Cheat Engine

[Mark Danielle]

So, I've found the memory addresses of mana/hp in a game, but the values seem to be encrypted and they change everytime the game is loaded (the encrypted values change, the memory addresses change too, but that's not a problem). Is there a good tutorial on how to find the decrypted values of encrypted ones? I'm not entirely sure on where to go from here.

Thanks

[SteveAndrew]

Well if you've been able to find the encrypted values, then you're already most of the way there! That's usually the trickiest part...

What did you do changed/unchanged value scans?

If you can debug, then do a find what accesses this address, and you can reverse from there, and find where the game encrypts or decrypts the values! Chances are there's some place on the stack or in some register(s) where the decrypted values will be! I've recently done this with Crysis 3 for health (it's stored encrypted and only decrypted temporarily to do some math with it, then it re-encrypts it and copies it back)

You have to find where in the code the game plays with the unencrypted value or decrypts it, as the value can't stay encrypted the whole time, it has to decrypt it at some point to know what the value actually is to actually use the value in the game