Cheat Engine

bld01 · How do I cheat? Reputation: 0 Joined: 14 Nov 2010 Posts: 8

Hello all,

I use cheat engine for a while, some games are really too hard to finish ^^ But I like to code and I tried to make a trainer for supreme commander. This game is prety cool, not too hard but I took it for exercice Wink

The point is to have illimited ressource (mass and energy).

First I tried to find the adresses of the mass -> found ! there is a float value.

So I tried to make a trainer that change the value on this adresses, It runs but if you change the map, it fails so I guess the adress is changing everytime a map is started.

I though it's better to find the instruction that write the value at the adress of mass : found ! it's a ...

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

Yep, usually codes that are writing to an address are shared. Look for addresses that are reading Your value. Use the "Find out what acesses this address". To find all codes that are reading or writing to from/to the address.

bld01 · How do I cheat? Reputation: 0 Joined: 14 Nov 2010 Posts: 8

Hi Geri,

thanks for help ^^

ok i have some news :

First I put a breakpoint on the movss instruction, with that, i found the adress of the amount of mass for the AI player. When I make a memory scanning with this amout, it found 2 adresses wich contains this amount. If I search the amount of mass for me (the player), I found 4 adresses.

So i guess that the 2 more adress for the player are specefic to him.

I have to investigate more, but I think I'm on the good way Wink

EDIT :

Yep all,

I got it I think but I block to code it.

I found that the adress of the amount of the mass of the player have everytime this form : XXXX035C (and XXXX0358 for the energy)

So it's simple to add to the routine which write the amount of ressource in the adress a code able to detect the last 4 numbers of the adress.

But my code fail, the cmp never match....

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

Now this code has more than one error.

1. When You use a register for Your own purposes, You can't just change it to 0 after You are done with it (unless it was 0 before You have changed it). You need to use the push and pop instructions. push is saving the register in the stack, and pop is loading it. so at the start, You should use "push ebp" and at the end "pop ebp" to restore it's original value.
I usually use pushad and popad which are saving/loading all register values. In some cases, You may also need to use pushfd and popfd to save the flags too, which is in this case may be changed by the cmp instruction.

2. XXXX035C is stored on 4 bytes. You can store 00-FF on one byte. Addresses are stored on 4 bytes with 8 hexadecimal digits. So 035C is actually 2 bytes only.

3. By using [ebp+4], You have compared the value on the address, not the address itself. EBP+4 would be the next address after XXXX035C anyway.

4. Don't use EBP, ESP, and EIP for Your own purposes. First 2 is needed for stack operations and EIP is pointing to the next instruction in the code, thus changing it will create a jump to the address that it is containing. Changing any of them just to store some values will most likely result in interesting tough undesired outcomes, like crashes.

5. If You want to check only some bytes of a register and not all 4 of it, check this table to see how they are built up.

http://www.sandpile.org/ia32/reg.htm

And finally, I am not sure how it is working in Supreme Commander, but there were codes in SupCom2 which was reading the player's resources only and I think there is a 90% chance that SupCom has some codes too.
Checking the last 2 digit of the address will probably not work anyway, because the enemy has the same player structure so probably it will work for the enemy too.

Proof of my theory if the value that You have found has some copies that the enemy don't have. Search for all the codes which are accessing to Your resources and You will probably find at least one which is accessing to Your resources only.

If You wouldn't find any codes that are accessing to Your resource only, You could still check the code to see how is it copied to another addresses (but this may be a long process) and You can also search for unique data in the data structure with the data dissector in CE. Using the last 2 digits of the address will probably not the best approach, but as I said, I didn't look into that specific game, I have made cheats for SupCom2 only.

EDIT:
Yeah, I may be remember wrongly, I see I have used cmp [ebx+04],0 to check if the resource is the player's or the computers in SupCom2. And the resources were stored this way.

[ebx+38] energy
[ebx+3c] mass
[ebx+40] research

Maybe the player ID is the same or similar in SupCom too. Just check the data structure. Or backtrace where are those copies for Your resource values coming from, if they are copied only for You.

bld01 · How do I cheat? Reputation: 0 Joined: 14 Nov 2010 Posts: 8

Thanks for this accurate answer.

ouch, I have to study a little more the x86 asm ^^ I know only (basically) the c64 asm ^^

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

If EBP = XXXX035C, then EBP+2 = XXXX035E, not the last 2 digits of the EBP register. The last 2 digits of this register are stored on BP.

Open this table:

http://www.sandpile.org/ia32/reg.htm

Now see the first register, EAX. It is a 32-bit register, so it is stored on 4 bytes. The last 2 bytes can be referred as AX, the 3rd byte as AH and the 4th byte as AL.

In Your case, the last 2 bytes of EBP are BP. Which means BP=035C.

Of course You can use an allocated variable for the compare, but still, You need to be aware that storing EDI+2 on the variable will not be the last 2 digits of EDI, but XXXX035C+2, which is XXXX035E. The last 2 digits can be referenced as DI. Try to save BP or DI on another register or value and see what happens in the debugger. You will see how is it operating with the values.

Anyway this method may work in this game, but I have never tried it.

It was easy to find a player ID in SupCom2 though. The code to change the mass has looked like this:

SupremeCommander2.exe+4BA2CB Change Mass :mov edx,[ebx+3c]

For the energy:

SupremeCommander2.exe+4BA2C8 Change Energy :mov ecx,[ebx+38]

And for the research:

SupremeCommander2.exe+4BA2C5 Change Research :mov eax,[ebx+40]

As You can see, they are stored right after each other in the data structure. I have compared the data of my structure and the enemy structure from EBX, and came to this conclusion:

If the value on [ebx+04] is 0, then the structure belongs to the human player. If not 0, it is an AI controlled player's data. So my script was simply like that:

cmp [ebx+04],0 //check player ID
jne +7 //jump if not player
mov [ebx+3c],47C34F80 //change mass to 999999999
mov edx,[ebx+3c] //continues the original code

Now this is a much more reliable method and it was easy to find it too, so maybe You should check if You can see some similar player ID in SupCom. If You use the data dissector in CE, You can easily compare data structures and see what is common or different between Your data structure and between the enemy's. Then You can make a compare for that data to see if it is Your resource or not and make the neccessary steps according to that.

bld01 · How do I cheat? Reputation: 0 Joined: 14 Nov 2010 Posts: 8

Hi there,

So the 035c method fails, it finally changes. Sad

SO I try your method Geri, but I found nothing valable. I analyze the data structures of the players but nothing seems to be different bewteen them, here's an example (human player):

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

I see You have found out how to use the dissector, but You are missing one thing. You have to compare them from the base address of the data structure. The base address is usually the register between the brackets.

In Your case, it is seems to be edi, but it is obviously not. That is just a code which are changing more types of data. However looking at Your code, I see that some codes are using [edi+1c] usually. So I would say that

bld01 · How do I cheat? Reputation: 0 Joined: 14 Nov 2010 Posts: 8

Yep Geri,

I think it's okay ^^

I compare 4 players, but when I check EDI-1C, I saw nothing....

So I think maybe have something before that. I check the 4 players with EDI-2C, I redefined the structure and this is what I found :

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

Yeah, it seems base address+08 is the player ID.

Sometimes the value types are not correctly recognized but the data dissector is still very cool and mostly accurate. A double-check never hurt as You have found out Yourself. Now it easy from here, You need to write the script only and build armies to kick ass.

bld01 · How do I cheat? Reputation: 0 Joined: 14 Nov 2010 Posts: 8

YEAH!

It runs ^^

I made a code injection with this code :