Cheat Engine

[frjd]

Please explain this - The code put the "hero" in GOD mode, how/why does it work?


This (original) code:
005C536C D919 FSTP DWORD PTR DS:[ECX]
005C536E 8B82A0060000 MOV EAX,DWORD PTR DS:[EDX+6A0]

Is replaced with:

005C536C E8DF Call
005C536E B7A4FF909090 10B50 nop nop nop

- So instead of putting the value at ptr EDX+6A0 in EAX we jump to the cave...


Cave written at 10B50:

10B50 D9 19 fstp [ecx] Store real
C7 01 00 90 9C C5 mov [ecx], c59c9000
8B 82 A0 06 00 00 mov eax, [edx+000006a0]
C3 ret
90 nop

Why do we need the fstp? (assign memory for a real?)
Then c59c9000 is put at ECX?
Value stored at edx+6a0 is put in EAX?
(it this not what we just removed?)

So only modification is as I can see that c59c9000 is put at ECX?


005C5374 85C0 TEST EAX,EAX
005C5376 75 35 JNZ SHORT godfathe.005C53AD
005C5378 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14]
005C537C D980 84060000 FLD DWORD PTR DS:[EAX+684]
005C5382 8D56 08 LEA EDX,DWORD PTR DS:[ESI+8]
005C5385 D80A FMUL DWORD PTR DS:[EDX]
005C5387 D95C24 14 FSTP DWORD PTR SS:[ESP+14]
005C538B D901 FLD DWORD PTR DS:[ECX]
005C538D D81A FCOMP DWORD PTR DS:[EDX]
005C538F DFE0 FSTSW AX
005C5391 F6C4 41 TEST AH,41
005C5394 74 13 JE SHORT godfathe.005C53A9
005C5396 D901 FLD DWORD PTR DS:[ECX]
005C5398 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14]
005C539C D85C24 14 FCOMP DWORD PTR SS:[ESP+14]
005C53A0 DFE0 FSTSW AX
005C53A2 F6 C4 05 TEST AH,05
005C53A5 7B 02 JNP 005C53A9
005C53A7 8B D1 MOV EDX,ECX
005C53A9 8B 12 MOV EDX,[EDX]
005C53AB 89 11 MOV [ECX],EDX
005C53AD 8D 43 04 LEA EAX,[EBX+04]
005C53B0 8D 7E 58 LEA EDI,[ESI+58]
005C53B3 3B F8 CMP EDI,EAX
005C53B5 74 24 JE 005C53DB
005C53B7 8B 18 MOV EBX,[EAX]
005C53B9 8B 0F MOV ECX,[EDI]
005C53BB 3B CB CMP ECX,EBX
005C53BD 74 19 JE 005C53D8
005C53BF 85 C9 TEST ECX,ECX
005C53C1 74 06 JE 005C53C9

And another cave:

push ebx
lea ebx,[eax+000010f8]
mov [00010ad0],ebx
cmp byte ptr [00400450],01
jne 00400426
mov [eax+000010f8],4545da1e
fld [eax+000010f8]
pop ebx
ret
nop

[dezuzi]

could you be more specific at what that code is supposed to do, and you didnt write it?
its extremely messy you might want to clean it up before asking what it does

[frjd]

[dezuzi]

push ebx // pushes ebx on the stack
lea ebx,[eax+000010f8] // loads effective address into ebx
mov [00010ad0],ebx // moves ebx at location 00010ad0 of the memory
cmp byte ptr [00400450],01 // compares data stored at 00400450 with 1(true) probably done because you can disable and enable the cheat ?
// at adr 00400450 the trainer make a one byte datacave with a 01 hex.
// guess he want this to evaluate true always?
// why not just jump always?

jne 00400426 // (j)ump (n)ot (e)qual to 00400426 otherwise
mov [eax+000010f8],4545da1e // mov 4545da1e(most likely a float) onto the location eax+000010f8. the rest isnt important
fld [eax+000010f8]
pop ebx
ret
nop


anything else i can help with?

[frjd]

Thank.

[dezuzi]

[frjd]

[dezuzi]

but why dont you make your own godmode?

[frjd]

[dezuzi]

most of the time cheat engine will be able to find what writes.reads to/from a location before the application crashes, ive never encountered this "e5.0001 protection" myself.

when you were looking for that float value a certain id will be loaded in one of the registers, this will be identical to the "character", find your character's ID and make a cmp(compare) for it

caves are just parts of allocated memory by the process itself that isnt being used, you could compare it to a storage place that isnt being used completely

if theres anything else i can help you with feel free to ask