Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[HELP] DW 3 XL//OAB scan issue
Goto page 1, 2  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Wed May 27, 2020 5:21 pm    Post subject: [HELP] DW 3 XL//OAB scan issue Reply with quote

Hello,I'm a total beginner in coding/using cheat engine,I've read many guides but I'm still confused.And there im stuck with a problem.

I'm playing Dynasty Warriors 3 Xtreme legend on PCSX2 and have a cheat table,most of the scripts works,but one that I absolutely want simply don't...

Please I need help step by step to solve that issue...

My cheat engine version : 7.0

Thank you all in advance



CE AOB issue.JPG
 Description:
 Filesize:  61.98 KB
 Viewed:  3351 Time(s)

CE AOB issue.JPG




Last edited by Mystic974 on Wed May 27, 2020 6:00 pm; edited 1 time in total
Back to top
View user's profile Send private message
AylinCE
Grandmaster Cheater Supreme
Reputation: 31

Joined: 16 Feb 2017
Posts: 1247

PostPosted: Wed May 27, 2020 5:41 pm    Post subject: Reply with quote

Do the stars have any meaning?

Code:
88 11 A1 30 02 FA 00 * * * * * * * * * * * * * * * * * * * * * * 05 90 00 00 00


Why isn't this code like this?
Code:
88 11 A1 30 02 FA 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 05 90 00 00 00

or

Code:
88 11 A1 30 02 FA 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 05 90 00 00 00

_________________
Hi Hitler Different Trainer forms for you!
https://forum.cheatengine.org/viewtopic.php?t=619279
Enthusiastic people: Always one step ahead
Do not underestimate me Master: You were a beginner in the past
Back to top
View user's profile Send private message Visit poster's website MSN Messenger
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Wed May 27, 2020 5:48 pm    Post subject: Reply with quote

Thanks for the repply ! Well I don't know,someone gave me this cheat table like that :/ But it's not a problem for the other scripts that look similar to the one on the screenshot,with the stars ,and they works fine.

EDIT : I tried to replace each stars with "??",and I had the same error that popped up Sad
Back to top
View user's profile Send private message
Corroder
Grandmaster Cheater Supreme
Reputation: 75

Joined: 10 Apr 2015
Posts: 1667

PostPosted: Wed May 27, 2020 7:50 pm    Post subject: Reply with quote

How with adding preserve memory allocation?

Code:
alloc(newmem,$1024)

_________________
Stealing Code From Stolen Code...
And Admit It.. Hmmm....Typically LOL
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4289

PostPosted: Wed May 27, 2020 8:25 pm    Post subject: Reply with quote

Asterisks can be used as wildcards too.

Allocating more memory for newmem won't fix the aobscan pattern not being found. It's not like those few instructions come anywhere near 0x500 bytes anyway.

If the emulator uses jit compilation, you may need to play the game and do different actions in the game to get the correct code to compile.
Otherwise, find the new injection point. Maybe it still accesses pcsx2.exe+4C0230: add that address to the address list and look at what accesses it.

Even if you do get it working, I have no idea what that injection is supposed to do. All it does is replace a character with a null byte. There's nowhere to specify a name- just a single character.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Thu May 28, 2020 5:37 am    Post subject: Reply with quote

ParkourPenguin wrote:
Maybe it still accesses pcsx2.exe+4C0230: add that address to the address list and look at what accesses it.


Do I have to use pointers?If yes,which one?

ParkourPenguin wrote:
Even if you do get it working, I have no idea what that injection is supposed to do. All it does is replace a character with a null byte. There's nowhere to specify a name- just a single character..


