Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Some Help with AA

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
haunted5
Cheater
Reputation: 1

Joined: 23 Aug 2011
Posts: 35

PostPosted: Tue Aug 23, 2011 7:16 pm    Post subject: Some Help with AA Reply with quote

Hi Guys,

I have been making basic cheats for a while now. Generally I would use pointer scans to get the addresses I wanted. These days I have been trying to write AA scripts in order to make cheats.

I would like some help with the following:

Making a Health cheat that doesnt effect enemies:

So generally when i try a health script, I would find the value for Player and an enemy, compare them via dissect code, find something that differs between the two and always stays that way so my cheat will work through the whole game. I am currently trying dragon age origins. When I compare the health value for Player and Enemy, there is nothing I can use which is different but stay the same levelling up ingame or next time I load the game. So my question is, where do I go from here. What else can i try to identify player from enemy.

Experience Modifier:

So basically I have the value for experience. I want to make an experience modifier. The problem is that the new exp value comes off the Float stack and so i cannot double it to get the modifier result i am hoping for:

For example:

Lets say EXp = 0
I kill something and get 50 exp
The value 50 is copied from stack and i can add code to double it(using fmul) but next time i kill something ingame, lets say i get 40 exp. The float from stack will not be 40 , but will be 90 (50 + 40). Because the float is already increased in someother part of code, how can I find the place where it has been increased. I tried searching for 50 when i get 50 exp followed by next scan of 40 for next kill, but eventually i get 0 values. Any ideas would be appreciated.

Strangely enough when i try to explore the stack value that got me my exp value, it contains random numbers every now and then but mostly zero. Here is a code snippet:

00666B30 - d9 44 24 04 - fld dword ptr [esp+04] >>>> This is Exp loaded from stack
00666B34 - d9 59 4c - fstp dword ptr [ecx+4c] >>>> This is value stored and popped into my Exp address

Thanks In advance guys

And since its my first post, Thanks Dark byte for this awesome software that has made gaming fun for me again

Very Happy
Back to top
View user's profile Send private message
Corruptor
Advanced Cheater
Reputation: 3

Joined: 10 Aug 2011
Posts: 84

PostPosted: Wed Aug 24, 2011 3:04 pm    Post subject: This post has 1 review(s) Reply with quote

Quote:
When I compare the health value for Player and Enemy, there is nothing I can use which is different but stay the same levelling up ingame or next time I load the game.


Just to make sure i understand this: you compare the health values?
Just in case you really do (otherwise: ignore this): theres a tool called "dissect data/structures". Its a little bit tricky to use. find a few adresses of enemys and allies and paste them into that tool.
Geri made a tutorial about that tool, i'd recommend reading it:
szemelyesintegracio.hu/cheats/41-game-hacking-articles/230-dissect-data-structures

For the expierience stuff, the only idea that comes to my mind is using the backtrace function.
Heres just another tutorial by Geri (dam, he made a lot of usefull stuff. Thanz a lot, Geri Very Happy)
szemelyesintegracio.hu/cheats/41-game-hacking-articles/225-basic-encryptions-debugging-backtracing-and-some-info-on-the-stack

If its all just about doubling the exp you got, u could try to calculate.

Code:
//00666B30 - d9 44 24 04 - fld dword ptr [esp+04] //this seems to write your new exp, located at [esp+04] onto the stack
//00666B34 - d9 59 4c - fstp dword ptr [ecx+4c] //that one pops that value into the adress [ecx+4c], witch is your actual exp value.
//that would mean, that [esp+04] - [ecx+4c] would the the exp you just gained.
//do something like this:
fld dword ptr [esp+04]//writes new exp onto the stack (still :D)
fsub [ecx+4c] //now you have the exp you got
fadd [esp+04] //now you have the exp you got + (your xp + the exp you got) |
//meaning: 2*the exp you got + your xp
fstp dword ptr [ecx+4c]  //ready to pop the value now


Ps: ym i had 2 cut the http's and the www's. Cant post urls here it seems Rolling Eyes however, copy n pase should work
Back to top
View user's profile Send private message
Acubra
Advanced Cheater
Reputation: 0

Joined: 19 Jun 2011
Posts: 64
Location: C:\Windows\System32\HoG

PostPosted: Wed Aug 24, 2011 4:41 pm    Post subject: Re: Some Help with AA Reply with quote

haunted5 wrote:

Lets say EXp = 0
I kill something and get 50 exp
The value 50 is copied from stack and i can add code to double it(using fmul) but next time i kill something ingame, lets say i get 40 exp. The float from stack will not be 40 , but will be 90 (50 + 40). Because the float is already increased in someother part of code, how can I find the place where it has been increased. I tried searching for 50 when i get 50 exp followed by next scan of 40 for next kill, but eventually i get 0 values. Any ideas would be appreciated.

