Cheat Engine

[pronkyou2]

Oh the lovely fun. I learned a little from just lurking these forums, but there's some things that I just can't do alone. Enough, here's the case:

EDIT: Pointer scanning returns 100m+ results, and drops to 0 after a few rechecks.

All the PC values are in doubles because Iji was made in Gamemaker, and the addresses reset every time I relaunch the game but stay the same if I reset or load the save file. Fun bit is that Gamemaker sciences some weird subtraction through the use of the following tidbit:


iji.exe+2A73 - lea esi,[ecx+esi-04]
iji.exe+2A77 - lea edi,[ecx+edi-04]
iji.exe+2A7B - sar ecx,02
iji.exe+2A7E - js iji.exe+2A91
iji.exe+2A80 - std
iji.exe+2A81 - repe movsd
iji.exe+2A83 - mov ecx,eax
iji.exe+2A85 - and ecx,03
iji.exe+2A88 - add esi,03
iji.exe+2A8B - add edi,03
iji.exe+2A8E - repe movsb
iji.exe+2A90 - cld
iji.exe+2A91 - pop edi
iji.exe+2A92 - pop esi
iji.exe+2A93 - ret


The address iji.exe+2A80 is the only operation that comes up as writing to the health/ammo/whateverIputin. Set direction flag. I also can't set any breakpoints because this little section is in constant use and doesn't like to stall. It's called from over 20 different functions so I can't backtrack it.

I have no idea what information I'm missing, so here's the write check (does it twice every time):

00402A7B - C1 F9 02 - sar ecx,02
00402A7E - 78 11 - js iji.exe+2A91
00402A80 - FD - std <<
00402A81 - F3 A5 - repe movsd
00402A83 - 89 C1 - mov ecx,eax

EAX=00000010
EBX=0C863054
ECX=00000003
EDX=0C863054
ESI=0012FB40
EDI=0C86305C
ESP=0012F6A8
EBP=00000001
EIP=00402A81

I know how to inject code, I figured this would be a good next challenge, call it "weird pointers". For those who want to have at it themselves: www dot remar dot se/daniel/iji.php