| View previous topic :: View next topic |
| Author |
Message |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 9:39 am Post subject: Vac help in 2d game |
|
|
Hi i have found the char x,y and one mob x,y but now i am kinda lost how would i make a script to vac all monsters on map to my x,y. I have somewhere red that when you has one mob x,y u have all mobs x,y i dun understand that.
when i check what acceses the mob x adress it shows this which is a bit consofusing to me
| Code: |
00456882 - D9 81 E8000000 - fld dword ptr [ecx+000000E8]
00456891 - D9 81 E8000000 - fld dword ptr [ecx+000000E8]
0048C8CA - D9 86 E8000000 - fld dword ptr [esi+000000E8]
00487810 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048784B - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048B755 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048BA4A - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048BA86 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048C15F - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048C500 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048C593 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048C629 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0048CB15 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
0045BC31 - D9 03 - fld dword ptr [ebx]
0045AC16 - D9 07 - fld dword ptr [edi]
0045AC42 - D9 07 - fld dword ptr [edi]
0045AC62 - D9 17 - fst dword ptr [edi]
0045ACAC - D9 07 - fld dword ptr [edi]
00458BAF - D9 87 E8000000 - fld dword ptr [edi+000000E8]
00458CDD - D9 80 E8000000 - fld dword ptr [eax+000000E8]
004593E5 - D9 86 E8000000 - fld dword ptr [esi+000000E8]
004F4580 - D9 87 E8000000 - fld dword ptr [edi+000000E8]
|
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 2:49 pm Post subject: |
|
|
| When you right-click on the mob x address in your cheat table, and select 'find what accesses...', you should be presented with a debugger window that will populate with results. Each of the instructions that are shown, are instructions that are accessing the mob x address (obviously). Let the debugger run for a second, then stop it. Left-click on the top instruction and select 'show in disassembler'. In the disassembler window, the instruction that you highlighted in the debugger window should be highlighted here. Simply right-click on the instruction to see what other addresses (if any) this particular instruction accesses. Here, is where you will find out if a single instruction handles ALL mob x addresses...or something else. There are many possibilities here...especially if your game is older. Your game is 2D, but if it is an old game, it might not be worth the effort because it may very difficult. Depending on what results are had with this particular instruction, you may have to try the next instruction in the debugger list, and so forth.
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 3:55 pm Post subject: |
|
|
| GNIREENIGNE wrote: | | When you right-click on the mob x address in your cheat table, and select 'find what accesses...', you should be presented with a debugger window that will populate with results. Each of the instructions that are shown, are instructions that are accessing the mob x address (obviously). Let the debugger run for a second, then stop it. Left-click on the top instruction and select 'show in disassembler'. In the disassembler window, the instruction that you highlighted in the debugger window should be highlighted here. Simply right-click on the instruction to see what other addresses (if any) this particular instruction accesses. Here, is where you will find out if a single instruction handles ALL mob x addresses...or something else. There are many possibilities here...especially if your game is older. Your game is 2D, but if it is an old game, it might not be worth the effort because it may very difficult. Depending on what results are had with this particular instruction, you may have to try the next instruction in the debugger list, and so forth. |
thank you yes this is indeed the case i did as you said and the instruction changes all X addresses of the mobs on that map
so how do i proceed next?
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 4:22 pm Post subject: |
|
|
| Are you sure that the instruction only accesses x/y addresses? Also, does the instruction only access mob x/y addresses, or does the instruction access mob (and) hero x/y addresses?
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 4:26 pm Post subject: |
|
|
| GNIREENIGNE wrote: | | Are you sure that the instruction only accesses x/y addresses? Also, does the instruction only access mob x/y addresses, or does the instruction access mob (and) hero x/y addresses? |
i did exactly as u said what came up was list of 24 addresses(theres exactly 24 mobs on that map) with changing float values. i picked randomly few of them and changed the x to my hero and tho mob appeared on my hero when in same Y
that instruction only accesses X addresses of mobs on that particular map
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 5:34 pm Post subject: |
|
|
Okay. In that case, we will have to load your coordinates from their actual addresses. No problem.
Highlight the instruction in the memory viewer and select 'tools' from the drop down menu. Click on auto assemble. In the auto assemble window, select template, click on cheat table framework code. Select template again, click on code injection. Copy everything and paste it here, I will try to help.
We will also need the pointer information for your xyz addresses.
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 5:51 pm Post subject: |
|
|
| GNIREENIGNE wrote: | Okay. In that case, we will have to load your coordinates from their actual addresses. No problem.
Highlight the instruction in the memory viewer and select 'tools' from the drop down menu. Click on auto assemble. In the auto assemble window, select template, click on cheat table framework code. Select template again, click on code injection. Copy everything and paste it here, I will try to help.
We will also need the pointer information for your xyz addresses. |
its 2d game there are no Z coordinates and are you sure that one instruction is gonna be enough? it does not handle monster Y addresses only X
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fld dword ptr [ecx+000000E8]
exit:
jmp returnhere
"SamuraiOrc.exe"+56882:
jmp newmem
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"SamuraiOrc.exe"+56882:
fld dword ptr [ecx+000000E8]
//Alt: db D9 81 E8 00 00 00
Char X pointer 00ABD1A8 offset d4
Char Y pointer 00ABD1A8 offset c0
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 5:58 pm Post subject: |
|
|
Yes...2D...sorry; no z coordinate.
If you view the instructions that accesses mob y address, what is the most common offset?
For example, the x address for enemies, yielded:
fld dword ptr [ecx+000000E8]...which has +E8 offset.
What do you get for y address for enemies?
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 6:02 pm Post subject: |
|
|
| GNIREENIGNE wrote: | Yes...2D...sorry; no z coordinate.
If you view the instructions that accesses mob y address, what is the most common offset?
For example, the x address for enemies, yielded:
fld dword ptr [ecx+000000E8]...which has +E8 offset.
What do you get for y address for enemies? |
| Code: | 0045672E - D9 87 EC000000 - fld dword ptr [edi+000000EC]
0048BA56 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048BA92 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048C269 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048C532 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048C5C8 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048C65E - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048CBE8 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0045AC27 - D9 03 - fld dword ptr [ebx]
0045AC3A - D9 03 - fld dword ptr [ebx]
0045ACEF - D9 1B - fstp dword ptr [ebx]
00458CF6 - D9 80 EC000000 - fld dword ptr [eax+000000EC]
004593F0 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
0048CD96 - D9 86 EC000000 - fld dword ptr [esi+000000EC]
004F4591 - D9 87 EC000000 - fld dword ptr [edi+000000EC]
|
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 7:04 pm Post subject: |
|
|
That makes sense. Are you sure your hero offsets are correct (00ABD1A8+C0 and 00ABD1A8+D4)? That seems odd.
In your cheat list, double click on your hero pointers and copy the address+offset(s) and paste them here (such as "SamuraiOrc.exe"+010055C0 and offset +C0). I will write your script for you and help you with any questions.
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 7:18 pm Post subject: |
|
|
| GNIREENIGNE wrote: | That makes sense. Are you sure your hero offsets are correct (00ABD1A8+C0 and 00ABD1A8+D4)? That seems odd.
In your cheat list, double click on your hero pointers and copy the address+offset(s) and paste them here (such as "SamuraiOrc.exe"+010055C0 and offset +C0). I will write your script for you and help you with any questions. |
CHAR X
0D0EA3FD+C0 = 0D0EA4BD
00ABD1A8 ->0D0EA3FD
CHAR Y
0D0EA3FD+D4 = 0D0EA4D1
00ABD1A8 ->0D0EA3FD
could u explain me why is
00ABD1A8 converted to 0D0EA3FD?
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 7:35 pm Post subject: |
|
|
Please refer to the green circle...I need all text in this box...please copy/paste it here. Also, please tell me any/all offsets that are in the red circle (if there are more than one, I need those):
I need this for both address...hero x (and) hero y.
So, in the example above, you would have something similar to this:
"game.exe"+000DE9C0 +0
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 7:37 pm Post subject: |
|
|
| GNIREENIGNE wrote: | Please refer to the green circle...I need all text in this box...please copy/paste it here. Also, please tell me any/all offsets that are in the red circle (if there are more than one, I need those):
I need this for both address...hero x (and) hero y. |
then this is correct
Char X pointer 00ABD1A8 offset d4
Char Y pointer 00ABD1A8 offset c0
and it works like charm :]
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Jun 24, 2013 7:50 pm Post subject: |
|
|
You did not use pointer scanner?
Try this:
| Description: |
|
 Download |
| Filename: |
SamuraiOrc.CT |
| Filesize: |
5.92 KB |
| Downloaded: |
572 Time(s) |
|
|
| Back to top |
|
 |
shroom Cheater
Reputation: 0
Joined: 24 Jun 2013 Posts: 29
|
Posted: Mon Jun 24, 2013 7:56 pm Post subject: |
|
|
| GNIREENIGNE wrote: | You did not use pointer scanner?
Try this: |
no i find it myself, pointer scanner either return nothing or few millions of addresses never had luck with it
i did what accesses both of these addresses and heres result
| Code: |
char X
004667F8 - D9 9E D4000000 - fstp dword ptr [esi+000000D4]
0045BC31 - D9 03 - fld dword ptr [ebx]
0045AC16 - D9 07 - fld dword ptr [edi]
0045AC42 - D9 07 - fld dword ptr [edi]
0045AC62 - D9 17 - fst dword ptr [edi]
char Y
0046D214 - D9 86 C0000000 - fld dword ptr [esi+000000C0]
0046D220 - D9 9E C0000000 - fstp dword ptr [esi+000000C0]
0046D269 - D9 86 C0000000 - fld dword ptr [esi+000000C0]
0046DF28 - D8 86 C0000000 - fadd dword ptr [esi+000000C0]
0046DF2E - D9 9E C0000000 - fstp dword ptr [esi+000000C0]
00455DE3 - D9 86 C0000000 - fld dword ptr [esi+000000C0]
00467504 - D9 86 C0000000 - fld dword ptr [esi+000000C0]
0046781C - D9 86 C0000000 - fld dword ptr [esi+000000C0]
004667FE - D9 86 C0000000 - fld dword ptr [esi+000000C0]
004731E2 - D9 86 C0000000 - fld dword ptr [esi+000000C0]
0045AC27 - D9 03 - fld dword ptr [ebx]
0045AC3A - D9 03 - fld dword ptr [ebx]
0045ACEF - D9 1B - fstp dword ptr [ebx]
00458E6D - D9 87 C0000000 - fld dword ptr [edi+000000C0]
004F2F98 - D9 80 C0000000 - fld dword ptr [eax+000000C0]
004F3303 - D9 80 C0000000 - fld dword ptr [eax+000000C0]
004EEC15 - D8 8F C0000000 - fmul dword ptr [edi+000000C0] |
004667F8 - D9 9E D4000000 - fstp dword ptr [esi+000000D4]
this instruction assesses addresses related to hero X and NPC X coord
i think the same goes with first Y instruction
i just tried to check the script clicked ok and got error not all code is injectable Error in line 24 mov edi,[[00ABD1A8]+C0] this instruction cant be compiled
Last edited by shroom on Mon Jun 24, 2013 8:01 pm; edited 1 time in total |
|
| Back to top |
|
 |
|