where the damage function is calling or jumping to this write instruction?

[Dark Byte]

ignore this, I just read it's a flash game

-----
Check the stacktrace on the find what writes window (more info) that should give an idea what jumped to the function (ebp+4)


Or, if you can run the game in windowed mode and have a recent intel cpu: (I know, my intel only hacks are annoying for those with AMD's but I can't help it)

Set a write breakpoint on the health address of the enemy (Select the bytes in the hexview, rightclick, and set a data write breakpoint)


Then open a lua window and give this command:
debug_setLastBranchRecording(true)

Now go to the game and get hit. The game will completly freeze, but if you managed to run it in windowed mode you should be able to alt-tab to ce

In lua execute:
print("max index=".debug_getMaxLastBranchRecord())

to see the maximum value you can use for debug_getLastBranchRecord (different for each kind of cpu)

Then you can fetch the addresses of the last jumps and conditional jumps it took with debug_getLastBranchRecord(index)

If you're on 64-bit don't forget to reboot with unsigned driver support enabled...


And I think you can even apply this in an onBreakpoint function so you don't even have to run in windowed mode without breaking


----------------
Now after reading this useless info, ignore this as this will be completly useless to you as it's a flash game. (for other games useful advice)

If the code you found is in a code section, or the same code is used for everything else, then you can see this flash game as a playstation game running in an emulator (And I'm sure you know what that means)

Anyhow, 6 bytes left of the value should be a pointer to a block witch contains a pointer somewhere to a string with the variablename. Perhaps you can do something with that

[SwaggaJackin']

It's java, not flash. Not sure if that makes a difference but I'll look into what you said.

EDIT:

Added a pointer -6 of the address I found and it doesn't point to anything.

[Dark Byte]

yeah, the -6 won't work then

anyhow, same principle. Java is an emulator and the game is the native code it is emulating. The same instruction is used for writing the mouse cursor to writing a pixel on the screen

If the code you found is part of the java runtime and not a JIT generated piece of code to increase speed then debugging will not work.
Perhaps you can find a identifier in the region arround the variable you found. Or else try a specialized java tool to debug or decompile the game

[SwaggaJackin']

Hrmmm, I'll see if I can find out how it loads the damage I'm going to do then. Maybe I can find a constant it reads from a table and just change the constant to 1-hit KO.