Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


How to make working script on Sacred?
Goto page Previous  1, 2, 3  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Thu Jun 13, 2013 1:31 pm    Post subject: Reply with quote

The script I posted above is not meant to work for companions. Look at its code and try to understand what it actually does (I wrote the comments for that). Ask questions if there are specific parts you don't understand.

Now to add support for companions, see if you can find:
-a function that only accesses player and companion HP (probably the one that draws HP bars on portraits...).
OR
-a function that only accesses companion HP.
OR
-a variable that tells a given being is a companion (exactly like finding Hero ID).
OR
-a pointer to your current companion (like find his HP, first pointerscan, ditch companion, find another, pointer rescan with 2nd companion's HP).
Back to top
View user's profile Send private message
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Sat Jun 15, 2013 12:42 pm    Post subject: Reply with quote

I tried to find a pointer or that variable but it was very hard and I couldn't find anything. I will try again with other options for pointer scan, maybe I will find something, but I have a question:

Gniarf wrote:
Now to add support for companions, see if you can find:
-a function that only accesses player and companion HP (probably the one that draws HP bars on portraits...).
OR
-a function that only accesses companion HP.


What do You mean by "function"?
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Sat Jun 15, 2013 1:53 pm    Post subject: Reply with quote

I meant an instruction found using "find what accesses...".
Back to top
View user's profile Send private message
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Sun Jun 16, 2013 5:45 am    Post subject: Reply with quote

I have found 4 functions, but to be honest, the fourth one (16FF54) is the safest because the others have found some other values than just HP of my companion (max HP is 04 offset before the current HP, so eg. 0130 is current, then 012C is maximum HP)


CE 7.png
 Description:
 Filesize:  17.09 KB
 Viewed:  10714 Time(s)

CE 7.png


Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Sun Jun 16, 2013 3:07 pm    Post subject: Reply with quote

Ok, so assuming that 4th function only accesses companion HP (not baddies, nor player, though it doesn't matter), this script should provide companion godmode, player godmode, and epilepsy for you because you made a change -I believe in LogPlayerHPAddress - that I didn't include (I didn't have the sacred.exe+xxx source).

Code:
[ENABLE]
alloc(NewMem,1024)
//code locations
label(LogPlayerHealthAddress)
label(LogPlayerHealthAddress_End)
label(LogCompanionHealthAddress)
label(LogCompanionHealthAddress_IndexOK)
label(LogCompanionHealthAddress_End)
label(ApplyDamage)
label(ApplyDamage_ProtectVIP)
label(ApplyDamage_Exit)
label(ApplyDamage_End)
//variables
label(PlayerHpAddress)
label(CompanionHpAddressArray) //5 elements
label(ArrayIndex)

sacred.exe+1397f7:            //UPDATE THIS LINE
jmp LogPlayerHealthAddress
nop                           //UPDATE THIS LINE
LogPlayerHealthAddress_End:

"sacred.exe"+163020:
jmp ApplyDamage
nop
ApplyDamage_End:

"sacred.exe"+16FF54:
jmp LogCompanionHealthAddress
nop
LogCompanionHealthAddress_End:

NewMem:
ApplyDamage:
  push eax
  lea eax, [ebp+130]
  cmp dword [PlayerHpAddress],eax                //trying to damage the player?
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray],eax  //or one companion?
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+4],eax //or another companion?
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+8],eax
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+c],eax
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+10],eax
  je short ApplyDamage_ProtectVIP
  jmp short ApplyDamage_Exit
    ApplyDamage_ProtectVIP:
    mov edi,[ebp+0000012c]                  //load max HP
  ApplyDamage_Exit:
  mov [ebp+00000130],edi                    //original code
  pop eax
jmp ApplyDamage_End

LogPlayerHealthAddress:
  push eax
  lea eax, [ebp+4D8]          //UPDATE THIS LINE
  mov dword [PlayerHpAddress],eax
  pop eax
  cmp dword [ebp+4d8],ebx     //UPDATE THIS LINE
jmp LogPlayerHealthAddress_End

LogCompanionHealthAddress:    //will store ebp+130 into CompanionHpAddressArray slot 1 on 1st execution, then slot 2,3,4,0,1...
  push eax                    //save eax
  push ebx                    //save ebx
  mov ebx,dword [ArrayIndex]  //ebx=array index
  inc ebx                     //increase ebx by 1
  cmp ebx,4                   //4=number of slots in CompanionHpAddressArray-1
  jle short LogCompanionHealthAddress_IndexOK //jump if ebx is =4 or less
    xor ebx,ebx               //ebx=0
  LogCompanionHealthAddress_IndexOK:
  mov dword [ArrayIndex],ebx  //save in ArrayIndex, ebx=(ArrayIndex+1)modulo 5
  lea eax,[ebp+130]           //eax=address of Hp
  mov dword [CompanionHpAddressArray+ebx*4],eax //store eax in the ebx-th slot of CompanionHpAddressArray
  pop ebx                     //restore saved ebx
  pop eax                     //restore saved eax
  mov dword [ebp+130],eax     //original code
jmp LogCompanionHealthAddress_End

PlayerHpAddress:
dd 0

CompanionHpAddressArray:
dd 0  //companion 0 HP address
dd 0  //companion 1 HP address
dd 0  //...
dd 0
dd 0

ArrayIndex:
dd 0

[DISABLE]
dealloc(NewMem)

sacred.exe+1397f7:            //UPDATE THIS LINE
cmp dword [ebp+4d8],ebx       //UPDATE THIS LINE

"sacred.exe"+163020:
mov [ebp+00000130],edi

"sacred.exe"+16FF54:
mov dword [ebp+130],eax
Back to top
View user's profile Send private message
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Sun Jun 16, 2013 4:38 pm    Post subject: Reply with quote

It has a godmode for player, for companions, even for enemies, but now I'm updating lines, you checked, but I can't understand one thing: how to update this:

Code:
nop                           //UPDATE THIS LINE
?

@Edit: After some updates I made a script which kills everybody who is in some range, even the citizens are dying Very Happy

@Edit2: I can't understand this... I am sure that those functions only affects Player/Companions but still enemies are invincible as well, as I am, sometimes I can kill them when I hit them with more HP than their maximum, sometimes even when I hit them with more HP than 1000x their maximum, their still alive.
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Sun Jun 16, 2013 6:15 pm    Post subject: Reply with quote

Jacusiek wrote:
I can't understand one thing: how to update this:
Code:
nop                           //UPDATE THIS LINE
?
You replaced sacred.exe+1397f7 by another address, but if the instruction at this new address is not 6 byte long you may need to add or remove nops (nops are just padding).

Jacusiek wrote:
@Edit: After some updates I made a script which kills everybody who is in some range, even the citizens are dying Very Happy
Like the barbarian's dagger stare, on steroids.

Jacusiek wrote:
@Edit2: I can't understand this... I am sure that those functions only affects Player/Companions but still enemies are invincible as well, as I am, sometimes I can kill them when I hit them with more HP than their maximum, sometimes even when I hit them with more HP than 1000x their maximum, their still alive.
Post your updated script, I'll check if I see something wrong.
Back to top
View user's profile Send private message
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Mon Jun 17, 2013 2:02 am    Post subject: Reply with quote

Here are some codes, I will put them on another site, because they are just too long to put them here:

1) http://wklej.to/FBxGw- this gives everyone God Mode, which regenerates "slowly", so if I shoot fast enough I can still kill enemy (the same with enemy, who can kill me, if strong and fast enough)
2) http://wklej.to/FyRf4 - this one gives everyone God Mode, but enemy with 3000 HP can't be killed even with shot, which deals above 10000 HP (I would like to have GM like this, because the first one needs to regenerate and also I can still die, when I am hit over than my maximum HP)
3) http://wklej.to/jJsWy - like the 2)
4) http://wklej.to/RUNS4 - like the 1)

That's all I've found with "Find out what accessess...", I also tried to remove "nop" line but it just crashed the game.
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Mon Jun 17, 2013 3:30 am    Post subject: Reply with quote

There is a recurrent mistake in scripts 1,3 and 4. The 4 red registers should always be the same:
LogPlayerHealthAddress:
push eax
//lea edx, [ebp+130] //wrong
lea eax, [ebp+130] //good,only the green part changes on this line
mov dword [PlayerHpAddress],eax
pop eax
cmp dword [ebp+130],edx //original code
jmp LogPlayerHealthAddress_End

Refer to the comments of the first script I posted in this thread to see why it must be updated this way.

Also does this script give you a companion-only GM?
Code:
[ENABLE]
alloc(NewMem,1024)
//code locations
label(LogCompanionHealthAddress)
label(LogCompanionHealthAddress_IndexOK)
label(LogCompanionHealthAddress_End)
label(ApplyDamage)
label(ApplyDamage_ProtectVIP)
label(ApplyDamage_Exit)
label(ApplyDamage_End)
//variables
label(CompanionHpAddressArray) //5 elements
label(ArrayIndex)

"sacred.exe"+163020:
jmp ApplyDamage
nop
ApplyDamage_End:

"sacred.exe"+16FF54:
jmp LogCompanionHealthAddress
nop
LogCompanionHealthAddress_End:

NewMem:
ApplyDamage:
  push eax
  lea eax, [ebp+130]
  cmp dword [CompanionHpAddressArray],eax
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+4],eax
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+8],eax
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+c],eax
  je short ApplyDamage_ProtectVIP
  cmp dword [CompanionHpAddressArray+10],eax
  je short ApplyDamage_ProtectVIP
  jmp short ApplyDamage_Exit
    ApplyDamage_ProtectVIP:
    mov edi,[ebp+0000012c]                  //load max HP
  ApplyDamage_Exit:
  mov [ebp+00000130],edi                    //original code
  pop eax
jmp ApplyDamage_End

LogCompanionHealthAddress:
  push eax
  push ebx
  mov ebx,dword [ArrayIndex]
  inc ebx
  cmp ebx,4
  jle short LogCompanionHealthAddress_IndexOK
    xor ebx,ebx
  LogCompanionHealthAddress_IndexOK:
  mov dword [ArrayIndex],ebx
  lea eax,[ebp+130]
  mov dword [CompanionHpAddressArray+ebx*4],eax
  pop ebx
  pop eax
  mov dword [ebp+130],eax     //original code
jmp LogCompanionHealthAddress_End

CompanionHpAddressArray:
dd 0
dd 0
dd 0
dd 0
dd 0

ArrayIndex:
dd 0

[DISABLE]
dealloc(NewMem)

"sacred.exe"+163020:
mov [ebp+00000130],edi

"sacred.exe"+16FF54:
mov dword [ebp+130],eax
(This one doesn't need any updating)
Back to top
View user's profile Send private message
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Mon Jun 17, 2013 5:00 am    Post subject: Reply with quote

The new one You wrote, works like the old one: gives GM for everyone (enemies too).

@Edit: I also tried to update those lines, now correctly, but it didn't work. I see You deleted lines for player, so it means, that the instructions I found are wrong, because they also work for enemies and players...
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Mon Jun 17, 2013 5:47 am    Post subject: Reply with quote

Jacusiek wrote:
The new one You wrote, works like the old one: gives GM for everyone (enemies too).
Hmm...Are you ABSOLUTELY sure that "sacred.exe"+16FF54: mov dword [ebp+130],eax doesn't access enemy HP?

Fu, I guess it's time I take the dust off that cd...What version of sacred are you using? With or without the addon?
Back to top
View user's profile Send private message
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Mon Jun 17, 2013 6:19 am    Post subject: Reply with quote

Gniarf wrote:
Jacusiek wrote:
The new one You wrote, works like the old one: gives GM for everyone (enemies too).
Hmm...Are you ABSOLUTELY sure that "sacred.exe"+16FF54: mov dword [ebp+130],eax doesn't access enemy HP?

Fu, I guess it's time I take the dust off that cd...What version of sacred are you using? With or without the addon?


The newest version Sacred Underworld 2.28 (PL), but as You said, I see that "sacred.exe"+16FF54" also accesses enemy HP... It's strange, because some time ago it didn't. Also, when I select "find out what accessess" it finds me many instructions, but EVERY instruction accesses also enemy and my HP. I have found some structures to find players, enemy and companion ID, and that's what I found:

http://imageshack.us/g/593/4j7.png/

Photos:
IDs are: Player/Companion/Enemy/Enemy/Enemy (but I wonder if it should be P/C/Enemy1/Enemy1/Enemy2 (because Enemy1 are Goblin Warriors, and Enemy2 is goblin champion - another names)
2) IDs: 0064 - 4 bytes - 169/84/104/104/104
3) IDs: 03B0 - 4 bytes - 5/279/76/76/128 (here You can see e1,e1,e2)
also IDs: 0414 - byte - 217/20/11/11/64
and: 0415 - byte - 67/65/66/66/66 (I think this is the most possible, it looks realistic, numbers are near other numbers)
4) 4d8 - current health, 4d4 - max health
04D0 - 4 bytes - 7714/2904/3003/3003/3003 - it's something connected to HP, but it's not so important (it is the current value of HP but not HP I have, but HP I see on screen, so it's fake)
IDs: 04E0 - 4 bytes - 1124/250/158/158/158

