Cheat Engine

Majin · Posted: Sun May 15, 2016 5:14 pm Post subject:

Wellp, there was no ruddy documentation at all.

So I made my first ever program, in Pascal using the Lazarus IDE, to do it for me. It works like a charm, but it'll crash if you try and repeat the process without restarting the program.

I'll edit this post and attach it when I figure out what the problem is. Gotta spread the love, after all.

Majin · Posted: Mon May 16, 2016 8:50 am Post subject:

The program's still crashy, but perfectly usable. Heh.

I've finally gotten the AI structure down, and me program was a huge help. TOOTIN' ME OWN HORN, I AM!

Now, I need to figure out how to add these addresses to the list. I couldn't find a way to add an address as an AOB Search (tick the box, does the search, modifies a list entry to use the new address). The .CT I attached earlier does the same thing.

ParkourPenguin · Posted: Mon May 16, 2016 11:09 am Post subject:

If there's more than one address that matches an AoB signature, you'll have to use Lua to find all of them.

Majin · Posted: Mon May 16, 2016 11:23 am Post subject:

It only returns one address, so no worries there. This is the AOB: 4E 50 43 5F 54 48 49 4E 4B 5F 50 41 52 41 4D 5F 53 54 00 20 20 20 20 20 20 20 20 20 20 20 20 20 00 02 00 00 00 00 00 00 80 16 00 00 C0 E6 00 00

After thinking for a wee bit, I think I'll be better off just making a big assembly script for each main "feature" I want to add, in regards to changing the global AI structure.

ParkourPenguin · Posted: Mon May 16, 2016 11:43 am Post subject:

Oh. In that case, you can get that with this:

Majin · Posted: Sun Jun 05, 2016 3:06 pm Post subject:

Went through some hardcore burnout, but I've gotten over most of it. Figured I'd try something fresh to avoid going right back to burnt out city-ville.

I've designed a really simple script to compare if an enemy has the model IDs c2410 and c2400, and if they do, set the health to 0 (kill them). However, the Auto Assembler doesn't like me comparing a qword. Am I missing something, or do we have to compare individual bytes? Utter pain if we have to.

Here's what I've got so far:

ParkourPenguin · Posted: Sun Jun 05, 2016 3:12 pm Post subject:

If you're attached to a 32-bit process, then the concept of a qword ptr doesn't exist in this context. Compare two dwords instead.

Majin · Posted: Sun Jun 05, 2016 3:21 pm Post subject:

ParkourPenguin · Posted: Sun Jun 05, 2016 3:30 pm Post subject:

Yeah, I forgot about that. Oops.

Anyways, what's with you modifying the stack so much?

Majin · Posted: Sun Jun 05, 2016 3:33 pm Post subject:

I think they're hold overs of the original script I used as a template; the Friendly Silver Knights scripts. Good catch.

EBX was because I was struck by inspiration to use a register to work around the qword thing, but promptly figured that wouldn't work, and forgot to remove it.

edit: pop ecx is in the original assembly code from the game, by the way.

Edit #IDon'tKnow: I had an idea. And it worked!

Just replace the code in the Friendly Knights script, and voila. It clears out the areas lickety split. Working code:

Majin · Posted: Mon Jun 06, 2016 8:52 pm Post subject:

Right, am I still unable to double post? Kinda need to be able to start a new train of discussion.

Is it possible to have to cheats enabled, that inject the same instruction? Or does that cause all sorts of buggery?

ParkourPenguin · Posted: Mon Jun 06, 2016 9:13 pm Post subject:

No. When you inject code to hook an instruction, you override the game's memory with a jump to your code, do stuff in your code, and then jump back past the jump you wrote so the game can continue. So, conceptually, it follows that one jump can only jump to one other place at any given time (not two), not to mention the fact that it would break the AoB scan.

If you can't combine the two scripts into one, then you can try to find another injection point close by. If you can't do that, then you can write a master script which hooks that instruction and jumps to a section of memory that contains jumps to other scripts. Here's a hypothetical example:

Cake-san · Posted: Mon Jun 06, 2016 9:56 pm Post subject:

You can also use call.

ParkourPenguin · Posted: Mon Jun 06, 2016 10:01 pm Post subject:

It's perfectly fine to use call. I'd probably prefer it in this case, but you have to worry about where the stack is at. This commonly confuses beginners since it could change what the original code is if it accesses esp (e.g. mov eax,[esp+28] would turn into mov eax,[esp+2C] if you called your code to run).

Majin · Posted: Tue Jun 07, 2016 3:48 am Post subject:

...Alrighty, that sounds above me paygrade here.

I'll stick to having just one big ol' script with comments to keep things tidy. Don't want to go straight into nitty gritty pro-level stuff right the now.

That being said, the script I've made for auto-killing enemies is getting a tad on the larger side, so I figure I should spend a bit of time optimizing the script, though I've no idea how, as it looks pretty decent as-is.

One thing I read about is the usage of SSE registers. Supposedly, an SSE instruction is around 2x faster than it's equivalent x87 instruction. Or was that SSE2 being 2x fast? I forget.

Would just chucking in the SSE equivalent of esi give a notable boost, or nah? Seems like that'd be an easy optimization, if it will.

Also, where can I find documentation about the uses of registers? Further back in the thread I was informed that ESI can't be used as a general purpose register (like EBX is), contrary to one of me sources; me source was wrong in that scenario.

So knowing what registers can be used for would be dandy. For example, is EAX used only for 'fast & temporary' code, such as a mathematical function?