Cheat Engine

[Grimalkin]

I have tried doing the tutorial but I really can't seem to get my head around this stuff at all. I can't even get past step 5.

It's saying things like "you got to this point so I assume you know" when I really don't understand at all. I have followed the directions, but I don't really have any idea what I'm doing and I'm going to need someone to really break this stuff down for me in layman's terms if I'm going to get anywhere with it.

The only reason I even need to use CE is to update the attack addresses in a frame data overlay application to aid my training in practice mode in Tekken 7. I have looked for guides specifically on how to do this but there don't seem to be any available. If someone could just run me through what I need to know in order to accomplish this much that'd be all I really need at this point.

It would probably help me best if someone would be willing to speak with me one to one about this, as I really don't seem to be having an easy time with this stuff despite having a pretty decent level of computer literacy even for a millennial. Code stuff just isn't my thing and I could really do with some hands on help with this if at all possible.

[OldCheatEngineUser]

you can always ask for help, and there is something you should keep in mind:
- no body understands everything s/he do, read, or learn from the first time .. it takes time to memorize things as well as understanding them.

and if you consider yourself as a person who can understand and memorize everything s/he do, read or learn from the first time then you are obviously wrong and teaching you is waste of time.

[Grimalkin]

[Meas]

I'll try to explain the main components of memory editing but feel free to copy-paste a topic into Google.

Disclaimer: I'm no expert on memory, CPUs or CE but hopefully this will help you ground yourself in the basics.

So when using Cheat Engine it'll help to know about:
- Process memory
- Threads and CPU cores
- CPU registers
- The stack
- Memory Pointers
- Assembler (especially x86-64)

Process memory: A process that you open with CE is just a big sequence of bytes (0s and 1s). Those bytes hold no intrinsic context/meaning other than just being there, stored in your PC's RAM. What makes it interesting is what the CPU, with its instruction set, can do with all that memory.
It's important to understand that those 0s and 1s can be displayed in numerous different ways. As a sequence of text (a string), 4-byte long integer, or what ever you want. That's why you have to specify the value type when scanning in CE because CE needs to know what you expect those bytes to be. Just to drive it home, the binary value 1011 can be read as:
- 11 in decimal.
- As two binary: values 10 and 11, meaning 2 and 3 in decimal.
- The order that bytes are read can be different. Left to right or right to left. The order in which your CPU reads bytes is called Endianness: https://en.wikipedia.org/wiki/Endianness

Threads and the stack: The way a process 'can do stuff', which is basically defined as moving bytes around in its reserved memory, is because some regions of that process' memory is being read by your CPU (specifically: the memory region in the process' memory containing the code/assembler instructions) via a thread.
A thread is, like everything else in CPU land, a block of memory for bookkeeping. This block of memory for a thread is called the stack and stores the values to keep track of it (every thread has its own stack). It can tell the CPU:
- Which instruction is the thread currently on? (Stored in 'instruction pointer' RIP register)
- What are the values of the CPU registers (with names like EAX, EBX, ECX etc..)? Used so that a CPU core can continue a thread's execution after pausing it.
- The call stack (part of the stack)
An analogy of a thread can be like your hands picking stuff up and putting it down. You have only 2 hands that can work simultaneously but a quad-core CPU has 4.

CPU registers: The CPU has its own special memory which are accessible through the registers (one copy of registers per CPU core for multi-threading). This memory is extremely limited (but VERY FAST) and is used to store and load results from previous instructions. You can view these values in the thread list in CE: Memory view -> View -> Threadlist (Ctrl+T) -> Expand one thread/item to view its registers with the values.
The value a register can hold depends on its size. You can read more about them here:
https://www.tutorialspoint.com/assembly_programming/assembly_registers.htm

Pointers: A pointer is just a number that points to a memory location (aka: address) inside the process' memory. On 32-bit processes its a 4 byte long number (Ex: FFA105E4) and on 64-bit processes its 8-byte long (Ex: 01020304A0B0C0D0). They are mostly used to point to a base address (aka "first byte") of a struct. A struct is a predefined memory block predefined by the programmer with a fixed size. Example: An integer itself is just a struct with a length of 4 (bytes). A string (text) is a struct with a size depending on how long the text is.

A player struct is a memory block that probably holds things like HP, ammo and other values of the player. It might be 1000s of bytes long, depending on the game, where the first 4 bytes might be the HP and the next 4 bytes the X position of the player. That's why you use CE! To find what these bytes mean!
So when you want to find a pointer to the player struct you have to find the location in memory (aka: address) that HOLDS another address (aka: pointer) to the player.
When you scan for the player's HP value and then do "Find out what writes to this address" on that address you'll get the instructions that write to the player value. Whenever you see "[EAX+4]" as part of an instruction in CE memory view it tells you that that instruction is reading the memory location pointed at by the value in CPU register EAX + OFFSET 4.

It can be useful to snoop around the memory region that a CPU register points to (which is the base address without +offset) because it's the first byte of a struct and can lead you to finding related values easily.

Assembler (particularly x86-64): When you open the memory viewer in CE while attached to a process you'll see the Assembler instructions that are written down inside the process' memory. The Opcode column shows what CE thinks is the assembler instruction based on the bytes it read at that memory location. Those bytes indicate what operation the CPU thread is going to do when it is on that instruction BUT it also contains the arguments for the operation. Example: first 2 bytes is operation, next byte is register to read from and 4th byte is value. Instruction size = 4 bytes.
The most common instruction (on X86-64 assembler) is probably "mov". It will move the value on the right-hand side into the left-hand side. Some quick assembler:

mov eax,1 = move the (hex) value 1 into CPU register EAX
add eax,f = Add 15 (F in hex) to the value stored in CPU register EAX

About modifying assembler instructions: If you change the instruction through CE it might complain about the change in instruction size. If your new instruction is smaller (fewer bytes needed) then CE can pad the remaining bytes with a NOP instruction which will have no side-effects. If it's larger then CE can either cancel the change or overwrite instructions that are after your changed instruction.
If you want to learn how to change instructions without breaking the code you can lookup "Cheat engine Auto assembler" tutorials.

[Grimalkin]

[OldCheatEngineUser]

these are the basic technical knowledge you need in order to achieve something, i willsend you my discord ID.

look at your PM's from here https://forum.cheatengine.org/privmsg.php?folder=inbox

[schooluser]

[jgoemat]

Just wanted to add that if you are stuck and someone helps you so you overcome the problem, try to keep track of what helped you out and post it. Maybe the tutorial could be improved or expanded to make it easier for others.