Strangely enough when i try to explore the stack value that got me my exp value, it contains random numbers every now and then but mostly zero.

Very Happy

As far as i understood you tried to double the exp you gain, but failed because the exp value gets modified before or after your code? Maybe you just found the wrong place to patch?!
Back to top
View user's profile Send private message
haunted5
Cheater
Reputation: 1

Joined: 23 Aug 2011
Posts: 35

PostPosted: Wed Aug 24, 2011 7:00 pm    Post subject: Reply with quote

Thanks very much corruptor,
That idea about EXP is what I should have done. For some reason i didnt think about it even though its so simple Very Happy I just need to subtract the two and go from there.

I did use the dissect data option by following Geri's tutorial, but I have compared the values (not just health but the whole structure) and found nothing i can use. Some values are different that i can use but it seems either they change next time I load the game or they change as I progress in the game. So I was wondering if there was any other ideas I could use.

I will look at the backtrace tutorial you mentioned as I dont know how to go about it. Thanks again
Back to top
View user's profile Send private message
gaming04
Expert Cheater
Reputation: 0

Joined: 06 Dec 2010
Posts: 190

PostPosted: Wed Aug 24, 2011 10:28 pm    Post subject: Reply with quote

There's one method I have been using recently that avoids the use of a structure: Pointer Comparison. When all else fails, you compare the pointer address to see if it points to the player's pointer. This is easy stuff once you understand how to find the base pointer of the player.

I wonder if anybody else knows this and is not willing to part with it.
Back to top
View user's profile Send private message MSN Messenger
haunted5
Cheater
Reputation: 1

Joined: 23 Aug 2011
Posts: 35

PostPosted: Thu Aug 25, 2011 11:19 am    Post subject: Reply with quote

Hi gaming04,

Please do elaborate or link to some tuts that tell us how to find the base player pointer.

Thanks
Back to top
View user's profile Send private message
gaming04
Expert Cheater
Reputation: 0

Joined: 06 Dec 2010
Posts: 190

PostPosted: Fri Aug 26, 2011 1:51 pm    Post subject: Reply with quote

I learned this technique on my own because Geri's method never worked for me. So that means no tutorial links for you.

First, you need to dig all the way down and find the player's base pointer.
Such as: "***.EXE+0000ABCD"

...a lot of offsets...

Then, compare the pointer currently in use for that code to the player's pointer. If it matches, then the code is currently being used for the player.

Example AA:
Code:

newmem:
push eax
mov eax,["****.EXE+0000ABCD"]
mov eax,[eax+08]
mov eax,[eax+24] //Player pointer found here.
cmp esi,eax //Pointers are compared here.
jne originalcode
//Player exclusive code, here...
...
...
//...player exclusive code ends.
originalcode:
pop eax
mov [esi+0C],01 //Variable inside pointer structure


Base pointers are basic stuff found in the tutorial forums. Have a look there first.
Here are more reference scripts:
...
http://forum.cheatengine.org/viewtopic.php?t=540283 << This is where I first discovered the technique. The script [Attack Speed+] is using this technique.
Back to top
View user's profile Send private message MSN Messenger
haunted5
Cheater
Reputation: 1

Joined: 23 Aug 2011
Posts: 35

PostPosted: Sat Aug 27, 2011 7:00 am    Post subject: Reply with quote

Ok, Thanks for that ..

I am currently trying to understand how to use back tracing. I will look into player pointers after this.

Thanks again
Back to top
View user's profile Send private message
haunted5
Cheater
Reputation: 1

Joined: 23 Aug 2011
Posts: 35

PostPosted: Sat Aug 27, 2011 8:27 pm    Post subject: Reply with quote

Ok gaming04,, i think I understand what you have posted about base player pointers. Would I be right in assuming that you would get the same result by using a pointer from a pointerscan with the lowest offset? What I mean is finding good pointers via pointerscan and then choosing the one with the lowest offset in the script to compare pointers?

Thanks
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites