Cheat Engine

[Flux.]

Having fun with Hitman Absolution, and have found the AOB for focus can anyone help me with the code injection please.

User jungletek made a table which works, but when playing on later levels and harder difficulty's you start with zero focus, and if you use that table it freezes at zero, so i would like to make a table that first adds focus then freezes the added value if possible.

jungletek table -

[mgr.inz.Player]

[++METHOS]

I would first recommend checking to see if there is a better injection location (e.g. read vs. write). It may not matter - I do not know about this game.

[Kavvman]

[ENABLE]
aobscanmodule(Instinct,HMA.exe,8B C1 8B 4E 0C) // should be unique
label(isntny)
registersymbol(isntny)

Instinct:
isntny:
nop
nop


[DISABLE]
//code from here till the end of the code will be used to disable the cheat
isntny:
db 8B C1

unregistersymbol(isntny)

[Flux.]

@mgr.inz.Player Hi again, thanks for the reply, have just tested the code you posted and it says -
error in line 19 "HMA.exe"+60013B: the address specifier is not valid.
Also should i have left this line in -

[Kavvman]

Sure, all it does is nop this

// ---------- INJECTING HERE ----------
"HMA.exe"+600139: 8B C1 - mov eax,ecx
"HMA.exe"+60013B: 8B 4E 0C - mov ecx,[esi+0C]
// ---------- DONE INJECTING ----------
"HMA.exe"+60013E: 89 01 - mov [ecx],eax

So just write your desired value to [ecx] which is the address of focus.


[ENABLE]
aobscanmodule(Instinct,HMA.exe,8B C1 8B 4E 0C) // should be unique
alloc(newmem_focus,64)
label(return_focus)

label(isntny)
registersymbol(isntny)

newmem_focus:
mov eax,ecx
mov ecx,[esi+0C]
mov [ecx],(float)100
jmp return_focus

Instinct:
isntny:
jmp newmem_focus
return_focus:


[DISABLE]
//code from here till the end of the code will be used to disable the cheat
isntny:
db 8B C1 8B 4E 0C
unregistersymbol(isntny)

[Flux.]

@ViZZion Hi, i just tried the updated code, and it has no effect, strangely focus seems to work as normal, it adds and decreases as if the code wasn't active.
So i tried i this again

[++METHOS]

[mgr.inz.Player]

[Flux.]

@++METHOS Thank you for the reply, just looking to find a alternate code now (will post results soon)

@mgr.inz.Player My apologies, Sorry yeah, i meant to say last night but i was too tired, once i attached the process (no error) the code injected but it didn't add any focus when starting a level.

[Kavvman]

Oh okay then, i just pasted my old code for the trainer i made ages ago...not really sure what registers contain what.

But yeah do like METHOS suggested, maybe this place is only accessed when you decrease instinct or not a lot.

[Flux.]

@ViZZion Thanks for your help, the first code you gave works great so thank you for that.


A possible fix (maybe hopefully), after doing another search on the focus from scratch, one of the results was the actual value in hex that went up and down when the focus bar did, i think 48 was full, and it went down to 3f and then all the way to zero after use (changing this value had no effect in game) so using the debugger, here's what writing to this address -

First result popped up after a decrease -

[++METHOS]

Have you completed the CE tutorial? If not, I would recommend doing that first.

There is no use in writing any scripts until you are certain that you have the correct value. Test the value by changing it and/or freezing it, then play the game for a while to see if it sticks. Once you have confirmed that you are working with the correct value, you have two choices-

1. Right-click the value to see what is 'writing' to it.
2. Right-click the value to see what is 'accessing' it.

Try the second option to get a 'read' instruction - preferably one that is accessing the address constantly (every second). When the debugger window pops up to show you the instruction(s) that are accessing the address, right-click inside the window somewhere, and click on the option that checks to see if found opcodes access other addresses. Doing so, will show you if the instructions that populate the list are exclusive to your focus value, or, if they also access other addresses in addition to your focus value. If possible, return to game-play for a moment to see if anything changes, then return to the debugger window. If any of the instructions show a (1) next to them still, then you are probably good to proceed with using that for your injection point. Once chosen, write a script that will constantly set the focus value to full. From here, you can repeat your steps by choosing 'what writes' to the focus value, and nop'ing that instruction to avoid any possible fluctuations.

[Flux.]

@ ++METHOS Thanks for your help,

I thought i did find the correct value, its a 4 byte value that when you add it to your code list and check the box to activate, it freezes the focus and works fine.
After a restart of the game the address no longer worked, so i then did a pointer search and after the second round of searching within pointer results the search gave me nothing, so the address is dynamic, one more time i found the 4 byte focus value, then found what was writing to the address and created a AOB script which started this thread.

As to finding out what accesses the address, i followed your instructions, and checked to see if found opcodes access other addresses, by changing the focus (increase and decrease) a couple of times, the results i received are below -
7 results all with 1 next to them, could you please help in which to choose may be the correct value.

[++METHOS]

Any one of them.