Cheat Engine

[Smanettone83]

Hi guys,
i think i've found the code that check the memory of game for the anticheat protection after i had set a data breakpoint on the instruction that accesses to my ammo...
the istruction is:

[Dark Byte]

that's the integrity check routine yes
what you could also do is make a copy of the whole game memory and adjust the ECX register to point to the copy, so it reads an unmodified version of the code

Or look into the stealthedit plugin for cheat engine

[Smanettone83]

[Screitor]

[Dark Byte]

Just experience (shift and xor on a byte value that it got from reading code)
EAX is the return value of this "CalculateIntegrityValue()" function. (ECX=memory pointer, EDX=bytes left)

Instead of a copy you could also check the value of EAX at the point of ret and always make EAX that same value when returning (Tip: Check if there isn't another function that checks the integrity of that function separately)

But if this is too difficult, then Geri posted a stealthedit tutorial on his website, including links to stealthedit downloads and a video on how to use it

[HiSaZuL]

So any news on disabling this garbage ?

There is break at ret...
So what would 1 usually do at this point ?

[Dark Byte]

find the start of the function and write:

[HiSaZuL]

Thanks for explanations DB Mhm... Its best I do little steps this is a bit over my head.... oh who am I kidding this is waaay over my head LOL. I pocked around didn't really figure out much.
Considering how bloody long it takes for crysis to start... not actual map load(its fairly fast) I got tired now meh ~_~.
And fling already got all that I wanted in trainer. His are well made no bs/pointless options so I'm going to leave integrity check study for a smaller easier to manage game
that someone with good asm knowledge just happens to mess with so I can get pointers as I go.
Again thanks for heads up it was interesting to try and see how integrity check works for a first time at least

[Daijobu]

I wonder why a check like this is even put in a singleplayer game. But I'm a newb so it all just seems very silly to me.

Great thing that I found this topic though, explains why the game kept crashing over and over.

[HiSaZuL]

[Dark Byte]

Perhaps it's an extra layer of drm for situations like delay loaded cracks.
e.g: a crack that disables the copy protection before it is executed, but after the exe has been started (so no modified exe but the copy protection check got removed)

or who knows, perhaps they only want their own DLC to have an effect in the game (e.g. selling godmode)

Also, have you tried the cracked version of the game ?
Cracked versions often take out checks like that, and the added bonus is that the game will run a lot smoother (less memory checks)

[HiSaZuL]

[Daijobu]

And here I sat diligently creating all the hacks I wanted to blast through the singleplayer like a demi-god. 10 to 20 seconds after injection > exit to desktop without warning or error.

I see some trainers have already been released. Lingon being one of them. Those guys must have circumvented this system already!

[Dark Byte]

It's really not that hard to do. Check out recifense table on shogun 2 steam version where he bypasses a similar protection.

And as I said, you might be able to use stealthedit to quickly bypass it without needing to know any assembler (besides the assembler to do the cheats you wish)

[redleouf]

I am going to test the stealthedit method later this week, and if nobody made it before me, I will post the result

Thank you for the advice Darkbyte