The injection is used to change the class of the bodyguards in the game : You can have playable characters as bodyguards for example ,and changing the value of the adress between 0-255 will change the bodyguards model/name(255 is the number of characters in the game,playable or not)



Blank.JPG
 Description:
[quote="ParkourPenguin"]Maybe it still accesses pcsx2.exe+4C0230: add that address to the address list and look at what accesses it.[/quote] I got a blank window :/
 Filesize:  21.36 KB
 Viewed:  3268 Time(s)

Blank.JPG



access.JPG
 Description:
I used the basic CE scan by changing the number of bodyguards(I don't know if this adress is usefull but there is cleary something about bodyguards ),until I found out an adress,then I used Found out what accesses this adress(nothing to see with character
 Filesize:  22.29 KB
 Viewed:  3268 Time(s)

access.JPG



write.JPG
 Description:
Same adress but this time Found out what writes this adress
 Filesize:  19.23 KB
 Viewed:  3268 Time(s)

write.JPG



browse mem.JPG
 Description:
I browse mem with the adress that I found using number of bodyguards
 Filesize:  220.44 KB
 Viewed:  3268 Time(s)

browse mem.JPG



Browse pcsx2.exe+4C0230.JPG
 Description:
This is what I got when browsing mem of pcsx2.exe+4C0230 adress
 Filesize:  187.22 KB
 Viewed:  3268 Time(s)

Browse pcsx2.exe+4C0230.JPG




Last edited by Mystic974 on Fri May 29, 2020 9:10 am; edited 1 time in total
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 198

Joined: 25 Jan 2006
Posts: 8517
Location: 127.0.0.1

PostPosted: Thu May 28, 2020 5:49 pm    Post subject: Reply with quote

This is not Lua related; moved to proper section.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Thu May 28, 2020 5:50 pm    Post subject: Reply with quote

atom0s wrote:
This is not Lua related; moved to proper section.


Sorry :/
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4289

PostPosted: Thu May 28, 2020 11:21 pm    Post subject: Reply with quote

Without more information on the code in the original injection point it could be hard to find it.

If you can find this 0-255 value, look at what instructions write to it and you should find something to use as an injection point.

Scanning for fewer bytes of the original injection point might work, but you don't have much to go on.
In the main window, set the scan type to array of bytes, clear the writable checkbox, check the executable checkbox, grey the CoW checkbox, scan for "88 11 A1", and for all the results in the exe, do to that address in the disassembler and check to see if it looks like it could be the injection point ("find out what addresses this instruction accesses" on "mov [ecx],dl"). If that fails, try "88 ?? A1". Scanning for "05 90 00 00 00" and scrolling up a bit in the disassembler might work too.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Fri May 29, 2020 10:02 am    Post subject: Reply with quote

ParkourPenguin wrote:


Scanning for fewer bytes of the original injection point might work, but you don't have much to go on.
In the main window, set the scan type to array of bytes, clear the writable checkbox, check the executable checkbox, grey the CoW checkbox, scan for "88 11 A1", and for all the results in the exe, do to that address in the disassembler and check to see if it looks like it could be the injection point ("find out what addresses this instruction accesses" on "mov [ecx],dl"). If that fails, try "88 ?? A1". Scanning for "05 90 00 00 00" and scrolling up a bit in the disassembler might work too.


Thanks a lot for the help ! What should I do from the last screenshot?



array shearch 1.JPG
 Description:
I found this adress with the Shearch for this array shearch mod
 Filesize:  45.1 KB
 Viewed:  3196 Time(s)

array shearch 1.JPG



found it.JPG
 Description:
I found this when scanning for 05 90 00 00 00 in the disassembler of the adress that I've found on the screenshot above. I've enlighted the adress
 Filesize:  187.11 KB
 Viewed:  3196 Time(s)

found it.JPG


Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4289

PostPosted: Fri May 29, 2020 11:20 am    Post subject: Reply with quote

That's in WindowsCodes.dll, not pcsx2.exe. I strongly doubt that's the correct injection point.

Try "88 ?? A1", or try "05 90 00 00 00" and scroll up a bit in the disassembler.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Fri May 29, 2020 11:31 am    Post subject: Reply with quote

ParkourPenguin wrote:
That's in WindowsCodes.dll, not pcsx2.exe. I strongly doubt that's the correct injection point.

Try "88 ?? A1", or try "05 90 00 00 00" and scroll up a bit in the disassembler.
Do I have to do the same process for these shearchs?

If yes ,there is what I found :



shearch..JPG
 Description:
Shearch for 88 ?? A1
 Filesize:  56.85 KB
 Viewed:  3170 Time(s)

shearch..JPG



05 90 00 00 00 shearch.JPG
 Description:
 Filesize:  60.18 KB
 Viewed:  3170 Time(s)

05 90 00 00 00 shearch.JPG




Last edited by Mystic974 on Fri May 29, 2020 1:02 pm; edited 1 time in total
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4289

PostPosted: Fri May 29, 2020 12:31 pm    Post subject: Reply with quote

For all the addresses in the exe (they'll all be about in the same region), go through each one and check:
  1. That instruction is of the form "mov [e??],??"
  2. Those bytes are aligned to an instruction - scroll up a bit in the disassembler then scroll back down. If the instruction disappears, those bytes probably weren't aligned
  3. Right click the "mov [e??],??" instruction and select "Find out what addresses this instruction accesses". If the address you're looking for pops up, that's probably the original injection point.
Remember to first scroll up a bit for the "05 90 00 00 00" pattern.

If you still can't find it, you probably aren't ever going to. Instead, try to find that 0-255 byte value and check what writes to it. I don't know how you'd find that value- you'd need to figure that out.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Mystic974
How do I cheat?
Reputation: 0

Joined: 27 May 2020
Posts: 8

PostPosted: Fri May 29, 2020 2:08 pm    Post subject: Reply with quote

ParkourPenguin wrote:
For all the addresses in the exe (they'll all be about in the same region), go through each one and check:
  1. That instruction is of the form "mov [e??],??"
  2. Those bytes are aligned to an instruction - scroll up a bit in the disassembler then scroll back down. If the instruction disappears, those bytes probably weren't aligned
  3. Right click the "mov [e??],??" instruction and select "Find out what addresses this instruction accesses". If the address you're looking for pops up, that's probably the original injection point.
Remember to first scroll up a bit for the "05 90 00 00 00" pattern.


Here is all of the adresses with 88 ?? A1 for mov [e??],?? that I've found,but 0 of them accesses to any adress.

pcsx2.exe+24ECDC - 88 06 - mov [esi],al
pcsx2.exe+6019D4 - 88 36 - mov [esi],dh
pcsx2.exe+6044D4 - 88 0B - mov [ebx],cl
pcsx2.exe+6045D4 - 88 0A - mov [edx],cl
pcsx2.exe+64D204 - 88 06 - mov [esi],al

They all have the 05 90 00 00 00 pattern (I used scan memory/array of byte : 05 90 00 00 00 to find it in the disassembler)

I've found way more of that like "DSOUND.dll+29954 - 88 36 - mov [esi],dh"and many other different types but I doubt it's usefull.Also they don't access to any adresses too.


ParkourPenguin wrote:
If you still can't find it, you probably aren't ever going to. Instead, try to find that 0-255 byte value and check what writes to it. I don't know how you'd find that value- you'd need to figure that out.



I will try that. Oh my...It's gonna be hard x) And thank you very much for all your help !



kind of results.JPG
 Description:
Shearch result with 05 90 00 00 00,same "add" result for all of them
 Filesize:  49.24 KB
 Viewed:  3121 Time(s)

kind of results.JPG



Capture 1.JPG
 Description:
Here is what I got for all the mov [e??],?? that I've found with 88 ?? A1
 Filesize:  145.54 KB
 Viewed:  3121 Time(s)

Capture 1.JPG


Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4289

PostPosted: Fri May 29, 2020 7:17 pm    Post subject: Reply with quote

You might need to do some action in the game in order for code to run and have something come up in the "accessed addresses" window. I'm not sure what that action would be... opening a menu? Perhaps when bodyguards spawn?

Narrowing it down to only 5 is good. You could set a breakpoint at each of them (highlight instruction, Debug -> Set breakpoint), play the game for a while, and if it suddenly stops working, go to CE and see what instruction triggered the breakpoint. If a breakpoint triggers too often and it's never what you're looking for, remove the breakpoint- it's probably not the correct instruction.
Or watch the accessed addresses of all 5, but you'd need to remember to check if anything comes up while playing.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites