Cheat Engine

ubiByte · Posted: Sat May 02, 2015 6:17 pm Post subject: AOB Script Issue

Hi, I have been reading so many tutorials in the tutorials section I am really starting to master cheating games, it's pretty awesome. Thanks to everyone who put up tutorials they have been extremely helpful.

There is one problem that I have run into however that I can't seem to figure out. Check out this code below, I am using this for infinite consumables which works fine but there's a problem with it.

justa_dude · Posted: Sat May 02, 2015 6:57 pm Post subject:

Read the variable (pointer to somewhere in the data segment for a global variable/static member, I'm pretty sure) into memory using a decorated (symbol/module) name for the address.

ubiByte · Posted: Sat May 02, 2015 7:05 pm Post subject:

I'm not quite sure what you mean, you want me to create a symbol for 033C385C? but that address will change every restart. Can you clarify please, I don't think I understood you right.

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5627

I guess

mov ecx,[033C385C]

is the original code and it's not necessary for your cheat, so you could try to change the point of code injection to not include this code.

And you can also try to look around in registers or stack to see if any of them contains this address (or an address close to this one). Eg if it happens that eax is always equal to the address you need, you can just replace this code with

mov ecx,[eax]

ubiByte · Posted: Sat May 02, 2015 7:45 pm Post subject:

Hey thanks Geri, I have tried replacing that piece of code but if I remove that the game crashes, it seems it needs to use that address, I'll give you the rest here.

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5627

What is above your code? You could shift the code injection to include the code you need and the code above it.
If that code is more suitable for an aob script.

ubiByte · Posted: Sat May 02, 2015 8:12 pm Post subject:

Above it is this:

Zanzer · Posted: Sat May 02, 2015 8:38 pm Post subject:

Since you're just NOP'ing the instruction:

ubiByte · Posted: Sat May 02, 2015 8:50 pm Post subject:

Zanzer · Posted: Sat May 02, 2015 8:54 pm Post subject:

ubiByte · Posted: Sat May 02, 2015 9:03 pm Post subject:

Geri · Moderator Reputation: 111 Joined: 05 Feb 2010 Posts: 5627

In this case, you could make a code injection to include

07BAE285 - 73 52 - jae 07BAE2D9
07BAE287 - 88 54 37 08 - mov [edi+esi+08],dl

instead.
But you have to change that relative jump to not be a static jump as CE compiles it. I have described everything for it in this tutorial:

http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles/507-aobscan-instruction

ubiByte · Posted: Sun May 03, 2015 11:40 am Post subject:

I've actually noticed something very interesting here, look at this:

aobscan(items, 88 54 37 08 8B 0D 5C 38 3C 03 8B 79 18 3B 77 04)

mov ecx,[033C385C]

I restarted the game several times just to make sure, and it is the case every single time. The 9th byte shown in the aobscan is always the one that gets replaced right after mov ecx, [03__385C]. Now my question is can I somehow copy the 9th byte and put it in that location in my script? If so how can I do something like this?

Zanzer · Posted: Sun May 03, 2015 1:56 pm Post subject:

readmem(items+8, 1)
Reads the [1] byte at the address [items+8] into your code wherever it is placed.

ubiByte · Posted: Sun May 03, 2015 2:32 pm Post subject: