Cheat Engine

[Fresco]

[mac13]

When I go to the address you gave me (73A3026) it only says "add [eax],al", so I suppose this is not it.

If in the huge list of memory viewer I choose "search/find memory", check "Array Of Byte" (default: from 00409000 to 7FFFFFFF) and paste in the "AOB scan" value you gave me, it says "nothing found".

So I have to find it manually...
when I find my gold value in my first search and then click "what writes to this address" (find "mov [ecx+10],eax"), and then I choose "show this address in the disassembler", should I look below or above this address for the "mov [edx+10],ecx" command?

Also in the "memory viewer" when I choose "search/find assembly code" and type in the "mov [edx+10],ecx" you gave me to find the memory address, it makes a list with about 30-40 findings. Then I go to each one of these addresses and what do I do next?

I tried finding the "call eax" command before it (above it), right-click on it and choosing "break and trace instructions", type in "36" that you told me and it brings up the "tracer" window. Then I make a change in my game's gold and still nothing appears in the tracer.

Then I tried to "break and trace" the addresses that came up with the "mov [edx+10],ecx" command, then "show what writes to this address", every time by making a change in my game's gold and from some of these addresses, I managed to get a list of other addresses.
I found the one that looked different withing them but it seems that I'm not able to change its value to try it out. How do I change it? I only know how to change the value of addresses that I find in the first CE window, where you double-click on them and you type a new value in.

I'm sorry for the trouble but it seems that I'm still missing something...

[Fresco]

well yes, i have to admit, i made that code in like 4 minutes and didn't payed much attention to it.
the code is not placed in a module, so the codes address might change, perhaps that's why when you got to the address that i gave you, you got something else
as for the aob scan, my bad, i actually thought that the two functions were always together, they are not, perhaps the function that goes immediately after the one that menages the gold it's not always the same, so that might mess up the aob scan a little bit.
sorry again, but with all the info i gave you, you should've found already that real gold address ?
try the new aob scan :

[mac13]

Thanks for the yet another reply!
I'll study the new info shortly, when I have some more free time and come back to you.

Damn! This aob scan seemed too long for me and after my fisrt few searches, I tried to make the scan shorter (of the first line only), but unluckily it still contained the "CC CC"s, so it still couldn't find anything.

[Fresco]

If the aob doesn't work, really, try finding that code yourself, i mean, you have a step by step procedure above

[mac13]

My 1st mistake was that I was looking BELOW the address in the disassembler for the "call eax" command and not above it, because I thought that the previous procedures were below. Now it just sounds silly to me to do that, but I think I got confused atm.

Search AOB "89 4A 10 8B 4D F0 89 0D 4C 80 C7 00" --> nothing found

...and sorry, but I could do nothing more when I followed the step by step procedure.

What I did (2 pictures below):
(according to the step-by-step guide)
- I find the gold value that changes immediatelly
- Choose "what writes to this address"
- Change gold in-game and I get "mov [ecx+10],eax" address (count 1)
- I open it in disassembler
- Locate "call eax" command (3 lines above it)
- Choose "break and trace", type in 36 (IDK what this "36" is anyway...)
- Make a change in gold in game OR from CE main window to the address found
- I get a list under the "call eax" function in the tracer.
- I look for the "mov [edx+10],ecx" command... NOT THERE!
(what I tried later):
- Start adding ALL the addresses that have "mov" inside to CE main window, one by one, by pressing the "add address manually" button
- Frozen 1st address
- Made a change in game's gold --> gold changed as it should (not frozen)
- Frozen them one by one, each time with a gold change --> (not frozen)
- Searched for another "call eax" command before the one I found
- Made a gold change --> nothing appeared in the tracer (as expected)

So, should I try to add/freeze ALL the addresses shown under the correct "call eax" command 1 by 1, or only the ones with "mov" inside, as I did?

PS. They should really add an "add address in the main CE window" function from the tracer window in the next version, so we don't have to type them in manually.

[Fresco]

[mac13]

@Fresco

I finally did it!
With your help of cource...

It's the "mov eax,[edx+10]" command that writes to the real money address.

BUT.......
according to your instructions, it took me a while to do it, because I understood that I should add (for example: edx+10), with "edx" memory address taken from the "what writes to this address window" and not from the addresses of the "tracer window" (when they show up to the right if you click to each one of the "call" sub-commands.

Any advice of how I can find the value that I should type in this memory address, so I can have an EXACT gold amount?
As an example, when I put 500000 my gold goes to 594291 and when I put 100000 it goes to 997000. It doesn't make any sense to me, or it must have a "multiplier" or something... but I guess I can experiment on that now...

Anyway, THANKS A LOT for the help and your time.

Let's see if I can find the experience values now...

PS. I tried exporting a trainer (never tried that before), but it seems that it has some problem with the addresses that change in each game run, so the trainer is not working.

Just to add, that when you finally change the address value and the new gold shows up in your game, you must buy/sell something from within the game, so it REALLY registers into the game's memory. What I mean is that if you exit (autosave) your game, without first altering your (new) gold amount (within the game), your new gold amount won't be there when you load it up again.

[Fresco]

it's good to hear that
phew, you finally understood.
next time, let me give you a tip and a working aob
tip:
trace the call eax with 19 instructions, the last one should have the pointer of the real money address.
this is the working aob, the previews one didn't work because there was a value that changed, in the code, very strange thing, but, that's why.
real working aob.
notice: this aob doesn't return the exact location of the code that writes to real gold address, but it's close enough for you to understand where it is located.
if you use the disassembler, just add an offset, for it to return the real code.
like this:

[mac13]

Thanks!

The character's experience seems to work in the same way as gold, but it's a bit more risky to mess with, because of the "weird" value in the real memory address (962771 gives you 128 exp, while 962760 gives you 155 exp). It needs to be set in the exact number you want (because of the Level capacity of the game) and this is not possible until you know the "pattern" that this value is calculated in the real memory address.

[Fresco]

can you post the aob for that ?
check if it works first.
and give the instruction.
aob
and instruction

anyways
i have here the solution for exact money
so, if you want 10 gold you have to do this:
10 xor 962643 = 962649
type in the real address value : 962649 and you'll have 10 gold
cheers
-here's an auto assemble code that will basically do no changes, but help you finding the code faster
just go to address goldcode
an it'll pop up the code that writes to the real gold address

[mac13]

Thanks!
The xor thing works fine for the money and for the exp as well.

Do you mean you want me to give you the aob scan for the experience?
IDK where to look for it.
Maybe the image can help you on this (highlighted in red is the real exp address).

The first instruction (what writes to this address) is "mov [esi+10],eax".
The second instruction (into call eax) is "mov eax,[edx+10]", exactly the same like the "gold" one.

[Fresco]

yep, that works, thanks.
though i can't figure why it stops upgrading after level 10 ?
any clue or requirements ? obviously i have the required XP points XD.

[mac13]

Yes. You need to upgrade you "hero's room" in your castle screen once, before you can level further to level 20. Twice for level 30, etc...
The game's final level cap, is level 100.
Try to do a simple 4 byte search for the level number of your character and once you find it you can change it immediately without having to even upgrade your hero's room. It may take a few searches, because it is a 1 digit number and that makes it more difficult to trace, but doesn't need any other mumbo-jumbo like "tracers" or "memory viewers". You just change it's value from the main screen and if you found the exp address already, you can mess with it (lower and increase it) in order to find easier your level number mem address.
I managed to level up my warrior up to level 432 and the other two classes up to level 452. After that there are too many skill points to spend in the skill trees, so the game doesn't "let you out" of the skill screen before you spend them all and you'll be "trapped" in there.
Of course you can find your skill points and adjust them with CE, but you'll have the same problem later on again.

So, will you tell me if my highlighted line in red is the aob scan?

[Fresco]

humm yes, you're right, the game does seem to have some sort of protection against point hacking, i upgraded all my abilities to max, but with no next button, you know to get out of the upgrade window, and sometimes appeared an X to close the upgraded, but no change would then be applied.
no, the aob is this :