Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


the impossible base pointer

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
grtnd
Newbie cheater
Reputation: 0

Joined: 29 Nov 2015
Posts: 14

PostPosted: Sun Nov 29, 2015 12:51 pm    Post subject: the impossible base pointer Reply with quote

Hello everyone,

I've ran into a problem finding base pointers in this particular game.
usually you can find pointers through pointerscanning, or alternativly through the cheat engine debugger.
neither of these options work in my case and that's because of the ridiciouls complex ways that this game stores it's pointers in.

this game hides it's base-pointers behind walls of register swaps and function calls which is making pointerscan's really difficult.
(i don't know if it intentionally does this)
most of the time, CE gave me pointerscanner error's because i set the maximium offset & level vales too high, and when it didn't, i got nothing of relevance anyway. (because all the rescans filters out everything and i ended up with 0 results)
this is strange because i'm sure my computer has enough resources to do big pointerscans.


anyway, since i couldn't use the pointerscanner i was forced to try and locate the base pointer through memory viewer instead. (the same way we all did before pointerscanning)

so i spent a long time yesterday trying to trace all the opcodes that affected my pointer, of course i couldn't find the original base pointer loading instruction, since the trail never seemed to end but i did find out what i stated above: that the base pointers are buried behind walls of register jumps (mov) and function calls/instruction jumps.

so in summary:
every pointerscan i've done on various different adresses has so far returned me nothing of relevance.

the base pointer is hidden behind ridiculous amounts of register swapping which makes it tricky, if not impossible to find manually.

in detail:
as far as i've managed to trace the pointer, i've found it jumps between around 3 unique registers 6 times while going through around 14 function calls and instruction jumps.
the biggest offset during a register jump (mov) of my pointer i recorded was 0x07DEA4 but since i've found some other unrelated offsets nearby that date slightly higher, i've made the assumption that all the offsets in the mov instructions that handle the pointer in question are under 0x80000

so i decided to give the pointerscan one last try before comming here.

i left all the values at default except for maximium offset which i set at 80000 and max level which i put at 8 (for the time being)

im 95% positive i have enough RAM and disk space as i monetize my memory usage during the scan process, i am also using the 64-bit version of cheat engine, but as always it turns up:
Quote:
Error during scan: StaticScanner:Could not convert variant of type (Null) into type (Int64)
followed by
Quote:
Unable to open file "C:\Users\xxxxx\Documents\yyyyy.PTR"


so i'm stuck at this point. pointer scanning apperantly doesn't have enough recources (but i have my doubts on that one) and the register manipulations in the assembly code are simply too large and spread out to find the pointer manually.

i'm sure im not the only one who has run into this at some point, but right now im out of ideas.
Back to top
View user's profile Send private message
Rydian
Grandmaster Cheater Supreme
Reputation: 31

Joined: 17 Sep 2012
Posts: 1358

PostPosted: Sun Nov 29, 2015 2:36 pm    Post subject: Reply with quote

Some games just straight-up don't have traditional pointers.

http://forum.cheatengine.org/viewtopic.php?t=572465

There's two other methods to use, Injection Copies would probably work best for you, though if editing the game code is a no-no an AOB to the structure might work (but is often slower to toggle on).

_________________
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Sun Nov 29, 2015 4:35 pm    Post subject: Reply with quote

Ridiculous offsets like 0x07DEA4 make me think you're targeting a script variable, so have you tried modding the game?
Also, does your game use one of the following engines: renpy (python), rpg maker, kirikiri (japanese visual novels), java, or lua?

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
grtnd
Newbie cheater
Reputation: 0

Joined: 29 Nov 2015
Posts: 14

PostPosted: Sun Nov 29, 2015 6:30 pm    Post subject: Reply with quote

Rydian wrote:
Some games just straight-up don't have traditional pointers.

[can't quote url's yet]

There's two other methods to use, Injection Copies would probably work best for you, though if editing the game code is a no-no an AOB to the structure might work (but is often slower to toggle on).


i don't suspect that there's anything unusual with this pointer, it may just have a lot of code behind it and needs to vary a lot, so it could just simply be a side effect. however, i read your post about AOB, applied it, and got it to work! i never even knew about these methods until now and reading up on them makes me feel that it would give me the ability do a lot more tampering in games with these methods when pointers aren't a hassle anymore.

so thanks a bunch for your answer! AOB worked flawlessly.

Gniarf wrote:
Ridiculous offsets like 0x07DEA4 make me think you're targeting a script variable, so have you tried modding the game?
Also, does your game use one of the following engines: renpy (python), rpg maker, kirikiri (japanese visual novels), java, or lua?

I'm not exacly sure what a "script variable" is, are you referring to "executable memory"? anyway, to my knowledge it's not written in any high level language. most likely it's native C or C++ (seeing as the assembly is static) but could possibly be .NET
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Sun Nov 29, 2015 7:22 pm    Post subject: Reply with quote

grtnd wrote:
I'm not exacly sure what a "script variable" is, are you referring to "executable memory"?
No.
Video games often use script interpreters, LUA being the most popular atm.
Cheat engine itself also has a built-in lua script interpreter, which you can bring by pressing ctrl+alt+shit+L. I'm not saying that you can interface between CE's interpreter and the game's, I'm just using CE as an example program using lua scripts.
If you take a simple script like:
Code:
local ScriptVariable=4
local AnotherScriptVariable=3
print(ScriptVariable+AnotherScriptVariable)
You should see what I meant by script variable. Now you may/should wonder how those are stored in memory, considering script interpreters have their own memory managers. My guess is that it starts with an enormous buffer to hold all variables, or at least all global variables, and various function calls to retrieve where the other variables/members are. 7DEA4 could have been the offset to your variable from the start of that buffer.

In games those scripts are typically shipped as text files stored inside the game's archives.
The point of scripts is that the level designer doesn't need to recompile the whole game (or the proprietary 3rd party game engine...) to add a new quest.

grtnd wrote:
most likely it's native C or C++ (seeing as the assembly is static)
Maybe, but FYI the script interpreter itself is usually written in C/C++ (lua is published in C, with some C++ ports available) and when you're tracing assembly, scripts and their variables are all just blobs of data.
_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites