 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Thu Jun 13, 2013 1:31 pm Post subject: |
|
|
The script I posted above is not meant to work for companions. Look at its code and try to understand what it actually does (I wrote the comments for that). Ask questions if there are specific parts you don't understand.
Now to add support for companions, see if you can find:
-a function that only accesses player and companion HP (probably the one that draws HP bars on portraits...).
OR
-a function that only accesses companion HP.
OR
-a variable that tells a given being is a companion (exactly like finding Hero ID).
OR
-a pointer to your current companion (like find his HP, first pointerscan, ditch companion, find another, pointer rescan with 2nd companion's HP).
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Sat Jun 15, 2013 12:42 pm Post subject: |
|
|
I tried to find a pointer or that variable but it was very hard and I couldn't find anything. I will try again with other options for pointer scan, maybe I will find something, but I have a question:
| Gniarf wrote: | Now to add support for companions, see if you can find:
-a function that only accesses player and companion HP (probably the one that draws HP bars on portraits...).
OR
-a function that only accesses companion HP. |
What do You mean by "function"?
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Sat Jun 15, 2013 1:53 pm Post subject: |
|
|
| I meant an instruction found using "find what accesses...".
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Sun Jun 16, 2013 5:45 am Post subject: |
|
|
I have found 4 functions, but to be honest, the fourth one (16FF54) is the safest because the others have found some other values than just HP of my companion (max HP is 04 offset before the current HP, so eg. 0130 is current, then 012C is maximum HP)
| Description: |
|
| Filesize: |
17.09 KB |
| Viewed: |
10699 Time(s) |

|
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Sun Jun 16, 2013 3:07 pm Post subject: |
|
|
Ok, so assuming that 4th function only accesses companion HP (not baddies, nor player, though it doesn't matter), this script should provide companion godmode, player godmode, and epilepsy for you because you made a change -I believe in LogPlayerHPAddress - that I didn't include (I didn't have the sacred.exe+xxx source).
| Code: | [ENABLE]
alloc(NewMem,1024)
//code locations
label(LogPlayerHealthAddress)
label(LogPlayerHealthAddress_End)
label(LogCompanionHealthAddress)
label(LogCompanionHealthAddress_IndexOK)
label(LogCompanionHealthAddress_End)
label(ApplyDamage)
label(ApplyDamage_ProtectVIP)
label(ApplyDamage_Exit)
label(ApplyDamage_End)
//variables
label(PlayerHpAddress)
label(CompanionHpAddressArray) //5 elements
label(ArrayIndex)
sacred.exe+1397f7: //UPDATE THIS LINE
jmp LogPlayerHealthAddress
nop //UPDATE THIS LINE
LogPlayerHealthAddress_End:
"sacred.exe"+163020:
jmp ApplyDamage
nop
ApplyDamage_End:
"sacred.exe"+16FF54:
jmp LogCompanionHealthAddress
nop
LogCompanionHealthAddress_End:
NewMem:
ApplyDamage:
push eax
lea eax, [ebp+130]
cmp dword [PlayerHpAddress],eax //trying to damage the player?
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray],eax //or one companion?
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+4],eax //or another companion?
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+8],eax
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+c],eax
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+10],eax
je short ApplyDamage_ProtectVIP
jmp short ApplyDamage_Exit
ApplyDamage_ProtectVIP:
mov edi,[ebp+0000012c] //load max HP
ApplyDamage_Exit:
mov [ebp+00000130],edi //original code
pop eax
jmp ApplyDamage_End
LogPlayerHealthAddress:
push eax
lea eax, [ebp+4D8] //UPDATE THIS LINE
mov dword [PlayerHpAddress],eax
pop eax
cmp dword [ebp+4d8],ebx //UPDATE THIS LINE
jmp LogPlayerHealthAddress_End
LogCompanionHealthAddress: //will store ebp+130 into CompanionHpAddressArray slot 1 on 1st execution, then slot 2,3,4,0,1...
push eax //save eax
push ebx //save ebx
mov ebx,dword [ArrayIndex] //ebx=array index
inc ebx //increase ebx by 1
cmp ebx,4 //4=number of slots in CompanionHpAddressArray-1
jle short LogCompanionHealthAddress_IndexOK //jump if ebx is =4 or less
xor ebx,ebx //ebx=0
LogCompanionHealthAddress_IndexOK:
mov dword [ArrayIndex],ebx //save in ArrayIndex, ebx=(ArrayIndex+1)modulo 5
lea eax,[ebp+130] //eax=address of Hp
mov dword [CompanionHpAddressArray+ebx*4],eax //store eax in the ebx-th slot of CompanionHpAddressArray
pop ebx //restore saved ebx
pop eax //restore saved eax
mov dword [ebp+130],eax //original code
jmp LogCompanionHealthAddress_End
PlayerHpAddress:
dd 0
CompanionHpAddressArray:
dd 0 //companion 0 HP address
dd 0 //companion 1 HP address
dd 0 //...
dd 0
dd 0
ArrayIndex:
dd 0
[DISABLE]
dealloc(NewMem)
sacred.exe+1397f7: //UPDATE THIS LINE
cmp dword [ebp+4d8],ebx //UPDATE THIS LINE
"sacred.exe"+163020:
mov [ebp+00000130],edi
"sacred.exe"+16FF54:
mov dword [ebp+130],eax |
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Sun Jun 16, 2013 4:38 pm Post subject: |
|
|
It has a godmode for player, for companions, even for enemies, but now I'm updating lines, you checked, but I can't understand one thing: how to update this:
| Code: | | nop //UPDATE THIS LINE | ?
@Edit: After some updates I made a script which kills everybody who is in some range, even the citizens are dying
@Edit2: I can't understand this... I am sure that those functions only affects Player/Companions but still enemies are invincible as well, as I am, sometimes I can kill them when I hit them with more HP than their maximum, sometimes even when I hit them with more HP than 1000x their maximum, their still alive.
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Sun Jun 16, 2013 6:15 pm Post subject: |
|
|
| Jacusiek wrote: | I can't understand one thing: how to update this:
| Code: | | nop //UPDATE THIS LINE | ? | You replaced sacred.exe+1397f7 by another address, but if the instruction at this new address is not 6 byte long you may need to add or remove nops (nops are just padding).
| Jacusiek wrote: | @Edit: After some updates I made a script which kills everybody who is in some range, even the citizens are dying  | Like the barbarian's dagger stare, on steroids.
| Jacusiek wrote: | | @Edit2: I can't understand this... I am sure that those functions only affects Player/Companions but still enemies are invincible as well, as I am, sometimes I can kill them when I hit them with more HP than their maximum, sometimes even when I hit them with more HP than 1000x their maximum, their still alive. | Post your updated script, I'll check if I see something wrong.
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Mon Jun 17, 2013 2:02 am Post subject: |
|
|
Here are some codes, I will put them on another site, because they are just too long to put them here:
1) http://wklej.to/FBxGw- this gives everyone God Mode, which regenerates "slowly", so if I shoot fast enough I can still kill enemy (the same with enemy, who can kill me, if strong and fast enough)
2) http://wklej.to/FyRf4 - this one gives everyone God Mode, but enemy with 3000 HP can't be killed even with shot, which deals above 10000 HP (I would like to have GM like this, because the first one needs to regenerate and also I can still die, when I am hit over than my maximum HP)
3) http://wklej.to/jJsWy - like the 2)
4) http://wklej.to/RUNS4 - like the 1)
That's all I've found with "Find out what accessess...", I also tried to remove "nop" line but it just crashed the game.
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Mon Jun 17, 2013 3:30 am Post subject: |
|
|
There is a recurrent mistake in scripts 1,3 and 4. The 4 red registers should always be the same:
LogPlayerHealthAddress:
push eax
//lea edx, [ebp+130] //wrong
lea eax, [ebp+130] //good,only the green part changes on this line
mov dword [PlayerHpAddress],eax
pop eax
cmp dword [ebp+130],edx //original code
jmp LogPlayerHealthAddress_End
Refer to the comments of the first script I posted in this thread to see why it must be updated this way.
Also does this script give you a companion-only GM?
| Code: | [ENABLE]
alloc(NewMem,1024)
//code locations
label(LogCompanionHealthAddress)
label(LogCompanionHealthAddress_IndexOK)
label(LogCompanionHealthAddress_End)
label(ApplyDamage)
label(ApplyDamage_ProtectVIP)
label(ApplyDamage_Exit)
label(ApplyDamage_End)
//variables
label(CompanionHpAddressArray) //5 elements
label(ArrayIndex)
"sacred.exe"+163020:
jmp ApplyDamage
nop
ApplyDamage_End:
"sacred.exe"+16FF54:
jmp LogCompanionHealthAddress
nop
LogCompanionHealthAddress_End:
NewMem:
ApplyDamage:
push eax
lea eax, [ebp+130]
cmp dword [CompanionHpAddressArray],eax
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+4],eax
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+8],eax
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+c],eax
je short ApplyDamage_ProtectVIP
cmp dword [CompanionHpAddressArray+10],eax
je short ApplyDamage_ProtectVIP
jmp short ApplyDamage_Exit
ApplyDamage_ProtectVIP:
mov edi,[ebp+0000012c] //load max HP
ApplyDamage_Exit:
mov [ebp+00000130],edi //original code
pop eax
jmp ApplyDamage_End
LogCompanionHealthAddress:
push eax
push ebx
mov ebx,dword [ArrayIndex]
inc ebx
cmp ebx,4
jle short LogCompanionHealthAddress_IndexOK
xor ebx,ebx
LogCompanionHealthAddress_IndexOK:
mov dword [ArrayIndex],ebx
lea eax,[ebp+130]
mov dword [CompanionHpAddressArray+ebx*4],eax
pop ebx
pop eax
mov dword [ebp+130],eax //original code
jmp LogCompanionHealthAddress_End
CompanionHpAddressArray:
dd 0
dd 0
dd 0
dd 0
dd 0
ArrayIndex:
dd 0
[DISABLE]
dealloc(NewMem)
"sacred.exe"+163020:
mov [ebp+00000130],edi
"sacred.exe"+16FF54:
mov dword [ebp+130],eax | (This one doesn't need any updating)
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Mon Jun 17, 2013 5:00 am Post subject: |
|
|
The new one You wrote, works like the old one: gives GM for everyone (enemies too).
@Edit: I also tried to update those lines, now correctly, but it didn't work. I see You deleted lines for player, so it means, that the instructions I found are wrong, because they also work for enemies and players...
|
|
| Back to top |
|
 |
Gniarf Grandmaster Cheater Supreme
Reputation: 43
Joined: 12 Mar 2012 Posts: 1285
|
Posted: Mon Jun 17, 2013 5:47 am Post subject: |
|
|
| Jacusiek wrote: | | The new one You wrote, works like the old one: gives GM for everyone (enemies too). | Hmm...Are you ABSOLUTELY sure that "sacred.exe"+16FF54: mov dword [ebp+130],eax doesn't access enemy HP?
Fu, I guess it's time I take the dust off that cd...What version of sacred are you using? With or without the addon?
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Mon Jun 17, 2013 6:19 am Post subject: |
|
|
| Gniarf wrote: | | Jacusiek wrote: | | The new one You wrote, works like the old one: gives GM for everyone (enemies too). | Hmm...Are you ABSOLUTELY sure that "sacred.exe"+16FF54: mov dword [ebp+130],eax doesn't access enemy HP?
Fu, I guess it's time I take the dust off that cd...What version of sacred are you using? With or without the addon? |
The newest version Sacred Underworld 2.28 (PL), but as You said, I see that "sacred.exe"+16FF54" also accesses enemy HP... It's strange, because some time ago it didn't. Also, when I select "find out what accessess" it finds me many instructions, but EVERY instruction accesses also enemy and my HP. I have found some structures to find players, enemy and companion ID, and that's what I found:
http://imageshack.us/g/593/4j7.png/
Photos:
IDs are: Player/Companion/Enemy/Enemy/Enemy (but I wonder if it should be P/C/Enemy1/Enemy1/Enemy2 (because Enemy1 are Goblin Warriors, and Enemy2 is goblin champion - another names)
2) IDs: 0064 - 4 bytes - 169/84/104/104/104
3) IDs: 03B0 - 4 bytes - 5/279/76/76/128 (here You can see e1,e1,e2)
also IDs: 0414 - byte - 217/20/11/11/64
and: 0415 - byte - 67/65/66/66/66 (I think this is the most possible, it looks realistic, numbers are near other numbers)
4) 4d8 - current health, 4d4 - max health
04D0 - 4 bytes - 7714/2904/3003/3003/3003 - it's something connected to HP, but it's not so important (it is the current value of HP but not HP I have, but HP I see on screen, so it's fake)
IDs: 04E0 - 4 bytes - 1124/250/158/158/158
Those are the nearest to current HP 4D8, so they are the most possible to be IDs. I also wonder, maybe companion and I have the same ID, or enemies have the same (even enemies with different names). I don't know how exactly look at it.
