Cheat Engine

Kyokyonos · Newbie cheater Reputation: 0 Joined: 14 Apr 2009 Posts: 19

So I was messing around with Dolphin Wii (had to use 32 bit version) with CE and ended up finding a code that, when nop'd, provides a desired effect. However, when restarting the game completely, the code locations change!

105F86DE, for example, would yield opcodes 'mov [edx+818],cl' (which, at this location, is what I need to replace w/ nothing), but on a complete restart, the same address (105F86DE) would yield something like 'add[eax],al' so nop'ing it would not have my desired effect ]:

I already know how to find pointers that point to addressees so I can easily change values, but this is my first time seeing the codes change. Can anyone link me to a guide regarding this (if it's possible)? Come to think of it, I don't think I could find pointers on this either ;x... I've looked and searched but I can't quite describe this behavior in a search that would get me to the right guide. Can anyone point me in the right direction?

Pingo · Posted: Tue Jun 22, 2010 1:54 am Post subject:

Looks to me like the game is codeshifting.
Try this next time you get that address. Add the address manually so you can see the value (dont nop it). Tick (also scan read-only memory) and scan for the value of your address. You should see it in the new scan list but it will be green. Double click it to bring it down. If you look at this new address it'l look something like this game.exe+XXXXX or it could be a .dll
Use that address.
So instead of writing your code like this
105F86DE:
//code

do it like
game.exe+XXXXX:
//code

The address should update after restart.

3XTR3M1ST · Posted: Tue Jun 22, 2010 3:37 am Post subject:

is that like a pointer thing?

Dark Byte · Posted: Tue Jun 22, 2010 4:36 am Post subject:

no, it's just an alternate method of writing an address which takes care of code shifting

an easier way to find that notation is just going to that address in the disassembler and press ctrl+m

Evil_Intentions · Posted: Tue Jun 22, 2010 5:16 am Post subject:

Pingo · Posted: Tue Jun 22, 2010 12:14 pm Post subject:

Kyokyonos · Newbie cheater Reputation: 0 Joined: 14 Apr 2009 Posts: 19

Radiation · Posted: Tue Jun 22, 2010 3:17 pm Post subject:

oh yeah, the code "add[eax],al" is 00 00 in hex... so your code must have been shifted

Pingo · Posted: Tue Jun 22, 2010 3:28 pm Post subject:

Kyokyonos · Newbie cheater Reputation: 0 Joined: 14 Apr 2009 Posts: 19

Pingo · Posted: Tue Jun 22, 2010 4:33 pm Post subject:

Run this small app i just made Link
All you need to do is paste that address in the top box on the app (game needs to be on aswell). It should show you the static address im talking about.
Should work for any code injection address you need.
I have no way of testing it so let me know how you get on.

Kyokyonos · Newbie cheater Reputation: 0 Joined: 14 Apr 2009 Posts: 19

Dark Byte · Posted: Wed Jun 23, 2010 5:04 am Post subject:

if it's actually a .net, java or flash game then it's generating the code at runtime.
In that case you must use autoassembler scripts that make use of the aobscan function to find where the code is located (make use of wildcards on addresses in code)

Pingo · Posted: Wed Jun 23, 2010 11:10 am Post subject:

I was only assuming the address was located in the game.exe.
It might be loaded from a dll, in which case that app wont work.
Keep trying what i suggested before. You'l know for sure.

Kyokyonos · Newbie cheater Reputation: 0 Joined: 14 Apr 2009 Posts: 19