View previous topic :: View next topic |
Author |
Message |
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Mon Jun 06, 2022 1:33 pm Post subject: Searching for two closely linked values at once. |
|
|
Didn't have enough title space to explain.
I want to search for a value, say 100. Every time the scan finds a value of 100, I want it to then check exactly 4 Bytes above that address, and check if the value +4 Bytes up is say, 120. Any time the search finds the value 100, and then finds that the value 120 is 4 Bytes above it, display the address of the 100 value in the results.
Don't know if it's possible or if it would take a lifetime to scan, but that is what I need to do. I can't change two values or anything around them. I know they are exactly 4 bytes separated, and that is it. So ultimately, I want to find every instance in the memory where the value 100 is then followed 4 bytes later by the value 120. Those particular values don't matter and are just examples.
Can this be done?
|
|
Back to top |
|
|
AylinCE Grandmaster Cheater Supreme Reputation: 32
Joined: 16 Feb 2017 Posts: 1260
|
Posted: Mon Jun 06, 2022 2:54 pm Post subject: |
|
|
Code: | function searchVal(scnVal,upVal,rangByt)
aobs = function(t) for k,v in ipairs(t) do t[k] = ('%02X'):format(v) end return table.concat(t, ' ') end
search = aobs(dwordToByteTable(tonumber(scnVal)))
aob=AOBScan(search)
if aob~=nil then
for i=0,aob.Count-1 do
aobfind=(aob[i]) .. "+" ..tostring(rangByt)
if readInteger(aobfind)==upVal then
print(aob[i]) --scnVal address
--print(readInteger(aob[i])) --scnVal
--print(readInteger(aobfind)) --upVal
end
end
else
print("code not found")
end
end
--use
searchVal(100,120,"04") |
result:
7FF99443BF5C
100
120
_________________
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4300
|
Posted: Mon Jun 06, 2022 3:01 pm Post subject: |
|
|
A group scan is the closest you can get to that w/o Lua scripting.
If by "above" you mean after, it would be `4:100 4:120`
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Mon Jun 06, 2022 4:44 pm Post subject: |
|
|
Freakin love you Aylin
ParkourPenguin wrote: | A group scan is the closest you can get to that w/o Lua scripting.
If by "above" you mean after, it would be `4:100 4:120` |
I'm unfamiliar with group scans. Is there a resource for learning about it? Or a quick explanation of what 4:100 and 4:120 would do?
Edit: Ok so I figured out the grouped value thing. I have another question to follow it up. Let's say that I've got two 4 byte values, but I don't know exactly how bytes they are from each other like in the above example. But once again, I cannot change their values. I only know they are likely to be within a few thousand bytes of each other at most. Is this something I can scan for as well?
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4300
|
Posted: Mon Jun 06, 2022 6:45 pm Post subject: |
|
|
Check "Out of order". Blocksize is the size of the block of memory those values reside in (e.g. a few thousand), block alignment is the alignment of the start of the block, and "must be type aligned" basically only finds values in the block if they are aligned (use this).
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Wed Jun 08, 2022 1:57 pm Post subject: |
|
|
ParkourPenguin wrote: | Check "Out of order". Blocksize is the size of the block of memory those values reside in (e.g. a few thousand), block alignment is the alignment of the start of the block, and "must be type aligned" basically only finds values in the block if they are aligned (use this). |
After messing around this makes sense, but what do you mean by "alignment of the start of the block"? Everything I'm looking for is in increments of 4 bytes so i've been leaving it at 4. Not sure if that's what it means, or what. Sometimes they're 4 bytes away, sometimes 20 bytes or more. It changes every time, but I know it's in increments of 4. So what would I put in that box to maximize efficiency?
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4300
|
Posted: Wed Jun 08, 2022 2:56 pm Post subject: |
|
|
CE basically goes through memory by blocks.
Code: | 12 byte blocks
Each x is a byte in memory
block alignment of 1:
xxxxxxxxxxxxxxxxxxxx...
|__________|
|__________|
|__________|
block alignment of 4:
xxxxxxxxxxxxxxxxxxxx...
|__________|
|__________|
|__________| | 4 is fine in your case.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Thu Jun 09, 2022 11:38 am Post subject: |
|
|
ParkourPenguin wrote: | CE basically goes through memory by blocks.
[code]12 byte blocks
Each x is a byte in memory
|
Hey man, your reply to my posts about grouping searches and it's opened a whole new world.
However, I now have a new problem, and I cannot figure out how in my life to even approach it. I don't even know what to ask for. Is there a world in which you'd be down to join me on Discord and let me share screen to see if you can tackle it? The learning experience would be invaluable for me.
I can't PM on this account and can't find my old one. If you're agreeable, please send md a PM with your discord info so I can use that brain. If not, I'm super appreciative for what you gave me already.
|
|
Back to top |
|
|
AylinCE Grandmaster Cheater Supreme Reputation: 32
Joined: 16 Feb 2017 Posts: 1260
|
Posted: Thu Jun 09, 2022 2:53 pm Post subject: |
|
|
This is somewhat dangerous code. It can take a lot of testing, hold, and be annoying.
A frequently used value like 100 will cause a lot of testing.
Still, it's an idea. (But I wouldn't recommend using it )
You can look up the hidden value (120) by *4 bytes high.
If there is more than one hidden value in a single address, it can list the same address again. If you don't want this to happen, I can add a code that eliminates the same address.
Code: | function fullByte(addr,newByt,upVal)
local res = 0
aobfind=(addr) .. "+" ..tostring(newByt)
if readInteger(aobfind)==upVal then
res=1
else
res=2
end
return res
end
function searchVal(scnVal,upVal,findMem,opt)
aobs = function(t) for k,v in ipairs(t) do t[k] = ('%02X'):format(v) end return table.concat(t, ' ') end
search = aobs(dwordToByteTable(tonumber(scnVal)))
newByt=4
aob=AOBScan(search)
if aob~=nil then
for i=0,aob.Count-1 do
if opt==true then
aobfind=(aob[i]) .. "+04"
if readInteger(aobfind)==upVal then
print(aob[i]) --scnVal address
--print(readInteger(aob[i])) --scnVal
--print(readInteger(aobfind)) --upVal
end
else
for j=1, tonumber(findMem) do
newByt = 4 * tonumber(j)
rangByt = string.format('0x%X', newByt);
res1 = fullByte(aob[i],rangByt,upVal)
if res1==1 then
print(aob[i])
print(upVal .. "; The results were found " .. j .. " sets of 4 bytes ahead.")
end
end
end
end
else
print("code not found")
end
end
--use
--searchVal(Search value,Searched hidden value,Memory limit to scan (how many clusters of 4 bytes to go forward?),limited (4 bytes as well (true)) or up to the given limit (false))
searchVal(100,120,400,false) |
_________________
|
|
Back to top |
|
|
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Thu Jun 09, 2022 4:48 pm Post subject: |
|
|
I've located a value that I need to change, and I simply cannot change it. There is a code out there somewhere that is preventing it from increasing under a certain condition. Is there any chance anyone reading this might be able to give me a live demonstration on how I can find it? It's something I've always struggled with and a concept I really, REALLY want to understand, even if that understanding is just seeing it done one time in front of me.
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4300
|
Posted: Thu Jun 09, 2022 7:49 pm Post subject: |
|
|
More likely than not, you didn't find the right value. Values can get cached for too many reasons to name. Maybe the real value is some other data type, maybe it's comprised of other values (e.g. current skill points = total - spent), or maybe it's not even stored on your computer (online games).
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Thu Jun 09, 2022 8:10 pm Post subject: |
|
|
Ok so the value itself can't be found, but I can modify another value that alters it. I can freeze a button to be always be pushable. Normally, you push it once, you have to wait until tomorrow. It's a workaround for directly modifying the value, cause as you said, modifying it directly doesn't work. However, this button that gives, say, 10 points per click, stops working after a while. One counter shows the points going up, but the important counter stops. It stops at exactly one week's worth of points. So I can't edit it directly, and I cant increase it indirectly. How do I go about either finding the real value, cutting out whatever is capping it at one week, or change it from a week to 99 maybe? I have no idea how to find something like that.
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 140
Joined: 06 Jul 2014 Posts: 4300
|
Posted: Thu Jun 09, 2022 9:33 pm Post subject: |
|
|
I'm assuming it's not an online game. Load the game and disable your internet connection. If you can't play the game normally anymore, the value you want probably isn't stored on your computer and you should give up.
My first guess is that the real value is obfuscated in some way, and the value you found is probably a cached decrypted value used for UI purposes. It's not uncommon for game devs to apply some operations to stored values as a form of cheap obfuscation, or maybe it's merely a consequence of a combination of other values. Try scanning for unknown initial value and changed/unchanged scans afterward. Once you can't narrow down the results any further, start freezing values and see what happens.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
sylfaen How do I cheat? Reputation: 0
Joined: 06 Jun 2022 Posts: 9
|
Posted: Fri Jun 10, 2022 12:38 pm Post subject: |
|
|
The game IS online, but everything is saved client side because the Dev is a designer and doesn't know how to code. He was given the engine and just adds content.
|
|
Back to top |
|
|
|