Cheat Engine

[I_Dont_Bot]

Hi All,

I've recently started a project to get some hands on practice with python. I decided to write a bot, that plays a game, similar to candy crush, where you have to combine gems. At first I went with reading screenshots approach, and already have a somewhat working thing, but I feel like going a little further, and adapt it to read from process memory. When it comes to memory reading, you can consider me a total n00b.
I did play around with CE (All the tutorials completed, most of YT videos watched), but all that was not exactly for my use case. It's a great tool for finding values in memory, and do modifications to those via direct modification or insertion of new logic, however it's not what I actually need. Now the problem is I can't seem to find information for my case.

My use case:
Since there are a few screens in game, with clickable options, I'd like my bot to determine which screen the game is on, and most important, to be able to read all the layout of the gems from memory.
So my questions are:

1. Most important - is CE the right tool for this? I am pretty sure, that the layout is doable, only finding the values for gem type, and how the game fills the board/layout entity is tricky. But if there's no way to figure out the game state, then that's only half the thing I need.

1.a) If something similar was already done - please share any insights/material you have/know. I would really like to know where to start here, other than the obvious ones like git gut with assembler/scans/memory stuffz etc.

2. I would like to keep the game untouched, so it would be best, if only scans are used, and no injections. Question is - Can I see with CE when a certain call is made (Let me remind you, I don't exactly know, how in memory things work)? If so, what is the general approach for that? If there's no other way, than doing some kind of trigger instructions/api's, i'm ok with that - but would prefer not to.

2.a) Now that I think about, if a waiting for a call logic is implemented, that might be heavy on processor, since I assume that scans should be looped until some value is found in certain address (however now I'm doing same thing with reading screen pixels, so maybe it's ok) - Are there any other ways I could do this?

I hope It makes sense, and hope someone will be able to explain this topic. Also, sorry if this was asked before - I've tried a few keywords and didn't find anything neither here, or anywhere else in the webz.

Cheers!

[ParkourPenguin]

Basic question, but have you tried searching for relevant values? i.e. focus on a tile and do changed/unchanged scans

[I_Dont_Bot]

Hi,

[ParkourPenguin]

[I_Dont_Bot]

Hi,

I feel like you missed a little of the original post (Maybe I made it a little TL;DR - my bad )

[OldCheatEngineUser]

[I_Dont_Bot]

Hi,

[OldCheatEngineUser]

the best results can be achieved by injecting some code into the process memory.

yeah, you can do more stuff easily with mono. (browsing symbols .. etc.)

there is a tool that can decompile assembly-CSharp.dll into 99% accurate C# code.

its .NET reflector, you might need an extra plug-in called Reflexil.

[ParkourPenguin]

[I_Dont_Bot]

Well, with mono disector and ILSpy I've got a pretty good look into all the ingame data structures, that I needed.

Say I found a method, from which the whole sequence of the stage shift happens - this would be a good place to implement some kind of trigger, that my python could pick up, and register this shift. I can think of a few options for this as well:

a) Inject assembler instructions, that would register some kind of flag, which I would search for on python.
b) Use something in this function as a flag, what can be picked up by python scans.

Maybe there are other, more simple ways to register that call?

...Damn, the more I try to figure this memory reading thing out - the less I understand

I also noticed, that even from disector, when I jump to disassembler, the base address (the one with no offset) sometimes dissapears after a few seconds. Could it be, that it is dynamic, and I won't be able to hardcode it's address for lookups?

[ParkourPenguin]

Again, I'd recommend code injection. Search for a suitable injection point that only accesses the relevant address and runs often enough. Find that injection point in Python (some type of aobscan; hope there's a module for that), allocate memory in the target process, use a code injection to copy that address to the allocated memory, and use that pointer in the allocated memory to access the board state.

There are plenty of tutorials for this out there. I think it goes by the name "injection copy," but it could go by other names. A part of this topic mentions it.

[I_Dont_Bot]

Yes - at this point I'm considering every possible solution. I am willing to start injecting codes at this point, but every tutorial out there is for adjusting values - not storing them in other places for later reading.
For now it's uncharted territory for me - It looks easy, when I watch people break code, but when I'm about to read something out, it's like I'm first time looking at the code.

Here's an example - below C# code - as simple as it gets:

[ParkourPenguin]