Cheat Engine

[++METHOS]

Not saying that this is the case, but on older games (e.g. NES), timers were often broke apart. For example, a timer of 1 minute, 42 seconds:

1:42

Each number might have its own timer. So, in the above example, you may have 3 different timers going. If you wanted to lock the timer, you could search for 2 (for seconds), then 1, then 0, then 9, then 8 etc. Locking the seconds value would lock the entire timer.

Not saying that your game is similar, but it is good to consider all possibilities.

[Skull Kid]

++METHOS: Thanks for your help, I do really appreciate it

This game came out back i 2001, and is Robot Wars Arenas of Destruction. A game based on the British TV Show Robot Wars.

[mgr.inz.Player]

"countdown timer" or "Stopwatch timer" can be programmed in many ways.

Value an be:

integer:
- 1byte
- 2byte (16bit, word)
- 4byte (32bit, double word)
- 8byte (64bit, quad word)
- 16byte (128bit, octaword, double quadword)

floating point:
- single precision floating point value (32bit, float, single)
- double precision floating point value (64bit, double, real)
- extended, floating point value (80bit)

even string:
- the time is kept as string, every cycle this string is converted to numerical type, processed, and converted back to string


For example, in assassin's creed series, many people didn't found countdown timer. They tried cheat engine "value type:all" without success. For that one timer, there are 100+ addresses which contain countdown timer value as single precision floating point (total seconds left), few as truncated sp-fp, and few 4byte integer. None of them were right. All of them were only: onscreen or temporary.

Actually, countdown and stopwatch timers for this game are build this way:
Two 8byte integers. One second is 30000.

While initializing:
- stopwatch: value1 = systemtime, value2 = systemtime
- countdown: value1 = systemtime, value2 = systemtime + 30000*startingTimerValueInSeconds

For "stopwatch" you see 00:00.00 on screen. For "countdown" you see 00:45.00 on screen (just an example).


Every cycle:
- stopwatch: value2 = systemtime, onscreenstring = converttohumanreadabletime( (value2 - value1)/30000 )
- countdown: value1 = systemtime, onscreenstring = converttohumanreadabletime( (value2 - value1)/30000 )

(Other games can use: kernel32.GetSystemTime or kernel32.GetSystemTimeAsFileTime or other API)


So, timer can be:
- ANY TYPE

- one value increasing (or decreasing) from 0(or some non zero value) up to (down to) some non zero value (or zero).

- two values (two integers, or two floating point). Both are initialized. Only one is changing every cycle. Every cycle there is calculated difference, and it is converted to other type. At the end, it is converted to string or progress bar width, or arrow angle, or sand, or .... whatever.

- three, four or even more

and of course, there are many temporary values.



A question. If you use speedhack and set speed to 0.5, does the timer slow down for you?

 

[Skull Kid]

mgr.inz.Player: Yes, the timer slows down with speedhack enabled.

[mgr.inz.Player]

So, it probably don't use kernel32.GetSystemTime or kernel32.GetSystemTimeAsFileTime (or similar) for timers.


The only option you can try is:
find visual (on screen) address, do "...what writes...", and trace back to the "timer cycle". Not an easy task. Sometimes, if you are lucky, it is just caller function, or callers caller function, you just break on "onwrite", then "execute till return" one or few times.

[Skull Kid]

[mgr.inz.Player]

"it shouldn't be that difficult"
I don't know. For example, knives quantity in AC2 and AC:B isn't simple value, it is an "object with list". It took me some time to develop fully working "infinite knives" cheat, without side effects.

So, it depends on:
- compiled code: is it native? is it bytecode? Managed? Non-managed?
- compilator itself
- compilator settings (optimizations)
- programmer (developer) wicked mind

[Skull Kid]

Well... this sounds a bit cryptic to me. I think I will have to realize that it's too much of a task to freeze the countdown timer in this game.

[mgr.inz.Player]

I thought you asked about "tracing". It's easier if code is native, Non-managed and without optimizations. Of course, programmer can make things hard.


Timers can be (as I wrote earlier) any type. Easy - only one value. Or more complicated - two or more values combined.

[Skull Kid]

I see. Well I suppose it's seconds with milliseconds after. A float value probably, like "14.1243453465342" for example, where 14 are the seconds and 1243453 etc. are the milliseconds.

[mgr.inz.Player]

Again, I will use AC:B stopwatch timer as an example:

timer is: two 8byte integers combined.

lets say, after playing a while it is:
value1 = 0x0000000264866386 (10276463494)
value2 = 0x0000000264976E6C (10277580396)

Every cycle:
difference:
(value2 - value1) = 1116902

convert it to float, and divide by 30000.0:
1116902.0 / 30000.0 = 37.23006(6)

truncate not needed part:
trunc(37.23006(6) * 100 ) / 100 = 37.23

push this value to "show on screen queue"


Another function:
will read that value, convert it to human readable string, then show on screen:
you will see: "00:37.23"

for example, if value (after calculations mentioned earlier) is 95.33 you will see: "01:35.33"

[Skull Kid]

Hmm. I could maybe take dumps of my screen when I try to find it? So that you get a clear picture of what's going on.

EDIT: I'm afraid I don't understand what you meant with that example... as I am just a basic Cheat Engine user, but certainly not a pro or veteran :/

[mgr.inz.Player]

@Skull Kid, you still here?

I installed this game, I found "timer function" and deleted this game right after.


Explanation:

Here you can read about ticks:
http://stackoverflow.com/questions/1739259/how-to-use-queryperformancecounter

QueryPerformanceCounter function returns integer value.



countdown timer initialization:
One address will keep:
TicksStart = QueryPerformanceCounter()

There's an another address which keeps total milliseconds you will have. For example if countdown starts from 40:00 (40 seconds) this 4-byte value will be 40000.

millisecondsAvailable = 40000


1. so, every cycle game gets processor elapsed ticks like this
ticksElapsed = QueryPerformanceCounter() - TicksStart

2. it converts ticksElapsed to millisecondsElapsed (float value) (depends on CPU frequency)

3. it performs simple:
millisecondsLeft = tofloat( 40000 - millisecondsElapsed )

then it changes unit from "millisecond" to "one hundredth of a second"

oneHundredthOfSecondsLeft = tointeger( millisecondsLeft / 10 )

4. oneHundredthOfSecondsLeft is converted to "human readable string", that is: text you see on screen

My hack:
my timer freeze hack is very easy, I just inject code before step 2. (I force ticksElapsed to be always 0)






How you can find it (do some tutorials first, my little suggestion):
set cheat engine hotkeys for speedhack, I am using ctrl+num7 for "speedhack speed to 0.01" and ctrl+num8 for "speedhack speed to 1.00"

start game, load challenge (so you will see timer), press ctrl+num7, look at current time, do alt-tab and quickly do this:

remembered time for example is 34:73 (34 seconds and 73/100 of seconds )

do first scan, value type: 4byte, scan type: between, left value 3400, right value 3500

back to game, ctrl+num8 (normal game speed), wait few seconds, press ctrl+num7, look at current time, do alt-tab and now (24:98 ):

next scan, value type: 4byte, scan type: between, left value 2400, right value 2500

add found address to table, do "... what writes ..."

you will find address of instruction which writes new values, highlight it, click "more information", click "S" button,
double click fourth entry,

you will land on "fild dword ptr [esi+1C]'
go up, until you will see bunch of NOPs. you will see two "call", after the second call there will be:
mov [esp+08],eax



you can do code injection here, for me, injection code looks something like this:

[Skull Kid]

mgr.inz.Player: I can't tell you how grateful I am, thanks a infinite times!

[mgr.inz.Player]

Above AA script works for you? Just curious.