 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
h3x1c Master Cheater
Reputation: 17
Joined: 27 Apr 2013 Posts: 306
|
Posted: Fri Jan 01, 2016 11:30 am Post subject: |
|
|
| Rydian wrote: | | I turned off the news feed in the launcher, that's what causes it. |
Ah, okay. I misunderstood your original comment to mean you used an older build that didn't have the issues of the newer one or something.
_________________
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Fri Jan 01, 2016 7:43 pm Post subject: |
|
|
Rydian's version of gamemaker is quite different from what I'm used to see, for example the ID at variable+0x10 aren't present so I guess we might have to restart from scratch for the next gamemaker version.
For now I'm going to focus on h3x1c's version, since it matches what I see in games atm.
In this version the string "getting variable oind=%d, varind=%d, arrind=%d - global=%08x(%d)(%d)" is present, referenced at CheatEngineSmallGame.exe+1185D1 and used if you set (byte)CheatEngineSmallGame.exe+5313BA to 1.
Health has varind=100000 (dec) and money 100001 so at least we now know that varind isn't hash-derived.
Does this 100000 have any correspondence in the editor, or is there an upper limit to the number of global variables?
I'd like to investigate the oind, arrind, and global stuff, so h3x1c, could you create a game like that:?
-2 classes (player and enemy) that do not inherit from each other.
-Player has health and money members, the enemy has level and health (declared in that order incase it matters).
-One instance of the player and 2 enemies, with buttons to change each member variable (just increasing is enough).
-Icing on the cake: one global variable plz (let's see if it has varind<100k).
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
 |
Rydian Grandmaster Cheater Supreme
Reputation: 31
Joined: 17 Sep 2012 Posts: 1358
|
Posted: Fri Jan 01, 2016 8:44 pm Post subject: |
|
|
Is it both versions or just the YYC that's different? The YYC version is supposedly compiled scripts and needed VS2012 to generate (which is why it was slower for me to post since god forbid an initial installer for something actually include the latest updates).
Then again I use the early access branch for testing things (it's quicker to adapt to library changes and junk) and it's hard to find an updated list of the actual differences.
_________________
|
|
| Back to top |
|
 |
AJarOfLube Newbie cheater
Reputation: 0
Joined: 30 Dec 2015 Posts: 12
|
Posted: Fri Jan 01, 2016 9:02 pm Post subject: |
|
|
Dang, GMS was on sale in an indie bundle a few weeks ago, I wish I had bought it now.
If anyone is interested, there is someone on SteamTrades dot com selling it for 18 keys (about $45), just search for "Play and Create with GameMaker"
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Fri Jan 01, 2016 9:22 pm Post subject: |
|
|
@Rydian: Both versions. Typically you have the varind (in the 100k+ range) 0x10 bytes after the double value, and I don't see it in the early access GMS, which puts zeroes there most of the time (also got junk(?) and a BAADB00B, ahem).
Looking up the stack (on the reader function) it would seem that local custom variable has varind 100002=186A2 (non-yyc ver), but I don't see it anywhere near the value itself.
On the yyc I don't see anything that looks like a varind on the stack.
BTW: there is stringref to "global variable %s(%d, %d) not set before reading it" at Hack Test(non-yyc).exe+10BF0F which is very close to the opcode that reads global variables. If we could grab that %s we should be able to do interesting stuff... with the globals.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
 |
FragrantRegard How do I cheat?
Reputation: 0
Joined: 01 Jan 2016 Posts: 4 Location: Seattle
|
Posted: Fri Jan 01, 2016 11:07 pm Post subject: |
|
|
I've been working with Spelunky to moderate success, actually, even despite my previous unfamiliarity with RAM editing, assembly, etc.
I found the line that sets initial HP, bombs, and rope, and created an autoassembler script to set it to a high value.
In Spelunky, whenever you save a damsel in a level and complete it, the health variable is incremented. I would modify it if I knew how to replace inc [eax] to addition without it breaking everything.
I've tried Risk of Rain, but it seems a lot of the variables are difficult to work with in the scan or otherwise unintuitive.
_________________
Working on spelunky hax |
|
| Back to top |
|
 |
pepsifresh How do I cheat?
Reputation: 0
Joined: 13 Nov 2016 Posts: 1
|
Posted: Sun Nov 13, 2016 3:43 pm Post subject: |
|
|
I spent my morning and made a tiny game with enemy zombies with money drops, two global variables, and a player with common local variables.
Because of my new status I cannot seem to attach files or post links to downloads, so if anyone is interested just pm me.
I would really love to see a solution to GameMaker Studio games before GameMaker Studio 2 comes out (as it's already in beta).
|
|
| Back to top |
|
 |
Creator256 How do I cheat?
Reputation: 0
Joined: 25 Mar 2017 Posts: 3
|
Posted: Wed Mar 29, 2017 3:13 pm Post subject: |
|
|
| Gniarf wrote: | Hotline miami 1.0: I've posted a godmode and ammo table on this forum. Basically the game's scripts were included in text form and compiled during the startup splash screen, I just did some text processing at that stage.
Hotline miami 1.1: vulnerability patched, pretty sure it's not even the same game engine as v1.0 .
Relic hunter 0: Also in gamemaker, I targeted the data.win file in which the variable names are present. If 2 variables have the same name then the engine thinks they are the same, so if a class has a variable named IsInvincible and another named CanMove and you rename one into the other you're basically in godmode as long as you can move... Unless IsInvincible is set to 0 after movement is enabled in which case you're target practice.
My colleagues (Bl00dWolf and deama1234) found out that the ID of a variable is stored as a dword 0x10 bytes after a its value. Unfortunately this ID changes with each patch.
12 better than 6 demo: I stumbled on the string "getting variable oind=%d, varind=%d, arrind=%d - global=%08x(%d)(%d)" so I went for the ID.
oind is variable+0x14 (object index?)
varind is variable+0x10 (same kind of ID as in relic hunter)
arrind is variable+0xC (array index)
This varind can also be found on the stack; when I hooked the fld qword [e**] that reads your variable, I had it at esp+0x24.
I don't know what game you're targeting but so far all the varinds I saw were in the 0x187** format... curious to know how much of a coincidence it is. |
I know this thread is extremely old, but I am hoping maybe you can explain something for me. For relic hunter 0, you said you target the data.win file and looked for the variables in there. How exactly did you target the file and look inside of it?
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|