Cheat Engine

crislivinitup · Cheat Engineer Reputation: 0 Joined: 08 Feb 2007 Posts: 19

I learned some stuff about assembly and gamehacking and I have been trying to make a trainer for titan quest. I have decided to go about hacking it in a very interesting way - though some of you may have seen it before, I haven't. To defeat DMA I have tried to find the base pointer however this was to no avail so I have a different approach:
first I found the address of xp by changing some values. Then I searched what writes to that value and came up with 009d80cb add [esi+34], eax.
Through other investigations I found that attribute points is stored at [ecx+38] and skill points at [ecx+3c]. I'm gonna organize it better to help you help me.
experience [esi+34] @ address 009d80cb
attribute pts [ecx+38]
skill pts. [ecx+3c]
in all cases, esi and ecx are the same value. the pointer. so I figure if I find esi for experience, I can add 38 to get to attribute points because attribute points are harder to modify to narrow a search.
What I've done is modify the code at 009d80cb to jump to a code cave and in the code cave I wrote the following:
add [esi+34],eax ; keep the original code there
mov [known address], esi
jmp 009d80ce ; the address where I need to return
the point of this cave was to write the value of the pointer to a location which is static and that I could find easily.
The problem is when I run this code the game crashes
HOWEVER
Mr. Dark Byte's Cheat Engine has an option in memory view that when you right click you can select "make page writable" from the drop down options. when I do this the trainer works fine. I want to know how this "make page writable" button works. I notice it changes the region size. If you could tell me I'd be very appreciate. The thing is that the trainer doesn't write the value of the pointer to the location, the program does by itself from the code I wrote and when it tries to do this the program will crash if this "make page writable" option has not been clicked. The trainer is for my father and he does not know how to use CE. I would like to make my trainer independent completely.

1. How can I mimic "make page writable" feature in my trainer?

2. Can I make my trainer allocate memory in a specific known location that I can write code to write to?

-Any help on this matter is greatly welcome and appreciated Smile

.

Dark Byte · Posted: Wed Feb 21, 2007 4:26 am Post subject:

is it a ce generated trainer or one written by yourself? (aa scripts support (fullacess(address) and alloc(xxx,xx))

for a self written trainer make use of virtualprotectex to make a memory region writable and even executable
and use virtualallocex to allocate a region of memory for your own code (don't forget to set it to executable)

crislivinitup · Cheat Engineer Reputation: 0 Joined: 08 Feb 2007 Posts: 19

one generated by ce.

anyway to mimic that button "make page writable"?

Dark Byte · Posted: Wed Feb 21, 2007 4:36 am Post subject:

let it execute a script with the line fullaccess(address)

also, I recommend using alloc(mycodecave,1024) instead of picking one out of memory yourself.

Dark Byte

Actually, I see your real problem

crislivinitup · Cheat Engineer Reputation: 0 Joined: 08 Feb 2007 Posts: 19

Dark Byte · Posted: Wed Feb 21, 2007 6:15 am Post subject:

it's part of ce's autoassembler language.
it makes the page writable.

and no, ce can not allocate memory at fixed addresses, it only gets random addresses.
I really recommend using the template for this though and use makewritable on 00400500 and make that your known address