 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
caval How do I cheat?
Reputation: 0
Joined: 14 Sep 2023 Posts: 8
|
Posted: Thu Sep 14, 2023 12:56 pm Post subject: knowing addresses, find the array of pointer to these |
|
|
Hello,
I am a dev, but new to memory reading with CE.
I am looking for the entity list, the list of combat enemy.
Tweaking in-game with enemy health, I have found they share a similar structure, but looking at their base address, I dont see the the "contiguous array pattern".
So the enemies are not stored next to each other.
Now, I have the assumption that a list exists where I could find the pointer to each one of these known address.
How could I scan for that ?
Maybe I can memory dump, and scan for regex pattern having all those address ? Or maybe CE has some feature that resemble my need
|
|
Back to top |
|
 |
caval How do I cheat?
Reputation: 0
Joined: 14 Sep 2023 Posts: 8
|
Posted: Sat Sep 16, 2023 8:18 pm Post subject: |
|
|
Actually, I think the best way to solve this problem is:
find a combat against a single enemy.
find the address that the game writes to when enemy health decreases.
Pointer scan for "object's base address enemy + health offset"
and then, I assume that for next multi-enemy fights, This pointer should point to the first enemy of any other combat
I tried this but...
I do not get a single relevant viable pointer: when restarting games, they seem dead.
Weird because I have a viable main character pointer health though, alongside other main character combat infos. There might some weird game logic where base enemy pointer might change based on random stuff, maybve some obfuscation technique idk.
I thought about an idea. Since I know the structure of objects,
What if I could have some kind of hook to catch newly created instances of object based on specific offsets to which there are specific values I can predict ?
Therefore, since I know when enemies objects are instantiated, i could catch their instanciation somehow ?
That would be awesome. Maybe this usecase is very specific though
|
|
Back to top |
|
 |
CassiOwOpeia Newbie cheater
Reputation: 0
Joined: 29 Nov 2018 Posts: 18 Location: France
|
Posted: Sat Sep 16, 2023 11:31 pm Post subject: |
|
|
You should look at the pointers manually.
You've found the enemy health address : look at the instructions that write to this address. You could find either something like :
Code: | sub [ebx+000007C0],eax // example from the tutorial
mov [ebx+000007C0],eax |
So on the model :
Code: | sub/mov/add/etc. [register+offset], something |
In rare case the offset could be 0.
When you've found your instruction, save the value of the register and the offset. Then search for the value you've found in the register (of course if it's an address think to check the HEX checkbox, or put a "0x" in front of the address). And then do the same thing as first : look what instructions write to the address, save register value and offset; and after 3 to 4 times doing this, do the same thing with another enemy, and compare the offset. You should restart this with the player or something else than an enemy and compare again.
You should find, but not always the case, something like :
Last offset (the first you've found, as we are working in reverse) should be the same for everyone, or for every enemy, it can be the offset to health.
Before the last offset (the second) should be some array, or many other things.
(the third) could be a pointer to player or enemy array, etc.
You could try to use Cheat Engine on Unity Games, because they use Mono, and Cheat Engine have a Mono dissector. This is interesting because when you are working with structures, it gives us some semantic to work with.
Also, when you stop to do the steps above, you should take the last address you've found, go to the Memory View > Tools > Dissect data/structures > Put the address you've found and Structures > Define new structure. Once you're here, just go at the different offsets you've found (in that case, there will be name to the values because of Mono dissector if you're doing this on an Unity Game).
|
|
Back to top |
|
 |
caval How do I cheat?
Reputation: 0
Joined: 14 Sep 2023 Posts: 8
|
Posted: Mon Sep 18, 2023 4:58 pm Post subject: |
|
|
thank you, figured out assembly degugging was the best way to go, with the data structure dissect its very good
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|