Cheat Engine

47iscool · Cheater Reputation: 0 Joined: 15 Apr 2014 Posts: 34

Errare humanum est.

That part I don't understand.

Also if you don't mind I'd like to post this at the Dolphin forums.

mgr.inz.Player · Posted: Sun Apr 20, 2014 5:20 pm Post subject:

"Errare humanum est". Just use google Very Happy

"Also if you don't mind I'd like to post this at the Dolphin forums."
no problem

47iscool · Cheater Reputation: 0 Joined: 15 Apr 2014 Posts: 34

This address here on SA2B 800637EC that you posted, I got the same one with only putting a write BP on the rings address. From my experience write BP's work better than read in most cases.

This game and SADX are different in how they handle rings, picking up a ring and losing them gives their own address each. Do you think it mught be possible to make a code on SA2B where you can pick up rings but not lose them when you get hit? I've barely any experience with PPC so maybe you could give me some advice if you don't mind. Very Happy

So, this is the meaning eh?

to err is human; to persist is of the Devil

mgr.inz.Player · Posted: Mon Apr 21, 2014 5:41 am Post subject:

To summarize tutorial (both parts):

- launch Dolphin in debug mode

- we have to look for PC register. PC register works the same as EIP/RIP register for PC. It is "instruction pointer register".

- to find it, just do:
a) Dolphin - Pause game, check PC register (registers tab), copy value kept in that register
b) CE - do new scan for that value (4-byte, exact, hex)
c) Dolphin - unpause the game, and pause it again, copy PC register value
d) CE - do next scan.
e) repeat c and d until you find correct address (which keeps value from PC register). The first "green address" would be the correct one. Add that address to table, name it "Dolphin GC - PC register".

- with CE, find rings address and add it to table. Set breakpoint: "break on access" (or "break on write")
- how to set breakpoint? Highlight "rings", press CTRL+B, MemoryView window will show up. In HexView part (bottom part of MemoryView window) right click the first byte and choose: "Data Breakpoint -> Break on ..."

- Dolphin - do something in game. It should freeze

- in CE - this "Dolphin GC - PC register" points to code block where our instruction is (instruction that reads or writes rings value). Accuracy depends on chosen "Dual Core", "CPU emulator engine", and probably other settings, maybe even other things such as PC configuration. It can point one instruction before or 5 to 50 instructions before the instruction we are looking.

- CE - remove breakpoint

To get exact "Dolphin GC - PC register" value while rings is accessed (read or write), and that means instruction we are looking for:

- Dolphin - add breakpoint (click +BP button), and paste "Dolphin GC - PC register" value you got earlier. Do something in game, it should freeze.

- CE - set "break on ....." breakpoint.

- be sure to have both windows visible: Dolphin window (where "STEP" button is) and CE "Memory Viewer" window.

- "Memory Viewer" window caption should be: "Memory Viewer" or "Memory Viewer - Running"

- now, click "STEP" button, look at "Memory Viewer" window caption.

- if it changes to "Memory Viewer - Currently debugging thread ....", look at "Dolphin GC - PC register", it exactly points to instruction we are looking for. Alternatively, just look at highlighted instruction in Dolphin ("Code" tab)

- if not, click step button again, and again, and again, ....

47iscool · Cheater Reputation: 0 Joined: 15 Apr 2014 Posts: 34

Step 6 fixed

mgr.inz.Player · Posted: Mon Apr 21, 2014 10:59 am Post subject:

Lets analyze whole thing again
Code which updates our rings value:
80063814: lha r29, 0x0068 (r31) -- load rings (from memory pointed by R31+0x68) into R29
80063818: add r0, r29, r4 -- sum R29 and R4, store result in R0. R4 can have positive and negative values
8006381c: sth r0, 0x0068 (r31) -- move value from R0 into memory pointed by R31+0x68

As you see, R4 is our modificator. If look up, there is no R4 register being used.
So, it must be function argument. If we look at "callstack", there are two different callers.

When we do "break on write":
- 8123e490 when collecting one ring
- 8123e884 when we loose all rings

Lets go there, and look for R4 register. Fortunatly for us, it is close to caller.

When gaining one ring:

47iscool · Cheater Reputation: 0 Joined: 15 Apr 2014 Posts: 34

Thanks for taking the time to help me with all this.

I have gotten this: 04063828 2C00FFFF

The first ring you pick up gives you 999 and when you get hit by an enemy you still have 999. It also works for the last Boss Fight.

I also seen that one on the boss fight, I was wondering if I had to add 05 to the start of codes that start 81. Thanks for confirming that.

There is also another which removes your rings when you go to another level This code fixes that:

Keep Rings Between Levels
04064330 60000000

By the way 0523e87c 38800000 isn't working, maybe it's Dolphin? Or maybe I have to keep looking.

mgr.inz.Player · Posted: Mon Apr 21, 2014 12:38 pm Post subject:

47iscool · Cheater Reputation: 0 Joined: 15 Apr 2014 Posts: 34

The PC register method works on more than just Dolphin. This method also works with Gens Kmod.

I'm betting it would work with PJ64 too, gonna try it next.

mgr.inz.Player · Posted: Wed Apr 23, 2014 4:18 pm Post subject:

I'm glad to help.

47iscool · Cheater Reputation: 0 Joined: 15 Apr 2014 Posts: 34

rijji76 · How do I cheat? Reputation: 0 Joined: 17 Jul 2013 Posts: 3

I have a problem
Cheat engine does give me the instruction who is writing to a specific memory in dolphin, but it's not freezing the dolphin process(dolphin emu continues running)
What could be the problem?

Game in question is Biohazard 2
let's say i have 22 bullets, i fire one bullet cheat engine gives me the instruction who decreased the ammo value(in the breakpoint window), but dolphin process still running

mgr.inz.Player · Posted: Sat Jul 19, 2014 6:11 am Post subject: