Cheat Engine

[Tatsu808]

Hi all, I'm currently attempting to create an aimbot for Fallout 4 using C#. I want to use the formulas below to "auto-aim" at the enemy closest to me.

float pitchX = (float)Math.Asin((enemy.zPos - player.zPos / 3dDistance(enemy, player)) * 180 / PI

float pitchY = - (float)Math.Atan2(enemy.xpos - player.xpos, enemy.ypos - player.ypos) / PI * 180 + 180;

I was able to retrieve pointers and offsets to my x, y, z coordinates as well as my mouse-x and mouse-y values. To find each enemies' coordinates, I first found a single enemies' Y coordinate (I used the enemy named 'Swan'), then found what wrote to that address, opened the memory viewer, and then chose the option, "Find out what addresses this instruction addresses". From there, a list of all the nearby enemy Y coordinates showed. I added several addresses of the enemies' Y coordinates to my address list in order to copy and find a good AOB signature for scanning. Using this AOB signature, I am able to find an address which accesses all enemy Y coordinates between game restarts. Luckily, each enemies' X and Z offsets are just a few offsets from their Y coordinates, so I basically have all enemies' X, Y, and Z coordinates. I'm sure I can find all the enemy HPs the same way.

To do this aimbot in C#, I'm trying to mimic Cheat Engine's "Find out what addresses this instruction addresses" in order to retrieve the list of each enemies' Y coordinates.

I searched the forums and found this thread,

viewtopic.php?t=584937

However, it looks like a C# solution wasn't found. Does anyone know if a library which mimics Cheat Engine's "Find out what addresses this instruction addresses" exists?

Will it be simpler to just use Cheat Engine's LUA script functionality to finish my aimbot? I'm assuming that because cheat engine supports LUA, I will be able to use cheat engine's functions such as its aob scanning and "Find out what addresses this instruction addresses" in LUA scripts?

[Tatsu808]

I guess my next goal will be to look at cheat engine's source code to learn how "Find out what addresses this instruction accesses" works, then re-create this method in C#. Once I have this created (if time permits), I will post and share the C# method/Object.

From my understanding CE attaches a debugger to a specified process, so I may have to use the same method in C# using:

[mgostIH]

[Tatsu808]

Thanks for the reply. I also noticed that most of the addresses in the list were 0x80 bytes were away from each other, but sometimes, they'll be off by some gaps greater than that. For example, towards the bottom the list there's:

C3163D2700
C3163D6980

which is 4290 byes away from each other. Then further down there's

C3163E6F00
C3163E9A00

which is 2B00 bytes away from each other.

I tried finding a pattern to the larger gaps, but am not seeing one. In the picture on my first post, the list is being sorted on the Value column. In the picture attached to this post, they are being sorted on the Address column. I've highlighted some of the addresses that are off more than 80 byes apart. Got any suggestions on how to handle the gaps that are more than 80 bytes apart?

[mgostIH]

[Tatsu808]

True, I added 5 random enemies to the dissect data/structures list and there was some "green" among them all. I haven't tried adding any addresses to the dissect data/structures list that were in between those "gaps" greater than 0x80. it's possible the "bad addresses" will be "red" in the locations where the enemy structures share a green area, but don't know just yet! I shall experiment and find out though! Definitely a good way to tell a good address from a bad one.

I shall look into hooking. Sounds like a very viable solution.

Thanks for the help. I will keep you updated on my progress.

[mgostIH]

[Tatsu808]

I was able to get all enemy coordinates via hooking just by using the following:

mov [storage], rdi
movaps [rdi], xmm0

[storage] then contained rapidly changing values representing the enemy y coordinates. I just kept reading the address at [storage] and added them to a C# dictionary.

[mgostIH]

[sh00ter999]