| View previous topic :: View next topic |
| Author |
Message |
Traps
Cheater
![]() Reputation: 0
Joined: 26 Mar 2007
Posts: 35
|
 Posted: Wed Mar 28, 2007 12:00 am Post subject: Learning CE with Space Cadet Pinball on XP |
 |
|
I checked out the pinball tutorial as provided in the CE help file, and went through the ce tutorial.exe. I'm sorry but i'm confused. Everytime you launch the pinball program, the memory location for the # of remaining balls you have will change. How do I determine this memory location so I dont have to keep searching for it. I assume that I have to determine how far away from the starting position of the allocated memory this value is to be stored. I think thats called an offset??
I'm still reading through this forums wealth of information, and I think my answer may have something to do with understanding pointers better. But if anyone can give me a hint or a direct answer that would be great. It would help me continue to piece together this jigsaw puzzle.
Thanks! |
|
| Back to top |
|
 |
Labyrnth
Moderator
![]() Reputation: 10
Joined: 28 Nov 2006
Posts: 6300
|
| Posted: Wed Mar 28, 2007 12:52 am Post subject: |
|
|
Do the tutorials that came with CE, You will learn the basic concept and then go try it on PInBall.
Ill bet you get it then. |
|
| Back to top |
|
|
Traps
Cheater
![]() Reputation: 0
Joined: 26 Mar 2007
Posts: 35
|
| Posted: Wed Mar 28, 2007 7:41 am Post subject: Re: Learning CE with Space Cadet Pinball on XP |
|
|
| Traps wrote: | | I checked out the pinball tutorial as provided in the CE help file, and went through the ce tutorial.exe. |
I already did the tutorial.exe and followed the same steps.
If I close pinball and relaunch it, the pointer to the value I found for remaining balls changes.
What I did was........
1. Launch CE
2. Launch Pinball
3. Select Pinball as process to hack in CE
4. Started a new game in pinball
5. Searched for exact value of 3
6. Lost a ball, and did a next exact value search for 2
7. Found the address containing the remaining balls
8. Searched for the code that writes to this address
9. With the line of code that I found, I took the value in the register located between the [ and ] and did a new hex search for that value
10. With the address found I manually added a new pointer with that address and the offset(146 i think it was).
11. This gave me the pointer to the remaining balls. I froze the pointer, and then I wouldnt lose any balls.
12. However if i relaunched the pinball.exe, the pointer no longer shows the remaining balls, it is some ambiguous number
If I remember correctly this is exactly what happens........ |
|
| Back to top |
|
|
me
Grandmaster Cheater
 Reputation: 2
Joined: 24 Jun 2004
Posts: 733
Location: location location
|
| Posted: Wed Mar 28, 2007 9:54 am Post subject: |
|
|
the ball address for the static pointer is  01023638+146 offset
the score address for the static base pointer is 01023638+50 offset
so its the same static base pointer with different offsets
a simple trick with pinball is to press F2 to start a new game after you have found your first level pointers (there are lots usually found by the first hex search),
then the addresses you found in your HEX search that still show your balls adress are stable enough to scan for,
then choose an address that does not change and do another hex scan for that, untill you get to the static base pointer that shows the address in brackets like this
[01023638]
so it sounds like you found the first level pointer you just need to get the stable address that supplies the first pointer you found,
its useful to learn all this but remember for simple games like this just nopping the code does the job
_________________
|
|
| Back to top |
|
|
ravicus
Master Cheater
![]() Reputation: 0
Joined: 16 Dec 2006
Posts: 464
|
| Posted: Wed Mar 28, 2007 10:29 am Post subject: |
|
|
Or, If it works, you could find an AOB and use it.
That would take some time though.
PS. Why do you want to keep hacking pinball more than once? 
_________________
|
|
| Back to top |
|
|
me
Grandmaster Cheater
Reputation: 2
Joined: 24 Jun 2004
Posts: 733
Location: location location
|
| Posted: Wed Mar 28, 2007 10:50 am Post subject: |
|
|
| ravicus wrote: | Or, If it works, you could find an AOB and use it.
That would take some time though.
PS. Why do you want to keep hacking pinball more than once? |
he just wants to hack it to learn the basics,
then he try better games
_________________
|
|
| Back to top |
|
|
Labyrnth
Moderator
![]() Reputation: 10
Joined: 28 Nov 2006
Posts: 6300
|
| Posted: Wed Mar 28, 2007 5:47 pm Post subject: |
|
|
| Quote: | | 8. Searched for the code that writes to this address |
^ When you did this step you are at the pointer.
Some games you dont need to try and go any farther.
Try not to think to deep when doing this, you can see now you over did it  |
|
| Back to top |
|
|
Traps
Cheater
![]() Reputation: 0
Joined: 26 Mar 2007
Posts: 35
|
| Posted: Wed Mar 28, 2007 6:07 pm Post subject: |
|
|
| Labyrnth wrote: | | Quote: | | 8. Searched for the code that writes to this address |
^ When you did this step you are at the pointer.
Some games you dont need to try and go any farther.
Try not to think to deep when doing this, you can see now you over did it |
Well. When I reload the game, the pointer (p-> ???????) and value change. The value becomes some monstrous number, and the pointer address changes.
What I did to find the base pointer was
1. Found the address holding remaining balls
2. Found code that writes to that address
3. Did a hex search for the most likely pointer address as indicated in extra info
4. It found like 300 address's containing that value. At the bottom of the list were 2 green addresses. I manually added both of the addresses using the offset 146(again as indicated in extra info), and restarted the game. The one that showed the correct remaining balls is the one I kept, and now everytime I restart the game it shows the correct number of remaining nutz. I can change or freeze that value and it has the correct response in the game.
What does the green color of the address mean(in the found box) According to Me, I was supposed to find brackets ( [ ] ) around the address.....???? |
|
| Back to top |
|
|
AnthraX1
Advanced Cheater
![]() Reputation: 0
Joined: 07 Nov 2006
Posts: 51
|
| Posted: Wed Mar 28, 2007 6:09 pm Post subject: |
|
|
alt+f4
_________________
CAn SOMEONE PLESE TEECH ME Hw To HcK I figured out how o donwlad Ceat Egnegine I just can't oPen it! I GET A SYSTEM 43 ERROR IT ANNOYING HELP! |
|
| Back to top |
|
|
Labyrnth
Moderator
![]() Reputation: 10
Joined: 28 Nov 2006
Posts: 6300
|
| Posted: Wed Mar 28, 2007 6:33 pm Post subject: |
|
|
| Quote: | | 2. Found code that writes to that address |
Thats it stop there, you found what you need Traps.
You are trying to over hack pinball. You dont need anything after this...
Here it is:
You can nop it and it will freeze the balls:
Or you can do a injection to give you more balls:
Jumping to the cave:
Code in the cave and jumping back to the original game code:
Anthrax what the hell are you doing? "Make that a option on a trainer"
Last edited by Labyrnth on Wed Mar 28, 2007 6:39 pm; edited 1 time in total |
|
| Back to top |
|
|
Traps
Cheater
![]() Reputation: 0
Joined: 26 Mar 2007
Posts: 35
|
| Posted: Wed Mar 28, 2007 6:35 pm Post subject: |
|
|
cd /
su
rm -r
| Labyrnth wrote: | | Quote: | | 2. Found code that writes to that address |
Thats it stop there, you found what you need Traps.
You are trying to over hack pinball. You dont need anything after this...
Here it is:
|
Thank you for your intelligent response. I have nooped it and injected code to increment +1, and both worked fine(not too sure about that code cave example). I was just trying to find the memory location that never changes. For practice to make a permanent hack.
I dont want to ask too many questions cuz I dont wanna get the response, "research it yourself". But everytime someone has answered me(and thank you btw) It brings more questions to my mind(which is a good thing)
Like this one.........
If I nooped it or injected my own ASM, would these a permanent hack? You know even if I restarted pinball? Assuming of course I somehow use CE to save the code injection, and reload CE if i wanna use the hax. Or would the memory location for the code change upon reload of the game, rendering the injection useless.(This I can test myself, just giving you an idea of where my brain is right now...... ) I hope you can follow what I just said. Dont know enough yet, to explain my thoughts according to your terms.
Still curious about the green color in the found box. |
|
| Back to top |
|
|
Labyrnth
Moderator
![]() Reputation: 10
Joined: 28 Nov 2006
Posts: 6300
|
| Posted: Wed Mar 28, 2007 7:38 pm Post subject: |
|
|
You dont have to nop it to do a injection.
Just do the nop or the injection [Not both], The injection i have shown is pushing 99 balls to eax.
eax holds the value of the balls.
mov eax,63
63 in hex = 99 in dec
===============================================
Now for it being permanent you can do the injection and then from the code list, patch the exe and it will be permanent.
Or you can make a trainer to poke the injection. |
|
| Back to top |
|
|
Traps
Cheater
![]() Reputation: 0
Joined: 26 Mar 2007
Posts: 35
|
| Posted: Wed Mar 28, 2007 8:11 pm Post subject: |
|
|
| Labyrnth wrote: | You dont have to nop it to do a injection.
Just do the nop or the injection [Not both], The injection i have shown is pushing 99 balls to eax.
eax holds the value of the balls.
mov eax,63
63 in hex = 99 in dec
===============================================
Now for it being permanent you can do the injection and then from the code list, patch the exe and it will be permanent.
Or you can make a trainer to poke the injection. |
Hehe... I understand. I guess I didnt explain it well enough. I've done a nop, and halted the decrement of remaining balls. I've done a code injection which also has halted the decrement of balls. Both done on seperate hack attempts.
Upon further testing I am unable to duplicate the problem when the initial pointer I found would not show the correct value for remaining balls(when pinball.exe was reloaded). I c now that you guys were correct(not that I ever doubted) I did not have to go any further to obtain an address for a perm hack(which I could use tmk or a vb6(cuz thats all I know) to make a trainer.
What are these green numbers in the found box.....LOL.... I GOTTA KNOW WHAT THE GREEN ADDRESS MEANS......
 |
|
| Back to top |
|
|
Labyrnth
Moderator
![]() Reputation: 10
Joined: 28 Nov 2006
Posts: 6300
|
| Posted: Wed Mar 28, 2007 8:15 pm Post subject: |
|
|
Those are static address's
But allot of the time those are display address's. Like what you see in games.
CE can make trainers too  |
|
| Back to top |
|
|
Traps
Cheater
![]() Reputation: 0
Joined: 26 Mar 2007
Posts: 35
|
| Posted: Wed Mar 28, 2007 9:01 pm Post subject: |
|
|
Just made a pinball trainer using CE, thanks labyrnth. I'd rep you but I dont see any buttons that let me do it.
Now i'm gonna try hacking diablo 2. I've used tsearch in the past to hack the level of your abilities, and the bonus points that you get to add to your attributes. But I havent figured out how to hack the life so that it never goes down. There doesnt seem to be any memory locations that hold the value of your life. Its as if the value displayed in the game is a represented as a calculation instead of the results of a calculation
Example
Display a+b+c ' a calculation of various attributes which equal your current health
as opposed to .....
Display z ' where z is your current health |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
