Cheat Engine

jerome64 · How do I cheat? Reputation: 0 Joined: 07 Dec 2023 Posts: 8

Hey community,

I'm seeking advice on the best way to quickly retrieve new static addresses and offsets after each update without having to go through extensive re-search. Is there an effective technique, such as using AOB (Array of Bytes) or any other trick that allows saving stable elements, ensuring easy retrieval of addresses after an update?

Any shared suggestions or experiences would be greatly appreciated. Thanks in advance for your help!

ParkourPenguin · Posted: Wed Dec 13, 2023 10:41 pm Post subject:

AOB scan for code, not values.

If you want base addresses for pointer paths, scan for instructions that reference each base address. Dissect code can help with that.
As for offsets... I don't know. You could scan for relevant instructions too, but why use pointers then? Just do an injection copy to get the address or some node in a pointer path to the address.

If code updated and the aob pattern stops working, try using wildcards. Lean a bit about how instructions are encoded as machine code (REX prefix, opcodes, ModR/M & SIB bytes, etc.) and you can more effectively use wildcards.
The comment at the end of the AOB injection template is vital for when the game updates. You can see all the instructions around the injection point and use that as a reference when searching for the new injection point.

Learning about how instructions are encoded can also let you know which instructions to avoid when choosing an injection point. Instructions that use RIP-relative addressing will almost certainly break the aobscan pattern on an update (reassemble & readmem if they can't be avoided, or {$lua} if it's really screwed up).

jerome64 · How do I cheat? Reputation: 0 Joined: 07 Dec 2023 Posts: 8

ParkourPenguin · Posted: Thu Dec 14, 2023 3:21 pm Post subject:

Try completing the CE tutorial if you haven't already.

You don't have to take a college course in software reverse engineering to hack games, but you should at least be able to read x64 assembly.

Search for "injection copy" for details on using a code injection to get an address. I generally prefer that over pointer paths.

Most of the time, I can do whatever I want by changing code- no need for values. e.g. want infinite ammo? NOP the call to the function that subtracts ammo. Finding that function can be annoying, but that comes with experience. You may be able to get away with just nopping the instruction that writes to ammo.

jerome64 · How do I cheat? Reputation: 0 Joined: 07 Dec 2023 Posts: 8

It work for exemple:
Game.exe+38DA63F and 7 offset ?