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Jun 17, 2013 7:03 am Post subject: |
|
|
Piszesz, że dla Player oraz Companion pod 4D4 jest wartość maksymalna, a pod 4D8 jest wartość aktualna. (w 4D0 wartość ukazana na ekranie).
Czy dla przeciwników wartość pod 4D4 jest zawsze mniejsza od wartości pod 4D8? Możesz wyjaśnić dlaczego w przypadku przeciwników max jest mniejszy od current?
Niestety nie posiadam tej gry i nie znam jej mechanizmów...
Mogę ewentualnie pomóc poprzez TeamViewer (jeżeli dobrze go skonfigurujesz, nie masz się czego bać).
_________________
|
|
| Back to top |
|
 |
Jacusiek Advanced Cheater
Reputation: 0
Joined: 24 Jan 2011 Posts: 81
|
Posted: Mon Jun 17, 2013 8:25 am Post subject: |
|
|
Przeciwnicy mają więcej HP niż max, ponieważ sam im zwiększyłem (żeby nie zginęli mi od razu, do testów). Dzięki za pomoc mgr.inz.Player, ale przy okazji staram się sam zrozumieć mechanizm skryptów, jakoś dam radę
Eng: Enemies have more current HP than max, because I increased their HP (because I didn't want their death, I was testing something).
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 223
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Mon Jun 17, 2013 8:33 am Post subject: |
|
|
Tak patrzę i oprócz tych niepewnych ID co podałeś w swoim poprzednim poście zauważ co jest w
39C
3A0
3A4
Tu są pointery do struktur, które tylko player i companion posiada.
Comapanion i Player mają tam jakiś adres, a przeciwnicy mają zero. Można wykorzystać ten fakt.
Ale chciałbym abyś wypróbował pewną nowość o którą poprosiłem autora programu CheatEngine. Zainstaluj CE6.3, w menu start odnajdź skrót do resetowania ustawień (Reset settings).
Odnajdź adres z HP tylko twojej postaci. Po odnalezieniu spauzuj grę, dodaj ten adres do listy, wybierz "find out what access ...", w nowym okienku kliknij prawym myszy w pustej przestrzeni zaraz pod kolumną "instruction". Z menu kontekstowego wybierz "check if found opcodes also access ..."
Ta nowa funkcjonalność CE6.3 pozwala szybko odnaleźć opcode które odczytują/modyfikują tylko jeden/kilka/więcejniżosiem adres(ów).
Wróć do gry i pobaw się (uprzednio możesz zamrozić HP aby cię nie zabili) przez jedną minutę. Spauzuj grę, w okienku powinny się pojawić opcode'y wraz z informacją ile razy przez ten czas natrafiły na adres HP. Wartości w nawiasach informują czy opcode'y także odczytują/modyfikują adresy z HP przeciwników, bądź w ogóle inne adresy.
Powiększ okienko maksymalnie jak się da, aby wszystkie opcode wraz ze wszystkimi informacjami były widoczne. Upewnij się że kolumna "Count" jest odpowiedniej szerokości. Możesz też zmniejszyć pole tekstowe w którym są dodatkowe informacje na temat obecnie wybranego opcode.
Wklej screenshot tak powiększonego okienka.
Opcode, które w nawiasie mają tylko wartość 1, oznacza że używane są tylko i wyłącznie do HP gracza, wartość 2 - dla gracza i chowańca, 3 i więcej oznacza że opcode jest współdzielonym także z przeciwnikami.
English:
I suggested him to use new CE6.3 feature:
"The "Find out what *** this address" function now has the ability to show if the given opcode is used for other data as well "
plus I noticed that values at 39C, 3A0, 3A4 are zero for enemies.
_________________
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|