Cheat Engine

ShurikeN · Last edited by ShurikeN on Sat May 10, 2008 5:22 pm; edited 3 times in total

i tried to make a loader for a molebox protected application but the problem is the address that im trying to patch is changing when i run it on other type of machines but on same type machines it works fine. if the address in my machine is 0x00B80E77 and if i tried it on other it becomes 0x00B40E77. it's like 0x00B80E77 -= 40000.

Ferocious · Posted: Fri May 09, 2008 1:52 am Post subject:

find the base address?

and have it + with the offset?

atom0s · Posted: Fri May 09, 2008 1:29 pm Post subject:

Sounds like code shifting. You said the address is 0x00B80E77 on your machine, locate the DLL memory space that address is inside of and use the base of it to create an offset.

To locate the base addresses of the DLLs inside the program, open Cheat Engine, open the memory viewer, select View from the menu, and choose 'Enumerate DLLs and Symbols'

Look for something that has an address close to that it should be smaller then that address as well. Something like:

0x00B80000

Then create your offset based on that address by doing:
Address - Base = Offset

Or in this example:

0x00B80E77 - 0x00B80000 = 0xE77

Then for your loader, start by locating the base address first which you can get using:
- CreateToolhelp32Snapshot
- Process32First/Process32Next
- Module32First/Module32Last

Then you would do:

Base + Offset = Address

To obtain the new address on what ever machine you are on.

ShurikeN · Posted: Fri May 09, 2008 4:30 pm Post subject:

i love you wiccaan. you've been a big help to me since i started learning. Razz

anyways, is this how i get the base?

atom0s · Posted: Fri May 09, 2008 6:33 pm Post subject:

Naw. You need to use the name of the module the address is found in. I was only using the address above as an example. Locate the name of the module your address resides in based on its base address and size, then scan using that code for that modules name.

ShurikeN · Posted: Sat May 10, 2008 4:29 am Post subject:

aw! i thought i made it work *LOL.

here's the screeny of the enumerated dll's and i found the base but it doesn't look like a name of dll to me, Module32first/Module32next can't detect it.
http://www.geocities.com/cursebox87/SCREENAH.PNG
the value in the middle of MBX@F6C@8227B0 which is F6C is changing everytime the game is restarted.

i think im dealing with a more complicated one.

atom0s · Posted: Sat May 10, 2008 1:06 pm Post subject:

That DLL is most likely going to be the one you need. That being said you will need to handle it changing names at random like that. You can compare part of the string using strstr, like this:

ShurikeN · Posted: Sat May 10, 2008 5:22 pm Post subject:

cool!! now it's 100% working. thanks thanks.