 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
o27897
How do I cheat?
![]() Reputation: 0
Joined: 29 Oct 2012
Posts: 5
|
 Posted: Mon Oct 29, 2012 9:29 pm Post subject: I need someone explain this problem. No pointer, just static |
 |
|
I'm trying to cheat this mini game: Abra Academy 2: Returning Cast
Problem is i can't control the value of the hint when i play. It's hard to explain but please read my word:
I have 5 hints inside a ball, click ball = release hint. As usual, when you freeze or change your value in CE, this will affect in game. For instance, i change 10 for my hint, In this case, my 10-hint still in the ball, but when i click the ball, nothing happen, no more hint! But, when i ESC to menu, and then go back game, i have 10 hints enabled - release hint when i click! "Find out what write to this address" does not help me much (or i don't know its power) There are 2 addresses remain, 7E8E4670 is the real to change value of hint, the other is the value at the line: Hint left:... (this is taken from above too)
And more issue i don't understand is when i use olly to put a hwbp to find what access to hint address. If you know olly, you can try that first you will see the mov [hint-address], 5 and then F9, NO-BREAK but you will see your value will extractly equal remain hint when you play game. I see this value come from saved file in
C:\Documents and Settings\ComputerName\Application Data\Abra Academy2
But i don't know why my olly does not break when this value change.
You can get full version here:
pass: www minigame vn (replace space by dot)
| Code: |
70~ MB
Mediafire: ?o9oco0c31xddcvz
|
|
|
| Back to top |
|
 |
Nibelton
Master Cheater
 Reputation: 1
Joined: 18 Mar 2011
Posts: 265
|
| Posted: Tue Oct 30, 2012 3:14 am Post subject: |
|
|
what engine used for this game ?
don't use "exact value" use "decrease" or "changed"
sometime your "current" value only shows how much you DIDN'T used,not how much YOU STILL HAVE i.e. use 1 point,seach for 1,then use 2nd and search for 2 and so on.
|
|
| Back to top |
|
|
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Tue Oct 30, 2012 8:28 pm Post subject: Re: I need someone explain this problem. No pointer, just st |
|
|
| o27897 wrote: | | For instance, i change 10 for my hint, In this case, my 10-hint still in the ball, but when i click the ball, nothing happen, no more hint! |
Ah you're quite lucky there, when the game shows 0 hints in the ball, but the hint count is frozen to 10 in cheat engine, I get a crash with a "List index out of bounds (0)" message.
Let me recap how your game works:
1-It creates HintCount blue indicators in the ball when you open a map.
2-A list/an array holds (pointers to) those indicators.
3-When you ask for help, the the game checks if HintCount>0 and if so, the indicator at IndicatorArray[HintCount-1] gets told to move to an object, play its pentagram animation, and commit suicide. HintCount (at 7D9C4670) is also decreased by 1.
If there is no indicator in the ball, but you freeze HintCount to anything non-zero then accessing IndicatorArray[HintCount-1] will cause an error, since IndicatorArray is empty.
So how to cheat the hint count anyway? Meh...
Simple way1: what you already do: set HintCount to an high value, exit map and return to it.
Simple way2: take one one operation that reads HintCount when loading a map, replace it with mov byte [HintCount],20. You're unlikely to use 32 hints in a map and it won't have a big impact on performance.
Hard way: find the function that plays the pentagram animation (string refs might help to locate it) and have it call the function that adds a indicator to the ball.
| o27897 wrote: | | And more issue i don't understand is when i use olly to put a hwbp to find what access to hint address. [...] i don't know why my olly does not break when this value change. |
Maybe a problem with your plugins, not sure...I run my olly naked.
Or perhaps a ring0 debugger that would tamper with your hwpbs? (I'm not familiar with ring0 debuggers)
Or we're not playing the same version of the game.
My olly correctly breaks on all instructions that access HintCount, be it with hwbps or swbps. Same with Cheat engine's "find out what access...".
For your convenience, here are all the instructions that access HintCount:
| Code: | AbraAcademy2.exe+32573F - C7 80 58463000 05000000 - mov [eax+00304658],00000005
AbraAcademy2.exe+323465 - 8B 80 60463000 - mov eax,[eax+00304660]
AbraAcademy2.exe+3301FB - 8B 80 60463000 - mov eax,[eax+00304660]
AbraAcademy2.exe+32BD8C - 83 B8 60463000 00 - cmp dword ptr [eax+00304660],00
AbraAcademy2.exe+323586 - 83 B8 60463000 00 - cmp dword ptr [eax+00304660],00
AbraAcademy2.exe+323997 - FF 88 58463000 - dec [eax+00304658]
AbraAcademy2.exe+3239A9 - 83 B8 60463000 00 - cmp dword ptr [eax+00304660],00 |
|
|
| Back to top |
|
|
o27897
How do I cheat?
