Cheat Engine

jeps997 · Newbie cheater Reputation: 0 Joined: 07 Sep 2019 Posts: 10

Hello everybody and hope you have a wonderful day! Smile

I am trying to develop a mmorpg bot for a game. The game is basically 2d mmorpg. It is a clone of minecraft/terraria but the point is that it is tile-based.

My bot will be a "memory bot" so basically it will read every tile's positions from memory and the players' position etc. Why I have decided so is that it will be much more efficient than just a color detection. Also the developers don't care about bots in the game.

So my question is that how can I find the game world in the memory? I already know the map is about 200x200 tiles in size and I also mostly know what the ids are of the tiles. (I already know how to find the player's position in the memory)

Also you can punch blocks in the game. (There is button for that) So my second question is that how can I find the game's function (punch block) from the memory? I think maybe I should for example search for the value 1 while the character is punching and when it is not punching I have to search for the value 0. But what is the simplest way to accomplish this? You have to hold the button down in order to punch.

Greetings traveler

Banjo Patterson · Cheater Reputation: 1 Joined: 15 May 2018 Posts: 36

What game is it? When you punch a block, does it reduce its health permanently or temporarily? If permanently that would make it easier to do a variety of scans starting with unknown initial value and then decreased/increased value scans depending on how the game handles the “health” of a block.

If you know the IDs of particular tile types, you could do a search for the tile type ID of say a block of dirt, then replace that block with a block of grass and next scan for that ID. If you get a narrow listing and think you might have the right address, you can check what e.g writes to that address. From there you might get some code like mov [eax+1C], ebx that’s triggered when the block is removed or replaced. From there you would know eax is a pointer to the block structure itself and ebx would be the new ID.

After that you could do a 4 byte hex scan for what eax was and you might find a section of memory that holds a list of pointers to all game tiles, then you can just iterate over that list.

Hopefully that gives some ideas, sorry if the formatting is ugly just on my phone.

jeps997 · Newbie cheater Reputation: 0 Joined: 07 Sep 2019 Posts: 10

Hello and thank you alot for your answer @Banjo Patterson!
Your post was very helpful and I managed to find the area in ram (while the game is running) where the tile based map is stored. Now my question is that how can I find a static pointer to this list? Also I think I can not tell the name of the game here because of the forum rules.

Banjo Patterson · Cheater Reputation: 1 Joined: 15 May 2018 Posts: 36

Happy to hear that helped! I did overlook the fact it was an online game but this thread hasn’t been locked yet so maybe it’s deemed alright in this case.

To find a static pointer to that list, you can do a pointer scan for the lists address, and then restart the game and do a rescan for the new address of the list. Eventually you will be left with a reasonably sized list of addresses which should all point to your list of interest.

If you need an extra hand / haven’t done pointer scans before just let me know.

jeps997 · Newbie cheater Reputation: 0 Joined: 07 Sep 2019 Posts: 10

Hi @Banjo Patterson and thank you alot for help. I managed to find the game world's base address from memory as a static pointer and also managed to save it as array in my C# code.

Yes I have done pointer scans before but now I have some other problems.
So basically in the game you can place blocks (not a surprise Very Happy

) and ofc remove them. So now what I want to do is be able to make the character place a block in specific coordinates from C# code. So I think I need to reverse engineer some block placing function in the .exe but I am not too good in Assembly (x86-64) yet. I read online that I could use ultimap/dbvm but I didn't get them to work.

Btw the reason I want to make this memory based is that I can run multiple instances of the game at the same time on once pc and have more efficient botting. Also I thought I need to find the functions in game to move the character but I think I probably do not need that since I can just send keystrokes to a certain .exe from my C# code.

tbsoares · How do I cheat? Reputation: 0 Joined: 24 Dec 2019 Posts: 5

Hello guys Smile

jeps, I'm in the same situation as you, trying to make a memory bot, but my game is android app then I use nox. I am reading in memory by python e send keystrokes but any moment it is not efficient. I would like to know, what do libraries u use in C# and can you send key to process minimized?

About game functions, Could you find the solution to run them?

Thanks u Smile

jeps997 · Newbie cheater Reputation: 0 Joined: 07 Sep 2019 Posts: 10

Hi @tbsoares, my problem is that I can not find the game functions but you could write pretty easily DLL for them if you happened to find them.

For reading game memory I use ReadProcessMemory function and for writing memory I use WriteProcessMemory. And yes you can send a key to a "minimized" window, you can even send mouse clicks to certain coordinates of that minimized window (if I remember correctly).

I might want to team up with you for your project depending on the game, can you pm me your discord name?