Cheat Engine

[Lötlampe]

Hi folks!

First of all, i gotta admit that i am generally new to pointer search since i never felt the need for it anyway.

For Drakensang however I'd like such a gimmick as freezing stamina/mana for the players without searching for them every time i start the game. Hence i made the pointer Tutorials from CE which seemed ... well ... actually quite easy and tried to find what points to the players attributes but i got stuck.

edit: i am sorry that i had to cripple the image urls but since this is my first posting i am not allowed to do it right...

Here's what I've done:

1. upgraded to CE 5.6

2. searched for the actual value (it's exp here, not mana, but with exp i have exactly the same problem)



(the value 10 was searched for, then changed ingame to 3, added, then changed in CE to 30000 and ingame reduced sometimes, so that explains the differences in the plain value)

3. then right clicked on the value, clicked "find what writes to this adress", attached the debugger, went back to the game, changed the value and the debugger found the corresponding opcode:

which contained:

i must admit here, that i am lacking the proper x86 assembler knowledge to fully understand the meaning of the base pointer register, but what made me curious is that unlike in the tutorials there is no adding to the adress containing register in the opcode itself. (nothing live MOV [edx+somthing], value) instead there is ebp-04 that actually results in the adress for exp.
Anyway, i continued with what CE suggested me, namely the adress 21F4F830 and did a hex search for this adress and got some:


aaalright methinks, next step

4. i chose the first one of them and added the pointer:


then right clicked the pointer (!), find out what "accesses" this adress and then "find out what is accesssing this pointer" (the pointer itself).

5. now here comes the funky part! i switched back into the game, opened the character panel and decreased the exp again, when i switched back to CE i saw this:

this is when i began writing this posting here.

6. i switched back to drakensang and just moved my character around a bit (nothing that inflicts the exp), switched back to CE and now saw this! (and this is what makes me REALLY curious):


all pointers that first pointed to my exp are now pointing to the first of them which itself points to ... itself????

is that some kind of memory protection i ran into? have i not understood something?
are there any informations missing to reproduce or understand what's going on?

i'd really like some help on this.

Thanks in advance,

lötlampe[/b]

[Lötlampe]

Hei, it's me again, i wanted to post an update to my "research" about drakensang.

I played around with the pointer scanner but had no luck so far, so i took a deeper look at the disassembly to find out, what was going on. I already found the piece of code that was altering the memory address accordingly, and the full function that is called is this: