Cheat Engine

thirdfoot · Newbie cheater Reputation: 0 Joined: 09 Feb 2019 Posts: 21

Trying to find AOB patterns in Northgard like CE does. I've found and created asm to give me food, wood, krowns and faster villager spawns with 4 small scripts that are AOB based.

When I search manually for these AOB, CE finds the areas without issues within 1-2 seconds.

When I try to search Northgard.exe (and all its modules via the process handle) myself with modBaseSize or even to lpMaximumApplicationAddress I can't find a single match. If I use the latter with virtualprotectex, it crashes the game. But won't find anything without either and no errors. If I do it with modbaseaddr+modbasesize it searches fast, but no hits. I do this externally but don't see what difference that would make.

Code works fine for other games where the offsets are exe+addr but in Northgard it seems to be dynamic. An old post by DarkByte indicated the heap is also searched with virtualqueryex, so I'm not getting why I can't find it but CE does...

Driving me nuts. Been at it the best part of this saturday. Was looking forward to make a quick trainer but the AOB pattern is eluding me.

atom0s · Posted: Sat Feb 09, 2019 10:44 pm Post subject:

Use VirtualQueryEx to walk the memory pages of the process, check the flags to make sure they can be read properly before attempting otherwise it can cause crashes. While you loop each page via VirtualQueryEx just dump the full page, scan the dumped memory of that page and move on as needed.

thirdfoot · Newbie cheater Reputation: 0 Joined: 09 Feb 2019 Posts: 21

Dark Byte · Posted: Sun Feb 10, 2019 6:34 am Post subject:

perhaps the aob you're scanning contains bytes from two different regions

e.g one being execute/copy_on_write and the other read/write/execute
(this often happens when you edit memory. A subsection of the memory region changes from execute/copy_on_Write to read/write/execute)

thirdfoot · Newbie cheater Reputation: 0 Joined: 09 Feb 2019 Posts: 21

Dark Byte · Posted: Mon Feb 11, 2019 5:31 am Post subject:

the easiest is just group all readable memory in one
if two subsequent regions are readable merge them into one bigger region

thirdfoot · Newbie cheater Reputation: 0 Joined: 09 Feb 2019 Posts: 21

Was concerned about memory usage doing that, but I'll experiment with it. Thanks.

Dark Byte · Posted: Mon Feb 11, 2019 6:16 am Post subject:

You can of course split that up again into smaller sections, but implement some overlap then

when you split up a region increment the first half with the size of the AOB
So when it overlaps you do find that result as well