Cheat Engine

[VaLatTex]

Hello everyone, script is attached

I'm trying to modify a Cheat Engine script for Warriors Orochi 3 Ultimate (PC STEAM).

The script currently increases animation speed, which also affects attack speed, movement speed, and overall action speed. However, it applies to both allies and enemies.

What I'm trying to achieve is having the speed increase affect only enemies, while leaving the player character and allies at their normal speed.

I've spent quite a bit of time researching and using Cheat Engine to scan for team/faction values or other relevant flags, but I haven't been able to find anything useful.

Has anyone knows how to identify enemy-only actor data or team/faction checks? Any advice on where to hook the code or what structures/registers I should be looking for would be greatly appreciated.[/u]

i can't post the attachment but here is the script below
[ENABLE]
alloc(newmem,2048,"WO3U.exe"+A5CF0)
alloc(newmem2,2048,"WO3U.exe"+DE90)

label(returnhere)
label(skipMod)
label(returnhere2)
label(skipMod2)

newmem:
push rax
push rbx
test r15,r15
je skipMod
movzx eax, byte ptr [r15+148]
cmp eax,1
je skipMod
mov ebx,3FB9999A
mov [r15+000000F4],ebx
skipMod:
pop rbx
pop rax
mov rax,[r15]
mov rcx,r15
jmp returnhere

newmem2:
push rax
push rbx
test rcx,rcx
je skipMod2
cmp rcx,10000
jl skipMod2
movzx eax, byte ptr [rcx+148]
cmp eax,1
je skipMod2
mov ebx,3FB9999A
mov [rcx+000000F4],ebx
skipMod2:
pop rbx
pop rax
db 40 53
sub rsp,20
jmp returnhere2

"WO3U.exe"+A5CF0:
jmp newmem
nop
returnhere:

"WO3U.exe"+DE90:
jmp newmem2
nop
returnhere2:

[DISABLE]
"WO3U.exe"+A5CF0:
mov rax,[r15]
mov rcx,r15
//Alt: db 49 8B 07 49 8B CF

"WO3U.exe"+DE90:
db 40 53 48 83 EC 20

dealloc(newmem)
dealloc(newmem2)

[ParkourPenguin]

That one script has 2 different code injections. Given that they write the same value (0x3FB9999A, or as a float, 1.45) to the same offset (+F4), they're probably accessing different instances of the same structure. You should look at both independently, but it's likely to be similar- i.e. if you can find something in the structure to differentiate player/ally from enemy in the first code injection, the same thing will probably work for the second.

Enable the script, go to the injection point (i.e. go to game.exe+A5CF0 in the disassembler, right click the `jmp` instruction at that address, and follow it), right click the instruction `mov [r15+000000F4],ebx`, and find out what addresses it accesses. Play the game for a little bit and some addresses should pop up.

Next could be the hard part. You have to somehow differentiate between which addresses you want to be affected and which ones you don't. Changing the values yourself and seeing what happens in-game might work, but given that the script is changing the value for you for all addresses, it should be disabled before trying to change the values. The game might also be continuously changing the value. In that case, I'd use Lua to set break-on-write hardware breakpoints on the addresses being written to and change the values in the callback. A "better" but more complicated solution is to modify the script to change the value written to the address depending on the address you're writing to.

You could select all the addresses the instruction accesses, right click them, open a new dissect data window with the addresses, and look around for something that might tell you what "kind" of structure it is (e.g. maybe a vtable pointer in the structure itself or in a pointer to another structure), but at that point, you're completely guessing which structures are the ones you want to change.

If you can differentiate which addresses you want to change and which ones you don't, select all the addresses corresponding to enemy structures, right click them -> Find commonalities between addresses -> Mark selection as group 1, and right click in the window -> Find commonalities between addresses -> Scan for commonalities. The remaining player/ally structures are the default "other" group. You could also select all player/ally structures and leave the enemies' structures as the default other group- the logic is simply inverted (e.g. `not (player or ally) <=> enemy; not enemy <=> player or ally`). In the commonality scanner window, there might be a register or something in the stack (rsp) you can use, but I'd go for the structure itself first (r15 in the first code injection, rcx in the second).

This opens the Structure Compare window. Do a new scan and see what turns up. You can look at the structures in a structure dissect window to maybe get a better idea of the data too. Note that the structure dissect window often guesses what the type of each value is, and often guesses wrong. You might need to adjust it yourself.

Once you have something you can use to differentiate player or ally from enemy, use that in the code injection. i.e. a `cmp` to check if it's an enemy or player/ally, then a `jcc` to `skipMod` to skip writing the modified value if it's not an enemy or a player/ally.

If this is your first time doing this, I'd strongly recommend trying step 9 of the tutorial first (main window, menu bar, Help -> Cheat Engine Tutorial (x86_64)). There are plenty of guides going over it. Most probably don't use the newer features like the commonality scanner, but you can experiment with that yourself.