![]() Reputation: 0
Joined: 29 Oct 2012
Posts: 5
|
| Posted: Wed Oct 31, 2012 2:28 am Post subject: |
|
|
@Nibelton: I'm using CE 5.6.1.
Actually, i did try your method, inc/dec gave me the same address.
@Gniarf:
- I do have this message "List index out of bounds (0)" but this just happen in certain condition.
- Nice to see your recap structure of the game, it helps me more understand this game 
- | Quote: |
When you ask for help, the the game checks if HintCount>0
[...]IndicatorArray[HintCount-1] will cause an error, since IndicatorArray is empty. |
I also aware of this, because i see the address checking if Hint > 0, i tried to change JNE to nop and DEC DWORD PTR [Hint Addr] to INC but non of them work, as you said it because of IndicatorArray
From here, we know that we have to find what is access to the IndicatorArray, problem is how to find it? If i understand your second solution correctly, you mean change this
mov [eax+00304658],00000005 to Mov addr, 20
It's the olly problem i mentioned, the value is set not just by MOV command, it's taken from .sav file too. Whatever value you change, it's not affect the game at all because your .sav keep another value.
A little bit more, this game is packed by pec, i have problem in unpacking this file, it's strange! I just unpack in olly, when i change mov addr, value the game is no longer run on my computer, maybe crc check, since i can't unpack it, i can do nothing.
- Now i'm still stucking.
+ How to find IndicatorArray and what access to this address.
+ The value in initialize state is taken from .sav, better not touch this file.
+ I think olly is ring3 debugger. When i said it's not break, i mean from mov addr, value to the moment game takes value from save file and then change hint value to real remain value, olly does not break.
+ In your posted CE code, i see only the first address is same on my computer, it's mov hint-addr, 5. Same addr, value of pointer. But from second line, it's completely different. I think it's where the initial hint value is set. And maybe you're using differ version of game, CE code is not same, and here 7D9C4670 either, my olly can't locate it. I have 2 addresses which decrease hint are: 007238FC and 00723997 but only the second break when i click hint.
- The third way is also possible but it takes time, i will consider it when the second way is getting hard to go.
|
|
| Back to top |
|
|
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Wed Oct 31, 2012 11:50 am Post subject: |
|
|
| o27897 wrote: | | From here, we know that we have to find what is access to the IndicatorArray, problem is how to find it? |
Take a mov Register1,[HintCount], and trace a bit after until you find something that seems loop over Register1 and do some stuff. Easier said than done in most cases, but I got real lucky this time so here it is:
| Code: | 00723465 MOV EAX,DWORD PTR DS:[EAX+304660] <- Read HintCount
0072346B TEST EAX,EAX
0072346D JLE SHORT AbraAcad.007234B4
0072346F MOV [LOCAL.4],EAX <-Store HintCount in LOCAL.4
00723472 MOV [LOCAL.2],1
00723479 /MOV EAX,[LOCAL.1]
0072347C |MOV EAX,DWORD PTR DS:[EAX+144]
00723482 |PUSH EAX
00723483 |MOV EAX,[LOCAL.1]
00723486 |MOV ECX,DWORD PTR DS:[EAX+148]
0072348C |MOV DL,1
0072348E |MOV EAX,DWORD PTR DS:[723090]
00723493 |CALL AbraAcad.00723A4C
00723498 |MOV [LOCAL.3],EAX
0072349B |MOV EDX,[LOCAL.3]
0072349E |MOV EAX,[LOCAL.1]
007234A1 |MOV EAX,DWORD PTR DS:[EAX+14C]
007234A7 |CALL AbraAcad.0042F984
007234AC |INC [LOCAL.2]
007234AF |DEC [LOCAL.4] <-loop over LOCAL.4
007234B2 \JNZ SHORT AbraAcad.00723479 |
that code is some sort of
| Code: | for (int i=HintCount;i>0;i--)
{
CreateIndicator(...); //actually several instructions
} |
Now hook AbraAcademy2.exe+323997 dec [eax+00304658] and have it do the content of the for loop above. All in all it gives the script at the bottom of this post.
| o27897 wrote: | If i understand your second solution correctly, you mean change this
mov [eax+00304658],00000005 to Mov addr, 20 |
Actually I meant replacing AbraAcademy2.exe+32BD8C - cmp dword ptr [eax+00304660],00 by mov byte [HintCount],20 and nopping the jle after. Since this code is executed before you enter a room/map, it was supposed to set HintCount before the indicators are created.
However it turns out the indicators are created when you press "Play" (but not rendered) instead of when you enter a map, so Simple way2 is simply not working (I F*ed up).
| o27897 wrote: | | It's the olly problem i mentioned, the value is set not just by MOV command, it's taken from .sav file too. |
Heh, you don't know how " taken from .sav file" is done, do you? In C it is done that way:
| Code: | int HintCount, TempBuffer;
int SaveFile=_open("C:\\savefile.sav",_O_RDWR); //get a handle to the file
//_lseek(SaveFile,some_constant,SEEK_SET); //optionally move withing the file to specify at which file offset the
//next read/write operation will happen
_read(SaveFile,&TempBuffer,4); //copy 4 bytes at some_constant into TempBuffer.
HintCount=TempBuffer; //this will become a mov command in assembly.
close(SaveFile);
|
the last 2 line can also be compacted into _read(SaveFile,&HintCount,4); in which case the mov [HintCount],??? is within the code of the _read function.
(Well there are ofc other ways of reading from a file, but it's roughly the same thing)
Q: You posted above "all the instructions that access HintCount", but there is no such mov. Why?
A: Saves are loaded before displaying the main menu or when changing profiles. I had not attached my debugger at those points. Simply put: I missed it.
Rest assured that HintCount is only set by mov commands.
| o27897 wrote: | | when i change mov addr, value the game is no longer run on my computer, maybe crc check, since i can't unpack it, i can do nothing. |
"i change" = "I copy to executable"?
if no: we're not playing the same version of the game.
if yes: well that's the whole point of packers. They store the code in compressed/encrypted form so when you put unencrypted code to the executable file and relaunch the game, the decryptor decrypts the already decrypted code which result in f**ed up output.
There is no runtime crc check since I can modify the code (in ram) without problem, so you can still use cheat engine's auto assemble scripts or use a loader that will launch the game, wait until it is unpacked, and apply your cheat. For this you can use d****o2oo2's Universal Patcher (be sure to use the MemCheck option).
****=iabl
Sorry for the ****, but since d****o 3 is a multiplayer game that stupid forum does not let me post that word.
| o27897 wrote: | | + In your posted CE code, i see only the first address is same on my computer, it's mov hint-addr, 5. Same addr, value of pointer. But from second line, it's completely different. |
I posted a list of "all the instructions that access HintCount", it's not one single chuck of code, but several instructions picked here and there.
Plus look at the addresses: can AbraAcademy2.exe+323465 be AFTER AbraAcademy2.exe+32573F ?
Unlimited hints scripts (you need HintCount=1+ for it to work):
| Code: |
//Abra Academy - Returning Cast v.Not_mentioned
//unlimited Hint script v1
[ENABLE]
label(ReturnHere)
alloc(code,256)
AbraAcademy2.exe+323997:
jmp code
nop
ReturnHere:
code:
pushad //save all registers
mov eax,[ebp-04] //the dec [HintCount] also has the base of the hint pointer in [ebp-4]
mov eax,[eax+00000144] //everything below was ripped from AbraAcademy2.exe+32347C
push eax
mov eax,[ebp-04]
mov ecx,[eax+00000148]
mov dl,01
mov eax,[AbraAcademy2.exe+323090]
call AbraAcademy2.exe+323A4C
mov edx,eax //slight modification here not to overwrite [ebp-c]
mov eax,[ebp-04]
mov eax,[eax+0000014C]
call AbraAcademy2.exe+2F984
popad //restore all registers
jmp ReturnHere
[DISABLE]
AbraAcademy2.exe+323997:
dec dword [eax+00304658]
dealloc(code)
|
|
|
| Back to top |
|
|
o27897
How do I cheat?
![]() Reputation: 0
Joined: 29 Oct 2012
Posts: 5
|
| Posted: Wed Oct 31, 2012 11:57 pm Post subject: |
|
|
I saw your first code, when i click play olly pause, but when i click hint, nothing happen; and it's a loop with hint value, how can it be a loop? That what i thought, i thought it just move real hint to other variable, just to display "Hint left: Var" so i just skip it  I will ask you at the bottom.
I also changed the comparison If Hint>0 to Mov addr, hint. Not work but i didn't know why, now i know
I understand your explain about Mov in Save option. Actually, my doubt came from the point is Olly does not break when the read(SaveFile,&HintCount,4) is executed.
I know Cracking so i know the tool to make patcher/loader Actually, the crc is ok in Olly, i mean with some app, change anything in olly does not crash it, just the "copy to executable" has problem.
Now let's talk about your script and the first code. The initialize code which build the IndicatorArray begin from here
00723465 8B80 60463000 MOV EAX,[EAX+304660]
I traced over the code and i see that was what i thought. Real hint is used as count var, and then loop to copy to other var:
007234AC FF45 F8 INC DWORD PTR [EBP-8]
[EBP-8] is moved to this line: Hint left: [EBP-8].
In short, i will rebuild this whole code to:
| Quote: | MOV EAX,[EAX+304660]
MOV [EBP-10],EAX
@copy:
INC DWORD PTR [EBP-8]
DEC DWORD PTR [EBP-10]
Jnz copy |
The omitted code is the code i don't understand. That code is also what you put in your script. I understand your script does:
| Quote: | 00723459 8B45 FC MOV EAX,[EBP-4]
0072345C 8B80 44010000 MOV EAX,[EAX+144]
push eax
|
First when click hint, it's jump to DEC-Hint which modified jump to code cave. Please look at that address, i think you copy the code from that. Push eax is save eax.
And then:
Begin of your rip code. Here, eax is replaced by new value that mean 3 first lines is not related here but if i remove 3 first lines, this will crash game. Please explain how did you indentify IndicatorArray which i think it's exchange value for "Hint left:" And what your first 3 lines do?
|
|
| Back to top |
|
|
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Thu Nov 01, 2012 2:15 am Post subject: |
|
|
| o27897 wrote: | I traced over the code and i see that was what i thought. Real hint is used as count var, and then loop to copy to other var:
007234AC FF45 F8 INC DWORD PTR [EBP-8] |
Congratulation to the devs there: they need a loop with [EBP-8]++ to calculate [EBP-8]=HintCount+1 !
| o27897 wrote: | | First when click hint, it's jump to DEC-Hint which modified jump to code cave. Please look at that address, i think you copy the code from that. Push eax is save eax. |
Actually this push eax is a "pass eax as parameter for the next call", but it's from ripped code anyway.
| o27897 wrote: | And then:
Begin of your rip code. |
(you're speaking about the 2nd mov eax,[ebp-04] of my script)
Nope, the rip begins earlier, at mov eax,[eax+00000144] this instruction was ripped from AbraAcademy2.exe+32347C=0072347C.
The instruction just before MOV EAX,[ebp+4] is the same in the rip source and in my script but it's just a (semi-)coincidence (see below).
| o27897 wrote: | | Please explain how did you indentify IndicatorArray |
I though "If I were a programmer and I wanted to initialize a variable size array, I would need a loop that does HintCount iterations and initialize one Indicator at each iteration". Thanks to my failure with Simple way2, I know that IndicatorArray is populated when clicking on "Play", so I just needed to find the code that reads HintCount after I click on Play. Luckily there was only one hit, so the rest is tracing (not much lol) until you find a loop over HintCount. Once I found this loop I assumed that one of the calls in there was initializing an Indicator and putting it into IndicatorArray, and the other was...doing stuff.
Trial and error showed that I needed the whole content of the loop (minus the inc & dec) to initialize and add an Indicator, not only one call.
| o27897 wrote: | | IndicatorArray which i think it's exchange value for "Hint left:" |
Sorry but I don't understand what you mean here. Could you reformulate?
| o27897 wrote: | | And what your first 3 lines do? |
popad Save EAX, ECX, EDX, EBX, original ESP, EBP, ESI, and EDI. Because the ripped code uses eax,edx,and ecx. I could have put only 3 pushs, but I was lazy.
mov eax,[ebp-04] I noticed that there ebp-4 contains the same address than the one used in the NON-RIPPED mov eax,[eax+144]. Which is not a coincidence since there is a recurring patterns in functions that deal with HintCount:
| Code: | MOV EAX,[LOCAL.1]
MOV EAX,DWORD PTR DS:[EAX+144]
MOV EAX,DWORD PTR DS:[EAX+304660] |
I guess all those functions use the same base pointer (GameData) to access something like GameData->HintData->HintCount. The names GameData & HintData come straight out of my ass, I haven't done enough research to know what they really are.
mov eax,[eax+00000144] Ripped from the loop that initializes IndicatorArray.
|
|
| Back to top |
|
|
o27897
How do I cheat?
![]() Reputation: 0
Joined: 29 Oct 2012
Posts: 5
|
| Posted: Thu Nov 01, 2012 6:35 am Post subject: |
|
|
I opened my mind when i see you explain this:
| Quote: | | Thanks to my failure with Simple way2, I know that IndicatorArray is populated when clicking on "Play", so I just needed to find the code that reads HintCount after I click on Play. |
I did have same solution as your simple way2, but i don't have any ideal, thank you for pointing out for me.
| Quote: | | IndicatorArray which i think it's exchange value for "Hint left:" |
Firstly as explained (the short-code i rebuild the code) i think the IndicatorArray is just a function which copy real hint to another variable, i don't think it's real IndicatorArray (hope you understand now )
| Quote: | | I guess all those functions use the same base pointer (GameData) to access something like GameData->HintData->HintCount. |
I do think so, but the way they exchange their positions is obey my level, no ideal to continue research, even with your script solution i still need time to learn it 
Thank you for all your help, i've learnt a lot from you
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
