Cheat Engine

fayt646 · Newbie cheater Reputation: 0 Joined: 26 May 2006 Posts: 19

I have tried all of the bytes and all of the tricks I know on "hacking" little games like this, but I just cannot seem to find the right byte or something to find the score...

anyways, here's the link to the game if you want to help.

Labyrnth · Moderator Reputation: 10 Joined: 28 Nov 2006 Posts: 6301

I think you should be able to do this small game.
However the download link is dead,
Got another link or upload it to rapid share or media share.

kdog2fast · Posted: Wed Nov 26, 2008 11:20 am Post subject:

The link is dead but I still can give you some tips which you might have not tried yet or looked over,

1) Try an unknown initial value scan for the value (byte to double). If the game is simple it must be stored in this manner but has a indirect value of what you see or are searching for.

2) Try using 2 byte or byte scans if the value is low (around 2-1000), In some games like Triple Triad, you have to find this value of the cards then if you changed it to 99 you would have the negative amount of the cards... the way around this was to then edit the byte of the address to 4, then change the value to 99 and you would get 99 cards.

3) If the game is made by games like game maker it is probably in double or float form. Make sure you try those if you already didn't, rounded or truncated searches make a difference.

That is all I can think of if its a simple game...

fayt646 · Newbie cheater Reputation: 0 Joined: 26 May 2006 Posts: 19

I put up a new link.

And I tried tried All Byte [byte to double] or something, and still couldn't find anything.

Labyrnth · Moderator Reputation: 10 Joined: 28 Nov 2006 Posts: 6301

2:10 PM 12/1/2008
Free Tetrix v.1.09.1

Score Board Save file:
Open the scores.lst in notepad and have fun.

2 Byte Scans
48B314:
ftetrix.exe+8B314

Debuggers:
CheatEngine: 735298f8 - 89 46 08 - mov [esi+08],eax
Ollydbg: 735298F8 - 89 46 08 MOV DWORD PTR DS:[ESI+8],EAX

Game Score Loop:
--------------------------
7352986E >/$ 56 PUSH ESI
7352986F |. 8BF1 MOV ESI,ECX
73529871 |. 57 PUSH EDI
73529872 |. 8BFA MOV EDI,EDX
73529874 |. 66:8B06 MOV AX,WORD PTR DS:[ESI]
73529877 |. 66:3D 0800 CMP AX,8
7352987B |. 72 22 JB SHORT MSVBVM60.7352989F
7352987D |. 25 FFFF0000 AND EAX,0FFFF
73529882 |. 83C0 F8 ADD EAX,-8 ; Switch (cases 8..11)
73529885 |. 83F8 09 CMP EAX,9
73529888 |. 77 5A JA SHORT MSVBVM60.735298E4
7352988A |. FF2485 109952>JMP DWORD PTR DS:[EAX*4+73529910]
73529891 |> 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] ; Case 8 of switch 73529882
73529894 |. 85C0 TEST EAX,EAX
73529896 |. 74 07 JE SHORT MSVBVM60.7352989F
73529898 |. 50 PUSH EAX
73529899 |. FF15 F0194273 CALL DWORD PTR DS:[<&OLEAUT32.#6>] ; OLEAUT32.SysFreeString
7352989F |> 8B07 MOV EAX,DWORD PTR DS:[EDI] ; Cases A,B,E,11 of switch 73529882
735298A1 |. 66:3D 0900 CMP AX,9
735298A5 |. 75 46 JNZ SHORT MSVBVM60.735298ED
735298A7 |. 8B57 08 MOV EDX,DWORD PTR DS:[EDI+8]
735298AA |. 56 PUSH ESI
735298AB |. 6A 03 PUSH 3
735298AD |. 6A 00 PUSH 0
735298AF |. 6A 00 PUSH 0
735298B1 |. 6A 00 PUSH 0
735298B3 |. 6A 00 PUSH 0
735298B5 |. 52 PUSH EDX
735298B6 |. C706 00000000 MOV DWORD PTR DS:[ESI],0
735298BC |. E8 C767FDFF CALL MSVBVM60.73500088
735298C1 |. 8B47 08 MOV EAX,DWORD PTR DS:[EDI+8]
735298C4 |. 50 PUSH EAX
735298C5 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
735298C7 |. FF51 08 CALL DWORD PTR DS:[ECX+8]
735298CA |. C707 00000000 MOV DWORD PTR DS:[EDI],0
735298D0 |. 8BC6 MOV EAX,ESI
735298D2 |. 5F POP EDI
735298D3 |. 5E POP ESI
735298D4 |. C3 RET
735298D5 |> 8B46 08 MOV EAX,DWORD PTR DS:[ESI+8] ; Cases 9,D of switch 73529882
735298D8 |. 85C0 TEST EAX,EAX
735298DA |.^ 74 C3 JE SHORT MSVBVM60.7352989F
735298DC |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
735298DE |. 50 PUSH EAX
735298DF |. FF51 08 CALL DWORD PTR DS:[ECX+8]
735298E2 |.^ EB BB JMP SHORT MSVBVM60.7352989F
735298E4 |> 8BCE MOV ECX,ESI ; Default case of switch 73529882
735298E6 |. E8 B377FFFF CALL MSVBVM60.__vbaFreeVar
735298EB |.^ EB B2 JMP SHORT MSVBVM60.7352989F
735298ED |> 8B57 04 MOV EDX,DWORD PTR DS:[EDI+4]
735298F0 |. 8B4F 0C MOV ECX,DWORD PTR DS:[EDI+C]
735298F3 |. 8906 MOV DWORD PTR DS:[ESI],EAX
735298F5 |. 8B47 08 MOV EAX,DWORD PTR DS:[EDI+8]
735298F8 |. 8946 08 MOV DWORD PTR DS:[ESI+8],EAX
735298FB |. C707 00000000 MOV DWORD PTR DS:[EDI],0
73529901 |. 8956 04 MOV DWORD PTR DS:[ESI+4],EDX
73529904 |. 894E 0C MOV DWORD PTR DS:[ESI+C],ECX
73529907 |. 8BC6 MOV EAX,ESI
73529909 |. 5F POP EDI
7352990A |. 5E POP ESI
7352990B \. C3 RET

fayt646 · Newbie cheater Reputation: 0 Joined: 26 May 2006 Posts: 19