Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Finding Pointers in PCSX2 is an Impossible Mission for me...

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
rfb
Newbie cheater
Reputation: 0

Joined: 01 Apr 2016
Posts: 15

PostPosted: Fri May 13, 2016 4:23 pm    Post subject: Finding Pointers in PCSX2 is an Impossible Mission for me... Reply with quote

I'm writing this out of deep frustration and surrendering spirit.

I'm genuinely tired of searching everywhere for this information and always being directed to topics that have the exact title that I want, but develops into such an advanced talk that I don't understand the first thing they said.

Let me give you guys a background on my CE knowledge: I downloaded CE and started the tutorial and learned how to do everything there. The things that I found too difficult, I searched on Google and YouTube for explanations and Tutorials. Very well, I've done everything that darn thing told me to do, and I repeated that Tutorial many times.

Later, I subscribed to a lot of Cheat Engine teaching Channels on YouTube, aiming on improving what I knew. I learned from the basic stuff to making a simple injection code using the assembler.

Great, there I am, so proud, so joyful, thinking that I can now start cheating on my favorite old games from PS2. For the most part, I did very well. Some games are just too easy to cheat on. Some offered more challenge, but I was able to think it through; using the Memory Viewer helped a lot. But my knowledge of pointers (given by the Tutorial) never helped me any bit in those tasks.

Then, I came into some hardcore games (to me)...FFX, FFX-2, Dynasty Warriors Series and so on. Everything, and I mean, every little thing I learned about pointers: in the tutorials, on this forum, on Google, on YouTube, never helped me, I used everything I learned, I came up with...: nothing. Every search I made gave me something like "[ecx], eax", which never helped me, because searching for pointers based on these values always returned no results; or the search would give me "[ecx+xx], eax", which for a moment would make me smile happily! Just to have my dreams crushed when the result I was looking for didn't come up when I tried to create the pointer + the offset.

Seriously, I'm tired...not tired of trying, but tired of hitting my head on the wall every time. You know, I thought that maybe the problem was probably just the use of an emulator, so I tried playing a simple game from steam, one that I could deal with directly. What do I found? Well, my knowledge of pointers didn't work there either...: found a dynamic value and tried to find its pointer, results? Not one to be found. Always "[ecx], eax" or something like that.

I wasted hours and I mean HOURS, hours per DAYS, then WEEKS (when my routine permitted) reading everything I could find on this forum that could relate to my problem on pointers, read great tutorials, that explained the origins of pointers and how they work in memory and blah, blah, blah, great stuff, but not practical... .

Also, my knowledge of programming is shallow, at best, and non existent, if realistic. I went through a course of VB6, but it was ages ago and I don't remember a thing of it, not that it would help me anyway, I believe.

Now that I complained enough and gave my background to you guys, so that you know you're dealing with a complete newbie, I'm going to ask my question:

How can I find pointers to games in pcsx2??? To be more specific, let's use the game I'm currently playing: Dynasty Warriors Gundam 2. I was able to realize that in Official Mode (the story mode), the values for the Armor (HP), Special and Thruster (Boost) are static to each mission. Also, the Pilot Points (experience) are static to each character, so once you've found them, you're good for life.

But the problem comes now. The Mission Mode, which is where the player really spends its time, the best part of the game, has dynamic addresses... so I tried doing the same thing I did on Official Mode, but every time I entered another battle, the game would simply change the addresses again, similar to FFX. I tried looking for pointers, what do I find?? Take a guess...:

For the Armor "3097D26D - 89 11 - mov [ecx],edx"

Yay, this thing again! Thank god the CE's Tutorial prepared me for it, right? Errr..., no.

Looking for the address in a 4-byte search in hex gives me nothing; adding a pointer with offset 0 gives me nothing.

This is the before and after of the command in my assembler:

Quote:
3097D256 - C1 E8 0C - shr eax,0C
3097D259 - 8B 04 85 3000800F - mov eax,[eax*4+0F800030]
3097D260 - BB 6FD29730 - mov ebx,3097D26F : [9DA805C7]
3097D265 - 01 C1 - add ecx,eax
3097D267 - 0F88 D33F83D2 - js pcsx2.exe+2201240
3097D26D - 89 11 - mov [ecx],edx
3097D26F - C7 05 A89D7E01 143D2400 - mov [pcsx2.exe+839DA8],00243D14 : [(float)-125.1030]
3097D279 - 83 05 C09E7E01 04 - add dword ptr [pcsx2.exe+839EC0],04


Does anyone have a clue on how to help me? Just tell me something! Even if you give me materials to study I will already be happy, just give me a clue. I'm going crazy here...

And a request, to DarkByte and whoever is related to this: Please man, think of the children, think of us babies in CE that need milk. Improve that tutorials of Cheat Engine, implementing new tough cases and puzzles so that we are prepared to what we are going to face. Why do we have to suffer on games when you could make us suffer on the tutorials, which will have explanations to what we need to do to escape the problems? I prefer a thousand times to suffer in front of my sensei, than to suffer when my life may depend on it...

Thanks in advance for anyone who had enough patience to read 'til here.

Any reply that brings edification is welcome.


Last edited by rfb on Fri May 13, 2016 10:22 pm; edited 2 times in total
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 140

Joined: 06 Jul 2014
Posts: 4289

PostPosted: Fri May 13, 2016 9:29 pm    Post subject: Reply with quote

rfb wrote:
How can I find pointers to games in pcsx2?
...
Does anyone have a clue on how to help me? Just tell me something!
Give up.
If you did research into what pointers are and emulators are, you should realize finding a static pointer to some value in a software being emulated is completely different from finding one in an already compiled binary. The pcsx2 emulator could be categorized as a virtual machine- a piece of software that emulates a computer system. As such, that asm you're looking at isn't a part of the game, but of the emulator itself. AKA, those instructions you see won't lead you to any pointers. You'd need to reverse engineer both the emulator and the game to find a good reference to your value. Even then, you'd still need a static reference from your computer to the game in the emulator.

Try the pointer scanner if you want a better hope at finding something. Make sure to use several pointer maps (restart your computer each time) and use a high max level and max offset. Just note that it's a possibility there just aren't any viable static pointers you could use. Take flash games for example. You could try a L20 pointer scan with a max offset of 1MB and still not find any reliable static pointers. Those that show up the first time wouldn't the next time you restart flash. Even if you did miraculously find something, I highly doubt it would work for anyone else, and the smallest update to flash would very likely cause it to break.

If that doesn't work out, try hooking that instruction and looking through the addresses around the value you want for something that you could use to discern that from the other addresses that instruction accesses (i.e. a string or a pointer to some other structure). See this topic for info on hooking an instruction (the "injection copies" section; also has outdated info on pointer scanning) and this topic for info on segregating a particular address from other addresses an instruction accesses.

rfb wrote:
Every search I made gave me something like "[ecx], eax", which never helped me, because searching for pointers based on these values always returned no results

I'm guessing you missed the word "probably" in the text "The value of the pointer needed to find this address is probably XXXXXXXX". That value CE gives you is a guess. It is not deterministic by any stretch of the imagination. For example, assuming a value's address is some offset inside another structure, the asm before an instruction that accesses that address could pre-load the base of the structure plus the offset into a register, like this:
Code:
lea ecx,[esi+24]
...
mov [ecx],eax

Of course, my previous rant of how emulated games are different from pre-compiled games still stands: you wouldn't be able to determine a good pointer from that instruction regardless of how you look at it.

rfb wrote:
Yay, this thing again! Thank god the CE's Tutorial prepared me for it, right? Errr..., no.
...
[your request]

