Cheat Engine

justa_dude

Hi folks,

I've been having a blast playing with CE the last couple of days (thanks DB and friends!). It's so versatile, and yet so specialized - things that are a real chore with Olly or even Ice are made so easy! I'm currently learning the powerful auto-assembler and script-engine features, and they are just amazing! Unfortunately, I've hit a little snag and I'm not quite sure how to interpret what I'm seeing. Thus, my plea for help.

So, my target game displays the player-character's wealth on the screen. The value it reads from changes from time to time (game reloads, reboots, etc). Since finding a static address for the money is a tremendous challenge, even with the outstanding pointer-scanning tool, I looked for the code that is constantly called to read this value and update it hoping to snag an address there. I think that I've done this properly, because if I enable my injection in the CE table and choose to "find what writes" the variable my symbol references, then I can see that the correct address to player-character gold is being stored with the disassembly view. Unfortunately, setting a "watch" on the symbol in the table editor never shows me the address I'm expecting. I'm a little confounded, to say the least.

The only thing I can think of that would cause the discrepancy is if the code that I've targeted updates values other than money. Unfortunately, I can't set a breakpoint because it's a direct-x game and will prevent me from alt-tabbing back to the cheat engine. I have watched the original code, though, and I've never seen it use the values I'm seeing in my symbol. Anyone have ideas as to what's going wrong or how I might approach the problem from another angle?

Thanks in advance,
adude

justa_dude · Posted: Fri Jul 02, 2010 7:28 pm Post subject:

Anyone have any guesses? Is my cave getting executed from somewhere else the only possibility?

Dark Byte · Posted: Fri Jul 02, 2010 8:00 pm Post subject:

that code that accessed the money is probably also used by the comp player (or it's actually a multi-purpose piece of code, e.g scripting and used by almost everything for showing ammo, to determining the color of a brick)

example: If it's done in a loop e.g first player 1(user), then player 2, player 3, etc... then the address you'll see at money_base_address will be that of the last player

easiest way to find out if it's used by multiple things is rightclicking the code and choose "Find what addresses this code accesses"

justa_dude · Posted: Sat Jul 03, 2010 5:11 pm Post subject:

Thank you for taking the time to look at my issue, DB. You suggest right-clicking the code and choosing, "find what addresses this code accesses." The only thing I see is the same value that's in the money_base_address variable. And this value never seems to match the address that I see in the disassembly snapshot. If I were setting breakpoints, would the two values always be the same?

Also, sometimes when I go back and view my code, it has been changed. I only have one script that is active, and the code is pretty trivial:

XaLeX · Posted: Sat Jul 03, 2010 7:41 pm Post subject:

Just a little note about your code: not sure if this can be a problem, but dealloc takes only one parameter, that is, the label. No size as CE already knows it.

justa_dude · Posted: Tue Jul 06, 2010 7:38 pm Post subject:

Thanks, guys. You were 100% correct.

I added a little sanity check to see if the value was in a reasonable range, and now I'm grabbing the correct address 100% of the time.

Thanks for the help!

Regards,
Adude