Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Swapping values / addresses?
Goto page Previous  1, 2, 3, 4  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Wed Nov 28, 2012 12:33 pm    Post subject: Reply with quote

Alright cool!

I just tried it again and it seems a bit more complicated.

I swapped between those two cars, tried to do as many actions as possible (crashing/doing damage, leaving area, using nitrous etc.) so get rid of as many values/addresses as possible.

I don't know what I had done earlier to only get those two values, but now I'm stuck with around a thousand values. They all seem to be linked to the vehicle: I swapped the vehicle and instead of searching for a changed value, I searched for an unchanged value. The result: 0 found.

Bad sign right?
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Wed Nov 28, 2012 12:49 pm    Post subject: Reply with quote

Leaving area? Bad move, very often when you change maps or get a loading screen your values in memory get shuffled around.

If I were you I'd do my scans without leaving the garage.

Ozzy25 wrote:
I swapped the vehicle and instead of searching for a changed value, I searched for an unchanged value. The result: 0 found.
You swapped TWICE between filtering, right?
if not: there is an "undo scan" button...
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Wed Nov 28, 2012 12:55 pm    Post subject: Reply with quote

Wow I never thought of that, I loaded the car every time and then drove around and did all kinds of stuff. Perhaps I should do it again while staying in the garage.

But why by the way? I mean the value for the car should stay the same.

I didn't really change map, I just went far away from the starting point. (Ok, not really. Like 1 minute haha)

No I swapped once, to another vehicle, and did this search on purpose to find out if these values were actually linked to the vehicle or not!

I've now decided to select some other cars and every 2nd car I return to the car I started with / the first car basically, with which I made my first scan. I don't manage to loose any values unless I change car, so far only 108 values left.

After that I'll try doing this in the garage!
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Wed Nov 28, 2012 1:14 pm    Post subject: Reply with quote

Ozzy25 wrote:
But why by the way? I mean the value for the car should stay the same.
The value is the same, but it's not at the same place.
When you enter the garage (or whatever allows you to change cars), the game allocates memory for the car selection screen, which holds the currently selected car. When you validate your car choice, the game reads the variable that holds the currently selected car, spawns this vehicle and frees ("deletes" if you wish) all the memory allocated for the selection screen.
When you re-enter the garage, the game reallocates memory for the car selection screen, but not at the same address (per Windows design).

That, of course depends on how the game is made; in a shit coded game the garage could very well never be freed from memory.
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Wed Nov 28, 2012 2:37 pm    Post subject: Reply with quote

Thanks for the tip.

So I tried doing it in the garage but it's almost even more difficult as there's exactly as many values to start with (at least a hundred millions) but it's much harder to get rid of them. All I can do is select a car, or select another. And in cheat engine all I can do is search for a changed or an unchanged value.

Earlier I took a car from the beginning of the list, and another more at the end of the list. So I tried searching for increased and decreased value but obviously it wasn't this, probably they're in a complete different order than they're presented to us.
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Wed Nov 28, 2012 3:16 pm    Post subject: Reply with quote

Ah, if your garage come with a 3d representation of the car, try lowering all graphic options to their minimums. Small resolution texture means less data loaded in memory, and the less data is loaded the faster the scan and the less false suspects there are.

But ultimately it boils down to a fight between the game and your patience. Don't forget trial and error when filtering becomes ineffective and you have, say, less than 5k remaining suspects (iirc 10k->cheat engine will hang).
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Wed Nov 28, 2012 4:11 pm    Post subject: Reply with quote

Nope not a 3D garage just I think the map outside is already loaded (actually I'm pretty sure it's the case).

I tried setting it to minimum but no changes!

Also in the game files I found some files with a list of vehicles, with numbers. They're not in the same order as in the game.

I tried:

- Finding a car with a number in that file.

- Selecting the car in the garage

- Searching the number (exact value) that I found in the file

- Chose a second car from the list in that file

- Selected it in the garage

- Searched for changed value

- Searched for exact value (number from the second car)


The result was that I always found 2 values that changed accordingly for both vehicles with the correct numbers, but as soon as I tried a third vehicle, the number stayed the same so it was all wrong Crying or Very sad I wish I had found it haha!


But I'm ok with patience. I like doing that also, it's kinda fun.

BTW — could it not be something else than a 4 bytes value?


Also, is it possible that it is impossible to do that? Or is there a 100% chance that this works, even if it's really hard?
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Wed Nov 28, 2012 4:33 pm    Post subject: Reply with quote

Ozzy25 wrote:
The result was that I always found 2 values that changed accordingly for both vehicles with the correct numbers, but as soon as I tried a third vehicle, the number stayed the same so it was all wrong Crying or Very sad I wish I had found it haha!
Damn, almost!

Ozzy25 wrote:
BTW — could it not be something else than a 4 bytes value?
Lots of developers are lazy and when they use an integer, they use a 4 byte integer, and pointers take 4 bytes, so you can try 2 theories at once.
But since there are less 256 cars in your game, it may also be a 1 byte integer that would hold the car ID.

Ozzy25 wrote:
Also, is it possible that it is impossible to do that?
The absolutely impossible does not exist afaik, but a certain hack may be too hard given your, or my skills.
Ozzy25 wrote:
Or is there a 100% chance that this works, even if it's really hard?
If I were hired by a game company and asked to protect a game vs cheating, this approach wouldn't work Wink.

It'd be uncommon for a racing game, but if it were written in python, this approach wouldn't work either. Python applications often come with a python*.dll. Flash games also have an uncommon way of handling integers that could thwart this, depending on how you proceed.
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Thu Nov 29, 2012 1:14 am    Post subject: Reply with quote

Hmm interesting. Thanks for sharing!

By the way, as for the value type: I noticed in the game files that some vehicles share the same vehicle files, yet they can have physical differences.

Obviously they can also have different colours.

Does that matter? I thought this information could be saved in there. Because I thought this would make the values even more "variable" perhaps.

Edit //

I believe I found something Smile

Did the same process again, with filtering etc. and narrowed it down to 25 values. All 4 bytes.

Two of them I know it's not them, I've already found them earlier when filtering so I can exclude these.

But then I have around 20 addresses or so, of which 10 use the exact same value, and it changes every time I change the car.

Then 5 addresses use the same value too, and another 5 addresses also use the same value.

Could this be something? Smile


Edit 2 //

Restarted the game, and sadly, all values had changed.

But I have searched for the values again (4 byte > exact value) and found them, so they changed addresses (Now we come to that part with changing addresses, where I'm still so confused…).

The addresses were the same as before for each car that I had selected. So those are definitely the addresses to the cars Smile

Earlier I said some cars can have physical changes although they share the same vehicle files. I noticed that too: I tested such a car, which has the exact same performance, handling etc. as the standard version, but it comes with a spoiler for example. I compared it to the "normal" car and one value was changing. Probably the one for the spoiler. I tried selecting the normal version and changing the code to the code for the spoiler and freezing it, but it did not really work (one reason I restarted the game, I wanted it to be "fresh" as maybe it can't do everything in real-time sometimes).

Funny thing was in the garage the car logo disappeared sometimes depending on what I changed, and usually also I have a "Are you sure you want to select this car?" window, but it skips it extremely quickly and it doesn't show any selected car. However if I start driving, then this car is selected.

I think this sounds good so far? Smile
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Thu Dec 06, 2012 1:05 pm    Post subject: Reply with quote

Gniarf, any ideas? Smile

(Sorry for the double post…)
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Thu Dec 06, 2012 3:21 pm    Post subject: Reply with quote

Ozzy25 wrote:
But then I have around 20 addresses or so, of which 10 use the exact same value, and it changes every time I change the car.
...
I tested such a car, which has the exact same performance, handling etc. as the standard version, but it comes with a spoiler for example. I compared it to the "normal" car and one value was changing.
Good you've found something tied to the car. Write down the values for normal/spoiler car somewhere: that's the precious result of your work so far.

Now the problem is to find what you can do with those.
Ozzy25 wrote:
I tried selecting the normal version and changing the code to the code for the spoiler and freezing it, but it did not really work
Ok, let's try a mean thing:
1-Find the value that changes when you switch from normal to spoiler version.
2-Right click on it->"find out what writes to this address"
3-In game, change from, say, normal to spoiler.
4-Freeze the value.
5-Look at the window titled "these opcodes write to...". If there are a lot of lines, I recommend not doing the next steps. You can try if you wish, you won't lose much anyway.
6-For each line, select the line and click "replace with code that does nothing". (use main window->advanced options to restore the original code later on)
7-Get back in game an try to switch from spoiler to normal. Anything abnormal?
8-If not, freeze the value to the code that correspond to a normal car, and try to switch from normal to spoiler. Anything abnormal like a spoilerless spoiler version?

If you get a crash in your face, post a screenshot of your "these opcodes write to..." window.

Ozzy25 wrote:
Now we come to that part with changing addresses, where I'm still so confused…
Hold your horses, first try to make a working hack, then try to keep it working across restarts/reloads.

Ozzy25 wrote:
Funny thing was in the garage the car logo disappeared sometimes depending on what I changed, and usually also I have a "Are you sure you want to select this car?" window, but it skips it extremely quickly and it doesn't show any selected car. However if I start driving, then this car is selected.
Right click on the cheat entrie(s) you changed->"find out what writes to this address" and go to the garage. If you see in the window titled "these opcodes write to..." any line that starts with "push" you're on the wrong track with this address. Actually it means that the address you're looking at is on "the stack". The stack is a place for highly temporary variables, a bit like a counter in a grocery shop: at one time there are client A's would-be purchase on it, a few seconds later it's client B's, except that for a computer we talk in cpu cycles, not seconds. (there are Cpu_GHz*1billion cpu cycles per second)

Ozzy25 wrote:
I think this sounds good so far?
Yeah it sounds good, you've grabbed the tail of what you want to hack. Worst case scenario, an experienced hacker could find the code that alters the values that represents the spoiler/spoilerless option, trace backward (=read the game's code in assembly) and figure out how the game handles car swapping. However we, or at least I, avoid that whenever possible since it's often fairly tedious.

last thing: thanks for the double post, I'd have missed your edits otherwise.
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Thu Dec 06, 2012 4:25 pm    Post subject: Reply with quote

Thanks for replying!

Sadly, it seems like I've lost track of all values. I had written them down, some of them I find them, some not, some of them don't change anymore. But I was 100% sure they were linked to the cars, they only changed when I changed the cars, I tried doing pretty much everything you can do and they never changed, except if I changed the cars.

Some of them I still have them, the "main" ones which define a car. But the ones that define a special version, for example a spoiler… no chance Sad (Or at least those that I thought they may be for a spoiler for example).

As far as the steps you listed go — I did what you said with two normal cars, since I don't find the values for the "special versions" of cars anymore.

Every car has ~ 14 values or so, and these change when I change the car. So I did all the steps you said until #5 and to my luck there was only one line Smile I clicked Replace and a very weird screen appeared and after a few seconds the game crashed!

And what did you mean with "push"? Do you mean that the word "push" is in there? If so then it isn't (there was only one line like I said so I can't have missed it Razz).

I'll test some more stuff now and we'll see if I'm lucky!

Thanks by the way for all the help through the topic, without you I wouldn't have come so far Smile
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Fri Dec 07, 2012 10:33 am    Post subject: Reply with quote

Ozzy25 wrote:
Every car has ~ 14 values or so, and these change when I change the car. So I did all the steps you said until #5 and to my luck there was only one line Smile I clicked Replace and a very weird screen appeared and after a few seconds the game crashed!
OK, that means that this instruction belongs to what is called "shared code",i.e. the same code that is used to handle lots of different things. This is very common in games.
Do steps 1-5 again (using spoiler & normal car, or normal & normal doesn't matter, but it's easier if there is only one value that changes), then click show disassembler and post here everything from the 4th line before to the 4th line after the selected line (=the instruction that writes to your value). Make sure view->"show module addresses" is enabled before copying, and ask to copy address+bytes+opcodes.

The idea is that I'll brew you a little script that will tell the game not to write to the address you specify (which will be the one of the car definition), but behave normally if the game tries to write to something else. That should be enough to dirtily test whether we can hack something interesting with that address.

Ozzy25 wrote:
And what did you mean with "push"? Do you mean that the word "push" is in there?
I meant that the word push should be there, yes. The instruction you saw was probably something like "mov [e**+***],e**" and I was telling you that if it were a "push *" it'd be bad.

Also, do you have any programming experience? It's just to adapt my way of explaining.
Back to top
View user's profile Send private message
Ozzy25
Cheater
Reputation: 0

Joined: 07 Nov 2012
Posts: 34

PostPosted: Fri Dec 07, 2012 11:41 am    Post subject: Reply with quote

Alright wait a second — I had to figure out the values of the cars again. I can't figure out the values that I thought determined the small differences (like a spoiler) anymore, so instead I concentrated on just finding values of the normal cars that I can drive.

So now I have the addresses + their values (well, their temporary addresses, but the values are always the same).

When I said there's 14 values and they all change when I change the car, I forgot to say that those 14 values are all the same, and when I change my car they all change to another same value. So I have 14 times the same value.

There was one however that was a bit different: the value changed to zero when I was in the garage, without any car selected. The others stayed this way. I think this is because it somehow saves the car you were using so when you start a race for example and you didn't select any car, it would use that last car you had.

So I did step 1-5 again like you said, and I came to the "following opcodes…" window. This time however I had two lines. Both counts for both lines are getting higher and higher and don't stop, not sure what these mean.

Those are the two lines:

Code:
95087A42 - movdqa [edi+edx+20],xmm2
0098AF31 - movss [exb+000000D4],xmm0


Here's the code for the first line:

Code:
libsystem_c.dylib+1A2B - F3 0F6F 54 16 20  - movdqu xmm2,[esi+edx+20]
libsystem_c.dylib+1A31 - F3 0F6F 5C 16 30  - movdqu xmm3,[esi+edx+30]
libsystem_c.dylib+1A37 - 66 0F7F 04 17   - movdqa [edi+edx],xmm0
libsystem_c.dylib+1A3C - 66 0F7F 4C 17 10  - movdqa [edi+edx+10],xmm1
libsystem_c.dylib+1A42 - 66 0F7F 54 17 20  - movdqa [edi+edx+20],xmm2
libsystem_c.dylib+1A48 - 66 0F7F 5C 17 30  - movdqa [edi+edx+30],xmm3
libsystem_c.dylib+1A4E - 83 C2 40     - add edx,40
libsystem_c.dylib+1A51 - 75 CD        - jne libsystem_c.dylib+1A20
libsystem_c.dylib+1A53 - E9 20FFFFFF  - jmp libsystem_c.dylib+1978


And for the second:

Code:
DRNG+989F1D - 89 83 CC000000      - mov [ebx+000000CC],eax
DRNG+989F23 - 8B 42 0C            - mov eax,[edx+0C]
DRNG+989F26 - 89 83 D0000000      - mov [ebx+000000D0],eax
DRNG+989F2C - F3 0F10 45 20       - movsd xmm0,[ebp+20]
DRNG+989F31 - F3 0F11 83 D4000000  - movss [ebx+000000D4],xmm0
DRNG+989F39 - 8D 83 D8000000      - lea eax,[ebx+000000D8]
DRNG+989F3F - C7 44 24 08 9E000000 - mov [esp+08],0000009E
DRNG+989F47 - 8B 55 24            - mov edx,[ebp+24]
DRNG+989F4A - 89 54 24 04         - mov [esp+04],edx


Thank god there's no "push" in there then Razz

And no sadly, I don't have any programming experience! Confused
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Fri Dec 07, 2012 2:51 pm    Post subject: Reply with quote

Ozzy25 wrote:
So I did step 1-5 again like you said, and I came to the "following opcodes…" window. This time however I had two lines. Both counts for both lines are getting higher and higher and don't stop, not sure what these mean.
Count is the number of times the selected instruction wrote on your address. If the count keeps increasing it means the game still is writing on those address as you read the counter, which is odd because once you've selected a car I don't see why the game would keep on writing "The player selected car 5.The player selected car 5.The player selected car 5.The player selected car 5.The player selected car 5.". At least that explains why freezing doesn't work: continuous writes(=freezing) by the game itself is always faster/"stronger" than freezing by cheat engine (1 write every 0.1s).

Ozzy25 wrote:
Those are the two lines:

Code:
95087A42 - movdqa [edi+edx+20],xmm2
0098AF31 - movss [exb+000000D4],xmm0
Interesting, try changing your value type from 4 bytes to float (double click on "4 bytes" in the cheat list). You might see a more "friendly" value. If not, well xmm0 can also be used for integer operations, after all.
movss ....xmm* are almost always used to handle float values.
movdqa, well there they are using it to blindly make copy from one memory to one other, so it doesn't carry any byproduct hint.

Right now my gut feeling is that you've found a property of the cars (speed? mass? price? 3d model's scale factor?...) but not the thing that specifies what car you've selected (Orz). You need to do the writing prevention test below to be sure, but the continuous writes and (assumed) float datatype are fishy.

Ok for that, paste the script below in cheat engine. You will have to edit it a bit since we're doing a test the quick and dirty way. That means you'll have to replace the 12345678 on the first line with whatever is the address (not value) of the value you want to prevent writing on, and use your smarts to expand it if you want to prevent those 2 instructions from writing to the other 13 values.

Also some informations:
-everything in blue is a comment and thus has no influence whatsoever on the hack's behavior.
-everything that follows "//" is in blue=is a comment.
Code:
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>0</ID>
      <Description>"Write stopper"</Description>
      <Color>80000008</Color>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>define(DoNotWriteThere1,12345678) //enter the address where writing is forbidden, in HEXADECIMAL
//define(DoNotWriteThere2,12345678) //if you need more... iirc you need 14 of those right?

[enable]
//code locations
alloc(code,2048) //give us 2048 bytes so we can code our hack, wayyy more than you need
label(DRNGHook)
label(libsystem_cHook)
label(DontWrite)
label(DRNGReturnHere)
label(libsystem_cReturnHere)
//storage locations
label(SavedValue1)
//label(SavedValue2)

DRNG+989F31: //F3 0F11 83 D4000000  - movss [ebx+000000D4],xmm0 takes 8 bytes
jmp code //jmp * takes 5 bytes
nop      //so add 3 nops
nop
nop
DRNGReturnHere:

libsystem_c.dylib+1A42: //66 0F7F 54 17 20  - movdqa [edi+edx+20],xmm2 takes 6 bytes
jmp libsystem_cHook //jmp * takes 5 bytes
nop      //so add 1 nop
libsystem_cReturnHere:

code:
DRNGHook:
push eax                 //save eax since we need one temporary storage location
lea eax,[ebx+D4]         //eax is now equal to ebx+d4
cmp eax,DoNotWriteThere1 //compare eax=ebx+d4 vs DoNotWriteThere1
je DontWrite             //if they are equal, don't write there
//cmp eax,DoNotWriteThere2 //if you need more...
//je DontWrite
movss [ebx+000000D4],xmm0  //original code
DontWrite:
pop eax   //restore eax
jmp DRNGReturnHere

libsystem_cHook:
push eax                 //save eax since we need one temporary storage location
mov eax, dword [DoNotWriteThere1] //those 2 lines are used to copy the data from
mov dword [SavedValue1],eax //DoNotWriteThere1 into SavedValue1
//mov eax, dword [DoNotWriteThere2] //if you need more...
//mov dword [SavedValue2],eax
movdqa [edi+edx+20],xmm2    //execute the original code, which copies 16 bytes
mov eax,dword [SavedValue1]   //those 2 lines are used to copy back the data from
mov dword [DoNotWriteThere1],eax //SavedValue1 into DoNotWriteThere1
//mov eax,dword [SavedValue2]   //if you need more...
//mov dword [DoNotWriteThere2],eax
pop eax   //restore eax
jmp libsystem_cReturnHere


SavedValue1:
dd 0

//SavedValue2:
//dd 0

[disable]
//restore the original code when disabling the hack
DRNG+989F31:
movss [ebx+000000D4],xmm0

libsystem_c.dylib+1A42:
movdqa [edi+edx+20],xmm2

//and free the memory allocated nfor that purpose
dealloc(code)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page Previous  1, 2, 3, 4  Next
Page 2 of 4

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites