Cheat Engine

markwoo · How do I cheat? Reputation: 0 Joined: 28 Dec 2013 Posts: 6

I know that speed hack hooks most of the critical time functions like timeGetTime, GetTickCount, QueryPerformanceCounter and probably more. But why doesn't it speed up youtube videos? I haven't written a multimedia application myself but I have read about its internals in books and internet resources. It seems that most multimedia players including flash player should rely on these critical system time function to calculate frame rate. But for some reason Online Flash videos are unaffected by speed hack. Does anyone know why?

Rydian · Posted: Sat Dec 28, 2013 10:33 pm Post subject:

Are you able to speed hack ANY flash at all? Chrome, for example, denies the Flash process from having disk access, so normal speedhack won't work and you need to use some special method to get to to work (which IIRC was on the front page in the news section as a plugin example a while back).

markwoo · How do I cheat? Reputation: 0 Joined: 28 Dec 2013 Posts: 6

Dark Byte · Posted: Sun Dec 29, 2013 5:48 am Post subject:

Cheat engine's speedhack does not hook the clock functions. Programs that make use of the clock instead of the timecounters are not affected.
Also, stuff that is dependant on the vsync of the monitor are not affected. As they count the number of frames drawn, instead of the time passed since last draw

markwoo · How do I cheat? Reputation: 0 Joined: 28 Dec 2013 Posts: 6

Dark Byte · Posted: Sun Dec 29, 2013 6:14 am Post subject:

GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
NtQuerySystemTime

markwoo · How do I cheat? Reputation: 0 Joined: 28 Dec 2013 Posts: 6

Thanks for the tip. I will try if these functions work.

Dark Byte · Posted: Sun Dec 29, 2013 8:13 am Post subject:

Also don't forget about timers that trigger an wm_timer every interval
And with browser based stuff it's possible the browser sends a timertick to the flashplugin process. So both processes would need to be speedhacked

markwoo · How do I cheat? Reputation: 0 Joined: 28 Dec 2013 Posts: 6

Hi again, I am back from testing your advice. I have hooked all the system clock functions and the WM_TIMER functions such as SetTimer and etc but none of them seem to do the trick. I have notice that there is an undocumented library called ntdll.dll that has a counter called rtlqueryperformancecounter. Do you know if this function is different than the one in kernel32.dll? Could it be worth a try?

Chris12 · Posted: Tue Dec 31, 2013 12:19 am Post subject:

There's a software called "Api Monitor 2.0".
Try it to find out what api is used to measure time.

There is also the asm opcode RDTSC, but I'm fairly sure flash doesn't use it.

It has to be queryperformancecounter, SetTimer, NtQuerySystemTime or maybe even Sleep / SleepEx.

Try setting a breakpoint in every function and see if its called. If yes, hook it.
Maybe you missed a function...

Dark Byte · Posted: Tue Dec 31, 2013 6:15 am Post subject:

QueryPerformanceCounter is RtlQueryPerformanceCounter.
Resolving QueryPerformanceCounter ends up giving the same address as RtlQueryPerformanceCounter

markwoo · How do I cheat? Reputation: 0 Joined: 28 Dec 2013 Posts: 6

Does speed hack hook timeGetTime()? I dumped an injected dll called speedhack-i386.dll and found four functions. They are realGetTickCount, realQueryPerformanceCounter, speedhackversion_GetTickCount, and speedhackversion_QueryPerformanceCounter but timeGetTime is missing. Of course this doesn't necessarily mean timeGetTime() isn't hooked, but just to make sure I am wondering why it's left out and if it's indeed hooked.

From observing api calls made by Flash video on Firefox and chrome using API Monitor suggested by Chris, I think that flash video is using timeGetTime(). Suppose that timeGetTime is hooked, and I want 2x speed, does speedhack simply do "return timeGetTIme() * 2"?

Dark Byte · Posted: Fri Jan 03, 2014 6:30 am Post subject:

timeGetTime is hooked and redirected to speedhackversion_GetTickCount