If the CE tutorial explained every possible scenario anyone could run into when trying to do anything with any game, it would take years to complete. Expect to do some work and research yourself.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
rfb
Newbie cheater
Reputation: 0

Joined: 01 Apr 2016
Posts: 15

PostPosted: Fri May 13, 2016 9:55 pm    Post subject: Reply with quote

ParkourPenguin wrote:
rfb wrote:
How can I find pointers to games in pcsx2?
...
Does anyone have a clue on how to help me? Just tell me something!
Give up.
If you did research into what pointers are and emulators are, you should realize finding a static pointer to some value in a software being emulated is completely different from finding one in an already compiled binary. The pcsx2 emulator could be categorized as a virtual machine- a piece of software that emulates a computer system. As such, that asm you're looking at isn't a part of the game, but of the emulator itself. AKA, those instructions you see won't lead you to any pointers. You'd need to reverse engineer both the emulator and the game to find a good reference to your value. Even then, you'd still need a static reference from your computer to the game in the emulator.

Try the pointer scanner if you want a better hope at finding something. Make sure to use several pointer maps (restart your computer each time) and use a high max level and max offset. Just note that it's a possibility there just aren't any viable static pointers you could use. Take flash games for example. You could try a L20 pointer scan with a max offset of 1MB and still not find any reliable static pointers. Those that show up the first time wouldn't the next time you restart flash. Even if you did miraculously find something, I highly doubt it would work for anyone else, and the smallest update to flash would very likely cause it to break.

If that doesn't work out, try hooking that instruction and looking through the addresses around the value you want for something that you could use to discern that from the other addresses that instruction accesses (i.e. a string or a pointer to some other structure). See this topic for info on hooking an instruction (the "injection copies" section; also has outdated info on pointer scanning) and this topic for info on segregating a particular address from other addresses an instruction accesses.

rfb wrote:
Every search I made gave me something like "[ecx], eax", which never helped me, because searching for pointers based on these values always returned no results

I'm guessing you missed the word "probably" in the text "The value of the pointer needed to find this address is probably XXXXXXXX". That value CE gives you is a guess. It is not deterministic by any stretch of the imagination. For example, assuming a value's address is some offset inside another structure, the asm before an instruction that accesses that address could pre-load the base of the structure plus the offset into a register, like this:
Code:
lea ecx,[esi+24]
...
mov [ecx],eax

Of course, my previous rant of how emulated games are different from pre-compiled games still stands: you wouldn't be able to determine a good pointer from that instruction regardless of how you look at it.


Thank you so much, man!

Don't mind me and please, do forgive what comes out in the heat of the moment. As I said in the beginning of the post, I was VERY frustrated, and frustrated people are not always rational. Embarassed

Just the fact that someone showed mercy on my plea is already refreshing. I will look into the posts you gave me and try to work something out from there. I'll post the results here later. Also, do you think the pcsx2 Debugger could help me at this point? I remember Dark Byte went through something similar, as posted by him at a topic entitled "Help me in hacking Final Fantasy X HP" cheatengine.org/forum/viewtopic.php?t=556747&postdays=0&postorder=asc&start=0&sid=26bf84884bc816cdc35a400a4b473736 (apparently, I can't post URLs yet...), but unfortunately, I couldn't replicate what he did there on my game, I tried, but I failed miserably (maybe I was missing some important info to understand what he said).

Anyway, I'll see what I can do. Thank you, man! Very Happy

ParkourPenguin wrote:

rfb wrote:
Yay, this thing again! Thank god the CE's Tutorial prepared me for it, right? Errr..., no.
...
[your request]

If the CE tutorial explained every possible scenario anyone could run into when trying to do anything with any game, it would take years to complete. Expect to do some work and research yourself.


Now, about the CE's Tutorial, I don't expect every scenario to be included in it, but more Tools on solving problems would be welcome. Like tricks and paths you could follow and some well known issues could be added. It would help a newbie to know that we are going to face problems, but they're not helpless nor hopeless.


