Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Extremely unstable pointer.

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions
View previous topic :: View next topic  
Author Message
MrGentle
How do I cheat?
Reputation: 0

Joined: 29 Sep 2015
Posts: 7

PostPosted: Wed Apr 20, 2016 7:25 pm    Post subject: Extremely unstable pointer. Reply with quote

So i'm trying to find the pointers for the players x/y position in Hotline Miami.

I found the X value, ran a lvl 5 pointer scan on it, and after some rescans i came back with a nice healthy pointer.

Now i try the same for the Y value, but nothing. I tried pushing it up to a level 10 pointer, found about 2bill pointers. After the rescan, i had 0.

What is going on here?
The X pointer always works, but the Y pointer is constantly changing.

Also, lets say the X value is at 00001000 and Y is at 00001004
When i restart the game this happens:
X: 00001000
Y: 00000FFC
Afterwards it can be above the X address again, i just don't get this.

Is there any way for me to get a static value from this address w/o using pointers?

Tell me if you need additional information.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Wed Apr 20, 2016 11:48 pm    Post subject: Re: Extremely unstable pointer. Reply with quote

MrGentle wrote:
Also, lets say the X value is at 00001000 and Y is at 00001004
When i restart the game this happens:
X: 00001000
Y: 00000FFC
Afterwards it can be above the X address again, i just don't get this.
-I've never seen that...ever. I've seen coordinates being stored different ways, different sizes (for different targets), but never changing order like that.

If your first pointer works, then you should be able to use that for your other coordinates. If you find a working pointer for a coordinate then you shouldn't have to scan for your second coordinate, as it should be next to your first coordinate (I've never seen it not be).

If it's a standard, 32bit game, and your coordinates are four bytes apart, then just change the last offset of your first pointer + or - and you should have your next coordinate. So, if your healthy pointer is this:

Code:
[[["game.exe"+44FF]+80F]+44]


...then the pointer for your next coordinate(s) should be one of the following:

Code:
[[["game.exe"+44FF]+80F]+40]
[[["game.exe"+44FF]+80F]+48]


As far as a reliable solution that works every time...you can try injection. I don't even use the pointer scanner anymore because injection is a superior alternative 99.99% of the time.
Back to top
View user's profile Send private message
Arondai
Newbie cheater
Reputation: 0

Joined: 20 Feb 2016
Posts: 12

PostPosted: Wed Apr 20, 2016 11:54 pm    Post subject: Reply with quote

Anything is possible, the X,Y values being swapped is a bit strange. Normally if the game would use special tricks to relocate values to make finding values to modify a bit more difficult, there would be more distance between those values.
What you need to find out is how the X and Y values are being read from the gamecode, so you can figure out how this addressing of the values works.
The gamecode will tell you why values are where they are and a pointerscan tells you where the values are.Use the combination to understand how it works.

So, put breakpoints on the data the pointers are referring to and investigate the code you see when the breakpoints are reached.
In normal scenario's, the X and Y value would be stored in a 2D Vector, consisting of two float values for instance. These values would always lie directly next to eachother, the X first, or the Y first, but never an altering order.
Therefore, it's possible that the values are stored separately but even then, it's unlikely they get swapped constantly.

I personally never use pointerscans, but even if I did, I would investigate the code that creates/updates those pointers afterwards.
Back to top
View user's profile Send private message
Cake-san
Grandmaster Cheater
Reputation: 8

Joined: 18 Dec 2014
Posts: 541
Location: Semenanjung

PostPosted: Wed Apr 20, 2016 11:59 pm    Post subject: Reply with quote

X and Y axis address are always near to each other on any game (I had never found any game that X and Y axis are far apart -_- )

simply just add/sub 4/8 from that X axis address and you should get the Y axis address.

Example:
Let say your X axis pointer is:

offset- 0x20
offset- 0x10
offset- 0x00
base - game.exe+B04

Then,just add/sub 4/8 from that first offset and you might get Y axis pointer like this :

offset- 0x24 <---- see, I add 4 from it.
offset- 0x10
offset- 0x00
base - game.exe+B04

I would recommend you to manually find the pointer ,though because
pointerscan will sometimes skip on solid pointer( depends on the game engine) and by manually finding the pointer yourself,you should grasp how the game works. -_-

Regards.

_________________
...
Back to top
View user's profile Send private message
MrGentle
How do I cheat?
Reputation: 0

Joined: 29 Sep 2015
Posts: 7

PostPosted: Thu Apr 21, 2016 4:35 am    Post subject: Reply with quote

Thanks for the answers guys!

So, whenever i switch rooms, both pointers became unusable.. should've thought of that earlier! I think i have to step away from pointerscanning for this game. (Get out of my comfort zone)

Just to clarify something, i already tried looking around the X-pointers offsets for the Y-pointer, and it was usually offset by like +/- 100..

Quote:
As far as a reliable solution that works every time...you can try injection. I don't even use the pointer scanner anymore because injection is a superior alternative 99.99% of the time.


How would i go about finding a reliable address through injection?


Quote:

So, put breakpoints on the data the pointers are referring to and investigate the code you see when the breakpoints are reached.
I would investigate the code that creates/updates those pointers afterwards.


I've never really been able to use the break/trace function efficiently, since i never really had an use for it(I think i never had a use for it atleast). So i'm kinda clueless when it comes to that part of the REing. I'll look around for some tutorials on how to use it i guess.


Edit: Btw, whenever i checked what wrote to the x/y addresses, the disassembler said something like:
[eax + 8]
but in reality it was
[eax + C]
Also, looking at what the same instruction accessed there was like 8-9 different addresses..
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Thu Apr 21, 2016 4:44 am    Post subject: Reply with quote

MrGentle wrote:
How would i go about finding a reliable address through injection?
-Right-click the address in your cheat table to see what is accessing it. Hook an instruction that is exclusive to coordinates, or, incorporate a filter. Write a script that will feed you the address every time, and add it to your cheat table so that you can manipulate it as you wish.

Typically, only one instruction is all that is needed for all coordinate retrieval and manipulation, however, if what you're saying about this target is true, then you may need to implement multiple injection points.

By the way, if possible, what is the name of the target and on what platform/environment are you running it?
Back to top
View user's profile Send private message
MrGentle
How do I cheat?
Reputation: 0

Joined: 29 Sep 2015
Posts: 7

PostPosted: Thu Apr 21, 2016 5:03 am    Post subject: Reply with quote

++METHOS wrote:
-Right-click the address in your cheat table to see what is accessing it. Hook an instruction that is exclusive to coordinates, or, incorporate a filter. Write a script that will feed you the address every time, and add it to your cheat table so that you can manipulate it as you wish.

Typically, only one instruction is all that is needed for all coordinate retrieval and manipulation, however, if what you're saying about this target is true, then you may need to implement multiple injection points.

By the way, if possible, what is the name of the target and on what platform/environment are you running it?


I'll see if i can figure something out with that method. Unfortunately i don't understand too much about "advanced" assembly usage. (But that's why i'm learning these things!)

Target is Hotline Miami for PC(Windows, The version Updated/Ported from GML to C++), running through steam.
Back to top
View user's profile Send private message
SunBeam
I post too much
Reputation: 65

Joined: 25 Feb 2005
Posts: 4023
Location: Romania

PostPosted: Thu Apr 21, 2016 8:15 am    Post subject: Reply with quote

Just seen this. I concur, the X/Y (and Z, if 3D) should always be +0x4 away from each other.

I always said Pointer Scan is unstable, unless.. the pointer you found is used by the game Wink

Try this:

- add your pointer to the list
- debug it (find out what accesses it)
- if nothing pops up, then your pointer is, as you said, unstable (means it's being filled in with data based on some random logic - or - used as temporary storage by the engine)
- if something comes up, start tracing the code and see if you get to a level of your pointer

e.g.:

- ptr = 0x586422; +2C = X; +30 = Y; +34 = Z
- debug 586422
- something comes up like "mov ecx,[eax]"
- looking at the code:

mov ecx,[eax]
mov ecx,[ecx+2C] <- X
mov ecx,[eax]
mov edx,[ecx+30] <- Y
..
..

Something like that Smile

BR,
Sun
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites