Cheat Engine

LongBeardedLion

I always wanted to use Ultimap but i cant.
So i found about Code Filter.

Unfortunately, it is not working either. It normally returns 0 values, or it simply crashes. Sad

.

I did exactly what he does in this tutorial:

https://www.youtube.com/watch?v=csrU18C4rWY

Used the From unwind info.

Is there any other option to make this work?

I dont know what to do. Maybe it doesnt work in my pc?

Dark Byte · Posted: Wed Jan 13, 2021 8:09 am Post subject:

Do you get 0 addresses when you get the unwind info or when doing things like has been executed/has not been executed ?

The unwind info data is only available on 64-bit targets and for the other methods you will need to go with trial and error in combination of enabling handling of unhandled exceptions so you can figure out which entries are at invalid code addresses

Besides that, it could be the game is problematic. Can you use the normal windows debugger interface?

Also, which module did you use to filter? E.g if system DLL's, DO NOT use VEH debug

LongBeardedLion · Posted: Wed Jan 13, 2021 9:49 am Post subject:

Thank you.

Yes its a old game. Age of Empires 2. So thats probably not gonna work. But i also tried using on the CE tutorial and it didnt work. It crashed a few times and it gave 0 results many others times. Using unwind.

I tried all 4 options and the Launch.
Is there any problem? Can i ruin the .exe doing this?

Dark Byte · Posted: Wed Jan 13, 2021 11:04 am Post subject:

If it's 32-bit (The instructions use eax,ebx, ecx, ... instead of rax,rbx,rcx in instructions that have brackets) , then you have to provide it a list of addresses yourself that are on instruction starts only. The disassembler is ok, but it's not 100% and can end up in the middle of an instruction. And if it's going to place a int3 bp, it will change the instruction instead of making it break.
Oh, and does this game have integrity check protection? If so, that'll cause it to crash/detect as well

As for the tutorial, there are 2 versions of the tutorial. Have you tried the 64-bit one, with just unwind info?

And it's pretty much impossible you can ruin the .exe. At most you can make the .exe difficult to load if you use kernelmode routines, and forced overwrite protection disabled but that's fixable by rebooting, and let's just assume you didn't do that to begin with