Last edited by rfb on Tue May 24, 2016 1:21 pm; edited 1 time in total
Back to top
View user's profile Send private message
rfb
Newbie cheater
Reputation: 0

Joined: 01 Apr 2016
Posts: 15

PostPosted: Tue May 24, 2016 1:19 pm    Post subject: Reply with quote

Update 05/14/2016 02:33 AM (Brazil):

Man (or Woman, I don't know your gender, really)!!!!!!!!!!!!!!!!!!!!!!!!!!

You seriously saved my life!!!!!

The AOB to Data from Rydian's Tutorial really helped me a lot. Instead of a pointer, I just needed a scripted data range, since the addresses I need are always at the same distance: (from Armor) Armor -> [Armor], Special -> [Armor+8], Thruster [Armor+18]. So once I've found [Armor], I just need to add the offsets. Now it's basically working like a pointer, since my addresses are static, as long as I deactivate and reactivate my script at every battle.

It's probably not the ideal solution, but it will suffice for now, until I can find another one. I would like to try other things and place them here as I find them. I still have to look at the other tutorial you sent me.

Seriously, you don't know how much you helped me!!

P.S.: If you find anything relating to pointers or dynamic addresses, could you please send it to me? my email is roodneyfb at Gmail servers (Jeez, I'm so limited by this forum...)

Update 05/24/2016 03:29 PM (Brazil):

Thanks to Dark Byte's instructions, I was finally able to find a pointer in PCSX2. I followed the instructions he gave at the "Help me in hacking Final Fantasy X HP" topic (I still can't post URLs).

The game was "Tales of the Abyss". I was able to find everything that goes on in a battle using the pointers and lock it to my heart's content.
Back to top
View user's profile Send private message
rfb
Newbie cheater
Reputation: 0

Joined: 01 Apr 2016
Posts: 15

PostPosted: Tue Mar 13, 2018 7:30 am    Post subject: Reply with quote

rfb wrote:
Update 05/14/2016 02:33 AM (Brazil):

Man (or Woman, I don't know your gender, really)!!!!!!!!!!!!!!!!!!!!!!!!!!

You seriously saved my life!!!!!

The AOB to Data from Rydian's Tutorial really helped me a lot. Instead of a pointer, I just needed a scripted data range, since the addresses I need are always at the same distance: (from Armor) Armor -> [Armor], Special -> [Armor+8], Thruster [Armor+18]. So once I've found [Armor], I just need to add the offsets. Now it's basically working like a pointer, since my addresses are static, as long as I deactivate and reactivate my script at every battle.

It's probably not the ideal solution, but it will suffice for now, until I can find another one. I would like to try other things and place them here as I find them. I still have to look at the other tutorial you sent me.

Seriously, you don't know how much you helped me!!

P.S.: If you find anything relating to pointers or dynamic addresses, could you please send it to me? my email is roodneyfb at Gmail servers (Jeez, I'm so limited by this forum...)

Update 05/24/2016 03:29 PM (Brazil):

Thanks to Dark Byte's instructions, I was finally able to find a pointer in PCSX2. I followed the instructions he gave at the "Help me in hacking Final Fantasy X HP" topic (I still can't post URLs).

The game was "Tales of the Abyss". I was able to find everything that goes on in a battle using the pointers and lock it to my heart's content.


Just an update. After a couple years, I decided to try that FFX topic thing on the Dynasty Warriors Gundam 2 game. I was able to use the AOB by Rydian to find the pointer as specified in the FFX topic response by Dark Byte. It also worked for finding a bunch of values in Shadow of Rome using the same method. I believe that's a good way of finding pointers for any PS2 games emulated in PCSX2, I wouldn't say it's infallible or something, but it works.
Anyway, thanks again, Penguin, for the answer and for your patience with my noobness.

Also, I believe this topic is way overdue to be closed by now.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites