Cheat Engine :: View topic - Relic Hunters Zero

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Relic Hunters Zero - any ideas?
Goto page 1, 2, 3, 4 Next

Cheat Engine Forum Index -> General Gamehacking

View previous topic :: View next topic

Author

Message

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 5:12 am Post subject: Relic Hunters Zero - any ideas?

Original theard: http://forum.cheatengine.org/viewtopic.php?t=583746 Link to game (it's free game by the way, 64mb size) - http://store.steampowered.com/app/382490/ So, anyone could explain how to hack games like that? I failed in: 1) Pointer method - 0 good pointers on 5 lvl, and inf pointers on 7 lvl impossible to do first scan and other rescans. (got 90 gb and 7 000 000 000 after 1500sec of searching) 2) Code injection - That will not help here And check the offset - just 0. But it 0 for EVERY value (hp, ammo, armor). 3) AOB Method - i restarted game\pc, but signatures a always the same, exacly same. And yep - signatures that i have tried a not uniq, just junk code. So is it game in LUA, or I just "too young" to hack it? _________________ Sry for my english, Hitler.

deama1234
Master Cheater

Reputation: 3

Joined: 20 Dec 2014
Posts: 328

Posted: Fri Aug 28, 2015 7:49 am Post subject:

Try 2 bytes or byte, or float; or whatever. Or you could try and just ignore the "0".

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 9:40 am Post subject:

deama1234 wrote:

Try 2 bytes or byte, or float; or whatever. Or you could try and just ignore the "0".

Try what? I don't understand you.
I can find value, but it will change on game restart\next level.
And there is no way to actually find something static or find uniq signature =(
So what other ways to hack it?
_________________

Sry for my english, Hitler.

deama1234
Master Cheater

Reputation: 3

Joined: 20 Dec 2014
Posts: 328

Posted: Fri Aug 28, 2015 9:51 am Post subject:

Post the instruction your referring to here; including it's address; and what is it supposed to do? Infinite hp?

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 10:23 am Post subject:

deama1234 wrote:

Post the instruction your referring to here; including it's address; and what is it supposed to do? Infinite hp?

I don't know what it supposted ot do. At least I want to just freeze HP. In the best case - find base address and offsets to other things, like ammo and etc.

For ammo:
ammo address - 10B12750 (double)

Code:

00509E14 - C7 07 00000000 - mov [edi],00000000

and second code

Code:

00509E4F - DD 1F - fstp qword ptr [edi]

And one intrestring thing

_________________

Sry for my english, Hitler.

deama1234
Master Cheater

Reputation: 3

Joined: 20 Dec 2014
Posts: 328

Posted: Fri Aug 28, 2015 10:32 am Post subject:

You have to use AOB injection instead.

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 10:36 am Post subject:

deama1234 wrote:

You have to use AOB injection instead.

I tried. Every time signatures just the same (but always wrong, cas script finding wrong base address)
Ok, gonna try it again.

UPDATE:
AOB failed.

First script

Code:

{ Game : RelicHuntersZero.exe
Version:
Date : 2015-08-28
Author : Bl00dWolf

This script does blah blah blah
}

[ENABLE]

aobscanmodule(ammo,RelicHuntersZero.exe,C7 47 0C 05 00 00 00 C7 07 00 00 00 00 8B 50 0C) // with this signature it just crashes the game
alloc(newmem,$1000)

label(code)
label(return)

newmem:
jmp return

code:
mov [edi],00000000
jmp return

ammo+01:
jmp code
nop
return:
registersymbol(ammo)

[DISABLE]

ammo+01:
db C7 07 00 00 00 00

unregistersymbol(ammo)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "RelicHuntersZero.exe"+109E14

"RelicHuntersZero.exe"+109DF2: C7 07 00 00 00 00 - mov [edi],00000000
"RelicHuntersZero.exe"+109DF8: EB 0F - jmp RelicHuntersZero.exe+109E09
"RelicHuntersZero.exe"+109DFA: 8B 07 - mov eax,[edi]
"RelicHuntersZero.exe"+109DFC: 85 C0 - test eax,eax
"RelicHuntersZero.exe"+109DFE: 74 09 - je RelicHuntersZero.exe+109E09
"RelicHuntersZero.exe"+109E00: 50 - push eax
"RelicHuntersZero.exe"+109E01: E8 3A D8 00 00 - call RelicHuntersZero.exe+117640
"RelicHuntersZero.exe"+109E06: 83 C4 04 - add esp,04
"RelicHuntersZero.exe"+109E09: 8B 44 24 1C - mov eax,[esp+1C]
"RelicHuntersZero.exe"+109E0D: C7 47 0C 05 00 00 00 - mov [edi+0C],00000005
// ---------- INJECTING HERE ----------
"RelicHuntersZero.exe"+109E14: C7 07 00 00 00 00 - mov [edi],00000000
// ---------- DONE INJECTING ----------
"RelicHuntersZero.exe"+109E1A: 8B 50 0C - mov edx,[eax+0C]
"RelicHuntersZero.exe"+109E1D: 89 57 0C - mov [edi+0C],edx
"RelicHuntersZero.exe"+109E20: 8B 48 0C - mov ecx,[eax+0C]
"RelicHuntersZero.exe"+109E23: 81 E1 FF FF FF 00 - and ecx,00FFFFFF
"RelicHuntersZero.exe"+109E29: 83 F9 06 - cmp ecx,06
"RelicHuntersZero.exe"+109E2C: 0F 87 41 02 00 00 - ja RelicHuntersZero.exe+10A073
"RelicHuntersZero.exe"+109E32: FF 24 8D 7C A0 50 00 - jmp dword ptr [ecx*4+RelicHuntersZero.exe+10A07C]
"RelicHuntersZero.exe"+109E39: 8B 00 - mov eax,[eax]
"RelicHuntersZero.exe"+109E3B: 89 07 - mov [edi],eax
"RelicHuntersZero.exe"+109E3D: 85 C0 - test eax,eax
}

Second (after game restart I did every same steps, just to be sure)

Code:

{ Game : RelicHuntersZero.exe
Version:
Date : 2015-08-28
Author : Bl00dWolf

This script does blah blah blah
}

[ENABLE]

aobscanmodule(ammo2,RelicHuntersZero.exe,00 C7 07 00 00 00 00 8B 50) // default signature. Not even close to uniq.
alloc(newmem,$1000)

label(code)
label(return)

newmem:
jmp return

code:
mov [edi],00000000
jmp return

ammo2+01:
jmp code
nop
return:
registersymbol(ammo2)

[DISABLE]

ammo2+01:
db C7 07 00 00 00 00

unregistersymbol(ammo2)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "RelicHuntersZero.exe"+109E14

"RelicHuntersZero.exe"+109DF2: C7 07 00 00 00 00 - mov [edi],00000000
"RelicHuntersZero.exe"+109DF8: EB 0F - jmp RelicHuntersZero.exe+109E09
"RelicHuntersZero.exe"+109DFA: 8B 07 - mov eax,[edi]
"RelicHuntersZero.exe"+109DFC: 85 C0 - test eax,eax
"RelicHuntersZero.exe"+109DFE: 74 09 - je RelicHuntersZero.exe+109E09
"RelicHuntersZero.exe"+109E00: 50 - push eax
"RelicHuntersZero.exe"+109E01: E8 3A D8 00 00 - call RelicHuntersZero.exe+117640
"RelicHuntersZero.exe"+109E06: 83 C4 04 - add esp,04
"RelicHuntersZero.exe"+109E09: 8B 44 24 1C - mov eax,[esp+1C]
"RelicHuntersZero.exe"+109E0D: C7 47 0C 05 00 00 00 - mov [edi+0C],00000005
// ---------- INJECTING HERE ----------
"RelicHuntersZero.exe"+109E14: C7 07 00 00 00 00 - mov [edi],00000000
// ---------- DONE INJECTING ----------
"RelicHuntersZero.exe"+109E1A: 8B 50 0C - mov edx,[eax+0C]
"RelicHuntersZero.exe"+109E1D: 89 57 0C - mov [edi+0C],edx
"RelicHuntersZero.exe"+109E20: 8B 48 0C - mov ecx,[eax+0C]
"RelicHuntersZero.exe"+109E23: 81 E1 FF FF FF 00 - and ecx,00FFFFFF
"RelicHuntersZero.exe"+109E29: 83 F9 06 - cmp ecx,06
"RelicHuntersZero.exe"+109E2C: 0F 87 41 02 00 00 - ja RelicHuntersZero.exe+10A073
"RelicHuntersZero.exe"+109E32: FF 24 8D 7C A0 50 00 - jmp dword ptr [ecx*4+RelicHuntersZero.exe+10A07C]
"RelicHuntersZero.exe"+109E39: 8B 00 - mov eax,[eax]
"RelicHuntersZero.exe"+109E3B: 89 07 - mov [edi],eax
"RelicHuntersZero.exe"+109E3D: 85 C0 - test eax,eax
}

Seems to be ok, but it is not.
After script apply it just don't do anything, or it just can crash game. (cas of wrong signature)

I tried to make signature longoer, shorter, all the same. If long - script just can't find anything, If too short - same as default, wrong\or crash.

So what to do now?

UPDATE:
Oooh god, wtf hell i'm doing. I don't need to change anything in script, right?
But anyway: it's searching wrong

_________________

Sry for my english, Hitler.

ogpayne
Cheater

Reputation: 0

Joined: 08 Dec 2014
Posts: 45

Posted: Fri Aug 28, 2015 12:41 pm Post subject:

Bl00dWolf wrote:

deama1234 wrote:

You have to use AOB injection instead.

I tried. Every time signatures just the same (but always wrong, cas script finding wrong base address)
Ok, gonna try it again.

UPDATE:
AOB failed.

First script

Code:

Second (after game restart I did every same steps, just to be sure)

Code:

I tried to find a way to do infinite ammo; I also was having troubles.. Hopefully you get it solved so I can learn what is happening as well.

deama1234
Master Cheater

Reputation: 3

Joined: 20 Dec 2014
Posts: 328

Posted: Fri Aug 28, 2015 1:05 pm Post subject:

EDIT: This seems to work fine for the red guy in all the rooms (inf ammo).

Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

label(check)

newmem: //this is allocated memory, you have read,write,execute access
cmp [edi+10],00018720
je check
jmp originalcode

check:
fld1
fstp qword ptr [edi]
jmp exit

originalcode:
fstp qword ptr [edi]

exit:
pop edi
pop esi
pop ebp
jmp returnhere

"RelicHuntersZero.exe"+109E4F:
jmp newmem
returnhere:

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"RelicHuntersZero.exe"+109E4F:
fstp qword ptr [edi]
pop edi
pop esi
pop ebp
//Alt: db DD 1F 5F 5E 5D

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 2:13 pm Post subject:

deama1234 working 0_0 great job. Can u please explain to me some code?

Code:

newmem: //this is allocated memory, you have read,write,execute access
cmp [edi+10],00018720
je check
jmp originalcode

cmp [edi+10],00018720 - how u find it? By stucture?

and what doind this code?

Code:

check:
fld1
fstp qword ptr [edi]
jmp exit

_________________

Sry for my english, Hitler.

deama1234
Master Cheater

Reputation: 3

Joined: 20 Dec 2014
Posts: 328

Posted: Fri Aug 28, 2015 2:27 pm Post subject:

Quote:

cmp [edi+10],00018720 - how u find it? By stucture?

Yep, found it in the structure of edi, offset 10; don't really know what it is, but it seems to be unique(?) to the player.

Quote:

and what doind this code?
Code:
check:
fld1
fstp qword ptr [edi]
jmp exit

It puts "1" into the FPU stack then I put it back into the [edi] (which is the ammo value); so pretty much your ammo will always be 1. Then it just jumps out of the code cave.

The reason I didn't simply "nop" it, is because at the start of the game, I had 0 ammo, then my guy started to reload; but since the code would be "nop'd" the ammo count would stay at 0.

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 2:39 pm Post subject:

deama1234 wrote:

Code:
check:
fld1
fstp qword ptr [edi]
jmp exit

It puts "1" into the FPU stack then I put it back into the [edi] (which is the ammo value); so pretty much your ammo will always be 1. Then it just jumps out of the code cave.

The reason I didn't simply "nop" it, is because at the start of the game, I had 0 ammo, then my guy started to reload; but since the code would be "nop'd" the ammo count would stay at 0.

Thx! Any tutorial in ASM for that? Cas i know ASM, but not that good.

deama1234 wrote:

Yep, found it in the structure of edi, offset 10; don't really know what it is, but it seems to be unique(?) to the player.

Hm, I missed that somehow. GJ.
_________________

Sry for my english, Hitler.

deama1234
Master Cheater

Reputation: 3

Joined: 20 Dec 2014
Posts: 328

Posted: Fri Aug 28, 2015 2:55 pm Post subject:

Quote:

Thx! Any tutorial in ASM for that? Cas i know ASM, but not that good.

You mean on FPUs? I just learned by searching and asking a bit here; the rest from experimenting.

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Fri Aug 28, 2015 3:02 pm Post subject:

deama1234 wrote:

You mean on FPUs? I just learned by searching and asking a bit here; the rest from experimenting.

Yep, FPU. Ok, thx for help. Gonna work further with this game to learn new things Very Happy

_________________

Sry for my english, Hitler.

Bl00dWolf
Advanced Cheater

Reputation: 0

Joined: 04 Jan 2010
Posts: 79
Location: Russia, Moscow

Posted: Sat Aug 29, 2015 7:15 am Post subject:

I tied to find in internet, how to push 999, instead of fld1 (1), but failed, lol - game crashed or no effect.

I tied to use fild qword ptr or fld qword ptr - with no succes =(

Code:

check:
push edi
mov edi, 63
fld qword ptr [edi]
pop edi
fstp qword ptr [edi]
jmp exit

?_?

And good news:
I think edi+10 are always uniq.

This is for Inf. HP

Code:

[ENABLE]
alloc(newmem,2048)
label(returnhere)
label(infhp)
label(originalcode)
label(exit)

newmem:
cmp [edi+10],187B2 // <------ again +10
je infhp

originalcode:
fstp qword ptr [edi]
pop edi
pop esi
pop ebp
jmp returnhere

infhp:
fldpi // lol pi value XD
fstp qword ptr [edi]
pop edi
pop esi
pop ebp

exit:
jmp returnhere

"RelicHuntersZero.exe"+109E4F:
jmp newmem
returnhere:

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"RelicHuntersZero.exe"+109E4F:
fstp qword ptr [edi]
pop edi
pop esi
pop ebp
//Alt: db DD 1F 5F 5E 5D

And reeeally bad news:
This 2 script CAN'T work ant the same time. Only inf, hp OR inf. ammo.
How to fix it?

UPDATED:
Faild with HP. Not uniq, all enemies in God Mode too xD Gonna search again.

Wow. And is this okay?

UPDATE2:
INF HP

Code:

[ENABLE]
alloc(newmem,64)
label(returnhere)
label(infhp)
label(originalcode)
label(exit)

newmem:
cmp [edi+10],187B2
jne originalcode
cmp [edi+170],0 // << new offset.
jne infhp

originalcode:
fstp qword ptr [edi]
pop edi
pop esi
pop ebp
jmp returnhere

infhp:
fld1
fstp qword ptr [edi]
pop edi
pop esi
pop ebp

exit:
jmp returnhere

"RelicHuntersZero.exe"+109E4F:
jmp newmem
returnhere:

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"RelicHuntersZero.exe"+109E4F:
fstp qword ptr [edi]
pop edi
pop esi
pop ebp
//Alt: db DD 1F 5F 5E 5D

With this script i'm in god mode, enemies not, but sometimes game crashing =(

UPDATE3:
Nope, wrong offset again (170). Can't find any good again. Just all the same for every enemy, or changing after restart. Hard game to hack actually =(
_________________

Sry for my english, Hitler.

Last edited by Bl00dWolf on Sat Aug 29, 2015 8:18 am; edited 5 times in total

Display posts from previous:

	Cheat Engine Forum Index -> General Gamehacking	All times are GMT - 6 Hours Goto page 1, 2, 3, 4 Next
Page 1 of 4

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum