Cheat Engine

[pfunkyfize]

Hey there,

I am an old COBOL programmer that just found this Cheat Engine tool. I'm new to CE but not new to programming. I think this application is great for scanning purposes but I would like to dive into the theory of how to find what you're looking for in a game's memory if what you're looking for can't be found on the first few attempts... I want to be able to understand the logic of when to use certain functions of CE.

A hypothetical example:
Let's say an RPG game developer wanted to hide the number/value of 'Gold Coins' in a game to dissuade hackers to find its address and change its value on a couple of search passes through CE. The dev comes up with a simple algorithm to breakup the gold value by allocating 7 separate integer variables. variable 1 contains the 1s value, variable 2 contains the 10s value, variable 3 contains the 100s value etc...
Each variable has its own 4 byte space allocated to it.

If a player's character in the game owned 2,789 gold coins, variable 1 would contain the value 9, variable 2 would hold 8, variable 3 would have 7, variable 4 would contain 2 and the remaining variables would still be at their initialized state of 0. The dev's reasoning would be that a memory scanner searching for '2789' would never find it because the number isn't represented in its entirety to be found which would thwart the lazy hackers at least

Whenever a function of the game modifies the gold amount of a character, it goes through a simple arithmetic procedure to break up the number and stores results in the appropriate 7 variables/addresses. When a player opens her inventory to check the amount of gold and equipment she has, the game does the respective multiplication operations on the 7 variables, then sums them together and finally displays the results to the screen.

A novice hacker playing the game has no clue as to the algorithm used to represent gold in the game so when they search for 2789 the results come back with a bunch of results (all bogus of course) and when the character dies in an unfortunate vampire encounter and loses 250 gold coins before reviving again, the search results for 2539 gold in CE comes back with zero results.

For the veteran CE users:
How does one go about finding the value of the 7 variables/addresses associated to gold coins so as to be able to modify them using CE alone and with no idea how the gold coins were represented by 7 distinct variables/addresses? How would you even begin to solve this given the unknowns in this problem from the hacker's perspective?

I want to follow your logic on how you would use CE to solve this because today's games are starting to be very tricky in the way they hide important values like money/ammo/attributes/lives etc. It has been a while since I had an assembly class but I can still follow the logic and the common opcodes. All a novice hacker would see in this example is that their search will be fruitless for the gold representation and I am at a loss as to what to try next in solving this problem, having no experience with this.

There weren't memory scanners like this when I was coding on giant mainframes so i appreciate any 'pointers' you all may have. Pun intended

Thanks!

[Dark Byte]

First question would of course be: Why would someone even bother protecting stuff like that in a single player game? Just let people mod their games as they see fit (If it's online gold wouldn't even be stored on your comp so no need to go through this length anyhow)

As for finding it there are multiple options.
First one a novice would do is doing a changed/unchanged value scan and then randomly freezing/changing a few of the results and see what effect it has in the game

Another one for the more advanced cheaters is finding the place where the final gold address is assembled into a real number and displayed on the screen (string form). It's not the actual address but related. From there you can trace back and try to figure out how it get's the value. Then possibly doing a code injection at a place where the full value is in memory(stack) because you need to do a calculation on it and modify the result

And another method even more experienced cheaters would use would be to use a profiler like 6.2's ultimap. You spend money and tell the program that the code that writes money has been executed
Then you do some other stuff and tell it that the code that writes money has not been called.
Repeat a few times and you will have a list of code addresses that get executed only when money has been written. From there try to figure out how it is stored.

Of course, if all else fails just do a complete decompile of the program. First find out in what language it was written and then use a decompiler and try to find out how it works

And alternatively, find out the location where the prices of objects are stored and modify those. A useless rock will be worth 1000000 if you sell it and a Vorpal sword + 1000000 will cost 0

[pfunkyfize]

Thanks!

I was beginning to realize that this process is really ripe with trial and error and you just have to try certain things. Seems like there is no real silver bullet in tracking down where data lives. The example as crazy as it was is a hypothetical one, i needed to know if CE has the ability to track back like you said and find the computations that use all the registers. *thumbs up*

An example in Saints Row 3rd had money with a '00' added to the end of the value to dissuade hackers finding the amount on a first pass but after going back and trying the 'novice method' to find the amount by doing unchanged/increased searches i found a number that paralleled the growth of money except with two '00'. Bingo.

Is it a safe assumption that CE can find all memory locations being used by a program? The pointer functionality leads me to believe that even memory created on the fly at runtime can be found so is it a fair assumption that if you don't find what you're looking for in a search that it's because you're using the wrong search type (float instead of integer etc.)?

Thanks for answering these newb's questions because everyone crawls at one point in their life *thumbs up*

[Dark Byte]

Actually, often normal programming methods are seen as things as ways to dissuade hackers.
Your example of saints row is actualy the result of using the 'money' floating point whichs stores the real value and cents into a decial value and when used divide by 100
This money type is also used in civ 5

Ce doesn't support this type by default(It's a stupid type), but you can add it with the custom type feature

Also, if you don't know the type, you could try the all type

And yes, pointers deal with the memory allocation at runtime. A program needs to know how to find the allocated memory, so that information can be used by ce as well

[Recifense]

Hi guys,

I faced a game that is using SQLite. Resource values, for instance, are stored sometimes as a 3 bytes integer and sometimes as double float (8 bytes long). And to complicate a little bit more, the database changes place during every turn.

Cheating is getting more and more amusing.

In case of this game, it's one of the reasons it is so slow.

Cheers!