 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4196
|
Posted: Sun Jul 14, 2013 3:21 pm Post subject: |
|
|
Really, if you have the value that you want to change, just inject code at an instruction that accesses a keyboard key or controller button, and tell it to increment/decrement your value if the keys/buttons are being pressed.
If you insist on injecting at the instruction that handles your speed value, then you will need to filter out all of the unnecessary addresses.
EDIT:
Even further, all you really need are the address and pointers of three values: the speed, controller button #1 and controller button #2. You can inject your code at any instruction that is being accesses a couple of times per second - it can be any instruction in the game.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Sun Jul 14, 2013 4:44 pm Post subject: |
|
|
| shadowpt wrote: | | mgr.inz.Player wrote: | | Game name ? |
Sent you a PM. |
You can not change physic attributes (speed, acceleration, position) in multiplayer games. This data is kept at server.
You can change those if you own server/host machine.
_________________
|
|
| Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Sun Jul 14, 2013 4:47 pm Post subject: |
|
|
| mgr.inz.Player wrote: | | shadowpt wrote: | | mgr.inz.Player wrote: | | Game name ? |
Sent you a PM. |
You can not change physic attributes (speed, acceleration, position) in multiplayer games. This data is kept at server.
You can change those if you own server/host machine. |
But I can.. I actually did it, I even said it in the previous replies. I can effectively change the movement speed just by changing the value of the respective address. I sent my vehicle flying against a wall at 600mph when I used the multiplication suggestion of the forum admin.
And no, this isn't client side mistake, it is actually live movement manipulation because those are client-side in that game.
Isn't it possible to assemble a code which pops the value (xmm0 or xmm1, etc) out, multiplies by two and pops back in?
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 474
Joined: 09 May 2003 Posts: 25962 Location: The netherlands
|
Posted: Sun Jul 14, 2013 5:24 pm Post subject: |
|
|
If multiply by 3 goes too fast, then try something smaller, like 1.3 or 1.003
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Sun Jul 14, 2013 5:36 pm Post subject: |
|
|
| Dark Byte wrote: | | If multiply by 3 goes too fast, then try something smaller, like 1.3 or 1.003 |
I did but since it is a multiplication it will always end up scaling to huge numbers, just slower at start with a smaller number.
And I have checked, those opcodes are responsible for all the speed values of all the addresses that I am using so it will be way better if I just modify the xmm value and then the game takes that value to all the addresses directly. It would be way better this way, no more need to update a ton of addresses each time the game updates.
Can I do that? Like mov [eax+40],xmm0*2?
Or even using an assembly code that takes that value out, modifies and then puts it back in?
|
|
| Back to top |
|
 |
daspamer Grandmaster Cheater Supreme
Reputation: 54
Joined: 13 Sep 2011 Posts: 1588
|
Posted: Sun Jul 14, 2013 6:32 pm Post subject: |
|
|
You can write
to achieve xmm0 * 2.
_________________
I'm rusty and getting older, help me re-learn lua. |
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4196
|
Posted: Sun Jul 14, 2013 6:54 pm Post subject: |
|
|
| Yes, you don't need to multiply anything. You should listen to advice and let people help you instead of focusing all of your energy on something that obviously isn't working.
|
|
| Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Sun Jul 14, 2013 7:08 pm Post subject: |
|
|
| DaSpamer wrote: | You can write
to achieve xmm0 * 2. |
That looks so simple! But won't it cause problems when the EAX is not present? I can't try it now but once I do I will report back.
Also if I want to increase the speed can I use mul xmm0, 3? (I think mul is the multiplication opcode, hope I am not wrong)
@GNIREENIGNE
I don't understand what you mean by controllers or how to use them to achieve my result, my knowledge with CE is not that big, that is why I am trying to find help to make a simple speedhack.
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4196
|
Posted: Sun Jul 14, 2013 7:29 pm Post subject: |
|
|
| Anything that you do not understand, just ask. When you ask a specific question, you will get a specific answer...as you can see. However, sometimes it is better for us to ask questions to better determine what it is that you are trying to do because the approach that you think is correct may not be correct or ideal.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Jul 15, 2013 2:11 am Post subject: |
|
|
OK, I saw that example from twitch.tv
You must find out how to filter out other addresses.
First, try this:
1. find address with your current vehicle speed.
2. do "find out what access ...".
3. just below "instruction" column, in that empty space, right click and choose "check if found opcodes ...."
4. go to game drive for a while
5. window "the following opcodes ...." should fill with data
6. make screenshots of whole window. Resize that window. And be sure that count column is wide enough. So we can see all entries. (you can shrink bottom list)
BTW.
addss xmm0,xmm0
is the same as:
sub esp,04
mov [esp],(float)2.0
mulss xmm0,[esp]
add esp,04
movss [eax+30],xmm0
Yes, the first one is easier, but what if you want to multiply it by 1.5 ??
EDIT:
try this code:
| Code: | [ENABLE]
aobscan(aob,8B4640F30F104030F30F588694000000F30F114030F30F108698000000F30F584034F30F114034F30F10869C000000F30F584038F30F114038F30F1086A0000000F30F584040F30F114040F30F1086A4000000F30F584044F30F114044F30F1086A8000000F30F584048F30F1140486A30)
registersymbol(aob)
alloc(hack,1024)
label(retHere)
label(multiplyBy)
hack:
sub esp,10 // prepare space
movdqu [esp],xmm1 // store xmm1
movss xmm1,[multiplyBy] // get multiply factor
shufps xmm1,xmm1,00
movups xmm0,[esi+00000094] // get current delta
mulps xmm0,xmm1 // multiply delta by user factor
movdqu xmm1,[esp] // restore xmm1
add esp,10
movq [esi+00000094],xmm0 // store new delta
movhlps xmm0,xmm0
movss [esi+0000009C],xmm0
movss xmm0,[eax+30] //original code
jmp retHere
hack+100:
multiplyBy:
dd (float)1.5 // CHANGE THIS
aob+3:
jmp hack
retHere:
[DISABLE]
aob+3:
db F3 0F 10 40 30
unregistersymbol(aob)
dealloc(hack) |
_________________
|
|
| Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Mon Jul 15, 2013 5:44 am Post subject: |
|
|
Alright I tried the adss xmm0,xmm0 and it "freezed" that axis movement, basically it is taking the final value and replacing itself with it, this means that no other value is added to it or decreased.
I also tried the assembly suggestions with and without limiter
| Code: | [ENABLE]
//Speedhack
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
sub esp,04
mov [esp],(float)2.0
mulss xmm0,[esp]
add esp,04
movss [eax+30],xmm0
originalcode:
movss [eax+30],xmm0
exit:
jmp returnhere
"Phys_x86.dll"+1D7C55:
jmp newmem
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"Phys_x86.dll"+1D7C55:
movss [eax+30],xmm0
//Alt: db F3 0F11 40 30 |
For the following OPcodes:
| Code: | movss [eax+30],xmm0
addss xmm0,[esi+00000094]
and
movss xmm0,[eax+30] |
But no luck, everytime I altered the xmm0 it would just ramp up insanely fast and throw me against a wall.
I suspect these opcodes are final value only so no matter what I change it will always add up to itself, no matter what I do. I am still trying to find where the increase/decrease value is being added to that xmm0 but so far it is not going well, kinda lost between all these opcodes and most of them are not something that I understand (what they do, where they are pulling info from etc).
I also tried your last script example but when I run it it says "This address specifier (AOB+3) is not valid".
--------------------
I forgot to add, I also did the address filtering like you said but nothing came up, no other window or anything and I waited for quite a while.
Also here it is an extended view on the opcode functions related to those mentioned before
| Code: | push ebp
mov ebp,esp
sub esp,10
push esi
push edi
mov esi,ecx
call Phys_x86.dll+1D9B10
mov cl,[eax+00000548]
movzx edi,word ptr [esi+58]
mov dl,[ebp+14]
shr cl,03
and cl,01
mov [ebp-01],cl
cmp di,[esi+5A]
jne Phys_x86.dll+1D7B17
mov cl,[esi+5C]
shr cl,1
and cl,01
xor cl,dl
je Phys_x86.dll+1D7B19
mov cl,01
cmp byte ptr [esi+000000AC],00
jne Phys_x86.dll+1D7B44
test byte ptr [esi+5C],01
jne Phys_x86.dll+1D7CB4
cmp byte ptr [ebp+10],00
jne Phys_x86.dll+1D7B44
test cl,cl
je Phys_x86.dll+1D7CB4
cmp byte ptr [ebp-01],00
je Phys_x86.dll+1D7CB4
test dl,dl
je Phys_x86.dll+1D7B6F
or word ptr [esi+5C],02
cmp edi,01
jna Phys_x86.dll+1D7B78
cmp byte ptr [ebp-01],00
je Phys_x86.dll+1D7B78
movss xmm0,[Phys_x86.dll+2A0A04]
mov ecx,edi
xorps xmm1,xmm1
cvtsi2ss xmm1,ecx
divss xmm0,xmm1
jmp Phys_x86.dll+1D7B80
mov edx,0000FFFD
and [esi+5C],dx
movss xmm0,[Phys_x86.dll+2A0A04]
test byte ptr [esi+5C],01
movss xmm1,[esi+0000008C]
movss xmm4,[esi+7C]
movss xmm5,[esi+00000080]
movss xmm6,[esi+00000084]
movss xmm7,[esi+00000088]
movss [ebp-0C],xmm1
movss xmm1,[esi+00000090]
mulss xmm4,xmm0
mulss xmm5,xmm0
mulss xmm6,xmm0
movss [ebp-08],xmm1
jne Phys_x86.dll+1D7BEF
movss xmm2,[eax+18]
movss xmm3,[eax+1C]
movaps xmm1,xmm0
mulss xmm1,[eax+14]
mulss xmm2,xmm0
mulss xmm3,xmm0
addss xmm4,xmm1
addss xmm5,xmm2
addss xmm6,xmm3
xorps xmm0,xmm0
movss xmm1,[ebp-0C]
movss [esi+000000D0],xmm4
movss [esi+000000D4],xmm5
movss [esi+000000D8],xmm6
movss [esi+000000DC],xmm0
movss [esi+000000E4],xmm1
movss xmm1,[ebp-08]
movss [esi+000000E0],xmm7
movss [esi+000000E8],xmm1
movss [esi+000000EC],xmm0
test byte ptr [esi+000000AC],04
je Phys_x86.dll+1D7CB4
mov eax,[esi+40]
movss xmm0,[eax+30]
addss xmm0,[esi+00000094]
movss [eax+30],xmm0
movss xmm0,[esi+00000098]
addss xmm0,[eax+34]
movss [eax+34],xmm0
movss xmm0,[esi+0000009C]
addss xmm0,[eax+38]
movss [eax+38],xmm0
movss xmm0,[esi+000000A0]
addss xmm0,[eax+40]
movss [eax+40],xmm0
movss xmm0,[esi+000000A4]
addss xmm0,[eax+44]
movss [eax+44],xmm0
movss xmm0,[esi+000000A8]
addss xmm0,[eax+48]
movss [eax+48],xmm0
push 30
lea eax,[esi+7C]
push 00
push eax
call Phys_x86.dll+1EE980
mov dl,[esi+000000AC]
mov ax,[esi+58]
add esp,0C
shr dl,1
and dl,01
pop edi
mov [esi+000000AC],dl
mov [esi+5A],ax
pop esi
mov esp,ebp
pop ebp
ret 0010
|
PS: Added the entire function instead, thought it would be way bigger like the others I had analyzed but it was small compared to them.
Last edited by shadowpt on Mon Jul 15, 2013 5:58 am; edited 1 time in total |
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Jul 15, 2013 5:48 am Post subject: |
|
|
| shadowpt wrote: | I also tried your last script example but when I run it it says "This address specifier (AOB+3) is not valid".
|
CheatEngine 6.3
_________________
|
|
| Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Mon Jul 15, 2013 5:59 am Post subject: |
|
|
| mgr.inz.Player wrote: | | shadowpt wrote: | I also tried your last script example but when I run it it says "This address specifier (AOB+3) is not valid".
|
CheatEngine 6.3  |
That is the version that I am using. Also I went ahead and just added the entire function related to those opcodes if you want to check it.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Jul 15, 2013 6:04 am Post subject: |
|
|
Probably, you get it wrong.
Try this table:
1. open table
2. attach CE to game process
3. enable script
| Description: |
|
 Download |
| Filename: |
alterspeeddelta.CT |
| Filesize: |
1.37 KB |
| Downloaded: |
1455 Time(s) |
_________________
|
|
| Back to top |
|
 |
shadowpt Advanced Cheater
Reputation: 0
Joined: 04 Jun 2011 Posts: 82
|
Posted: Mon Jul 15, 2013 6:09 am Post subject: |
|
|
| mgr.inz.Player wrote: | Probably, you get it wrong.
Try this table:
1. open table
2. attach CE to game process
3. enable script |
Did exactly as you said and when I click to enable the script CE just stalls and then crashes.
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|