Those are the nearest to current HP 4D8, so they are the most possible to be IDs. I also wonder, maybe companion and I have the same ID, or enemies have the same (even enemies with different names). I don't know how exactly look at it.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 223

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Mon Jun 17, 2013 7:03 am    Post subject: Reply with quote

Piszesz, że dla Player oraz Companion pod 4D4 jest wartość maksymalna, a pod 4D8 jest wartość aktualna. (w 4D0 wartość ukazana na ekranie).

Czy dla przeciwników wartość pod 4D4 jest zawsze mniejsza od wartości pod 4D8? Możesz wyjaśnić dlaczego w przypadku przeciwników max jest mniejszy od current?

Niestety nie posiadam tej gry i nie znam jej mechanizmów...


Mogę ewentualnie pomóc poprzez TeamViewer (jeżeli dobrze go skonfigurujesz, nie masz się czego bać).

_________________
Back to top
View user's profile Send private message MSN Messenger
Jacusiek
Advanced Cheater
Reputation: 0

Joined: 24 Jan 2011
Posts: 81

PostPosted: Mon Jun 17, 2013 8:25 am    Post subject: Reply with quote

Przeciwnicy mają więcej HP niż max, ponieważ sam im zwiększyłem (żeby nie zginęli mi od razu, do testów). Dzięki za pomoc mgr.inz.Player, ale przy okazji staram się sam zrozumieć mechanizm skryptów, jakoś dam radę Smile

Eng: Enemies have more current HP than max, because I increased their HP (because I didn't want their death, I was testing something).
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 223

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Mon Jun 17, 2013 8:33 am    Post subject: Reply with quote

Tak patrzę i oprócz tych niepewnych ID co podałeś w swoim poprzednim poście zauważ co jest w
39C
3A0
3A4
Tu są pointery do struktur, które tylko player i companion posiada.
Comapanion i Player mają tam jakiś adres, a przeciwnicy mają zero. Można wykorzystać ten fakt.





Ale chciałbym abyś wypróbował pewną nowość o którą poprosiłem autora programu CheatEngine. Zainstaluj CE6.3, w menu start odnajdź skrót do resetowania ustawień (Reset settings).

Odnajdź adres z HP tylko twojej postaci. Po odnalezieniu spauzuj grę, dodaj ten adres do listy, wybierz "find out what access ...", w nowym okienku kliknij prawym myszy w pustej przestrzeni zaraz pod kolumną "instruction". Z menu kontekstowego wybierz "check if found opcodes also access ..."

Ta nowa funkcjonalność CE6.3 pozwala szybko odnaleźć opcode które odczytują/modyfikują tylko jeden/kilka/więcejniżosiem adres(ów).

Wróć do gry i pobaw się (uprzednio możesz zamrozić HP aby cię nie zabili) przez jedną minutę. Spauzuj grę, w okienku powinny się pojawić opcode'y wraz z informacją ile razy przez ten czas natrafiły na adres HP. Wartości w nawiasach informują czy opcode'y także odczytują/modyfikują adresy z HP przeciwników, bądź w ogóle inne adresy.

Powiększ okienko maksymalnie jak się da, aby wszystkie opcode wraz ze wszystkimi informacjami były widoczne. Upewnij się że kolumna "Count" jest odpowiedniej szerokości. Możesz też zmniejszyć pole tekstowe w którym są dodatkowe informacje na temat obecnie wybranego opcode.

Wklej screenshot tak powiększonego okienka.


Opcode, które w nawiasie mają tylko wartość 1, oznacza że używane są tylko i wyłącznie do HP gracza, wartość 2 - dla gracza i chowańca, 3 i więcej oznacza że opcode jest współdzielonym także z przeciwnikami.



English:
I suggested him to use new CE6.3 feature:
"The "Find out what *** this address" function now has the ability to show if the given opcode is used for other data as well "

plus I noticed that values at 39C, 3A0, 3A4 are zero for enemies.

_________________
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page Previous  1, 2, 3  Next
Page 2 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites