Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Help on hacking Assassin's Creed Brotherhood
Goto page 1, 2  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Tue Aug 09, 2011 11:31 am    Post subject: Help on hacking Assassin's Creed Brotherhood Reply with quote

hi there, i normally make codes for the games myself, but there's this one game that has a really tricky address, the knives address in the game mentioned above. I found the address of the knives value, 100% authentic, but the problem is, when i tried to increase the value, for example, the original amount of knives i have is 5, to an amount of 10, after i used finish the 5 i initially had, when i try to use till the 6th, it will crash the game immediately. Anyone has any ideas how to solve this problem? Help appreciated.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Wed Aug 10, 2011 2:51 am    Post subject: Reply with quote

You can read here http://forum.cheatengine.org/viewtopic.php?p=5216239#5216239. That was a long battle.
First infinite knives codes were simple. But buggy (disappearing sword, etc). Then I fixed this with "mov al,5 ". Still, there were bugs. Then I made huge script, it was slow, but working.


Then I made this (cons? no more Very Happy ):
Code:
[ENABLE]
alloc(MyScript,128)
label(MyScript_part2)
label(returnhere1)
label(returnhere2)
label(exit1)
label(exit2)
aobscan(RetCheck, 85 C0 74 15 8B 10 8B C8 8B 42 38 56)                          //searching knives retcheck
aobscan(code1   , 0F B7 51 0A xx xx xx xx xx xx xx xx xx 8B C8 8D 14 91 56)     //searching knives address

aobscan(code2   ,74 0D xx xx xx xx xx xx 48 FF D0 5D C2 04 00 33 C0 5D C2 04 00)//Knives quantity hack
label(KniveAddress)

MyScript:
cmp [ebp+04],RetCheck
jne short exit1
test ebx,ebx
je short exit1
mov eax,[ecx+04]
mov eax,[eax+20]
mov [KniveAddress],eax
exit1:
mov eax,[ecx+04]        //original
and edx,00003FFF        //original
jmp returnhere1

MyScript_part2:
mov edx,[eax]           //original
mov ecx,eax             //original
mov eax,[edx+48]        //original
cmp ecx,[KniveAddress]  //dealing with knives ??
jne short exit2
//"call eax" replacement
mov eax,5
pop ebp
ret 004
exit2:
jmp returnhere2

KniveAddress:
dd 00

code1+4://searching knives address
jmp MyScript
db 90 90 90 90
returnhere1:

code2+2://Knives quantity hack
jmp MyScript_part2
nop
db 48
returnhere2:

[DISABLE]
dealloc(MyScript)

aobscan(code1, 0F B7 51 0A xx xx xx xx xx xx xx xx xx 8B C8 8D 14 91 56)
code1+4:
mov eax,[ecx+04]
and edx,00003FFF

aobscan(code2, 74 0D xx xx xx xx xx xx 48 FF D0 5D C2 04 00 33 C0 5D C2 04 00)
code2+2:
mov edx,[eax]
mov ecx,eax
mov eax,[edx+48]

_________________
Back to top
View user's profile Send private message MSN Messenger
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Aug 11, 2011 1:54 am    Post subject: Reply with quote

does your script work against the check that was used in the game? it's sort of like comparing the knives value against some other address, if the game calculates that your knives value has already reached zero, but you changed the value via cheat engine, it will immediately crash when u try to use the extra knives that you have just given yourself...
Back to top
View user's profile Send private message
SwaggaJackin'
Master Cheater
Reputation: 2

Joined: 06 Nov 2009
Posts: 312

PostPosted: Thu Aug 11, 2011 2:30 am    Post subject: Reply with quote

lalala1990 wrote:
does your script work against the check that was used in the game? it's sort of like comparing the knives value against some other address, if the game calculates that your knives value has already reached zero, but you changed the value via cheat engine, it will immediately crash when u try to use the extra knives that you have just given yourself...


Does it use windows live? You need to bypass the CRC check then.
Back to top
View user's profile Send private message
Geri
Moderator
Reputation: 112

Joined: 05 Feb 2010
Posts: 5627

PostPosted: Thu Aug 11, 2011 4:04 am    Post subject: Reply with quote

This game is not using live.
_________________
My trainers can be found here: http://www.szemelyesintegracio.hu/cheats

If you are interested in any of my crappy articles/tutorials about CE and game hacking, you can find them here:
http://www.szemelyesintegracio.hu/cheats/41-game-hacking-articles

Don't request cheats or updates.
Back to top
View user's profile Send private message
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Thu Aug 11, 2011 5:03 am    Post subject: Reply with quote

i realised something, the address that i hooked to is the opcode writing the address, while there's another opcode that is accessing the address, and the crash is caused by the accessing address. now if i use the accessing address to change the value instead, it is all good... Very Happy thanks for all your help!
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Sun Aug 14, 2011 4:41 am    Post subject: Reply with quote

lalala1990 wrote:
now if i use the accessing address to change the value instead, it is all good... Very Happy thanks for all your help!


Ok. Try to buy items, dye clothing, etc.

_________________
Back to top
View user's profile Send private message MSN Messenger
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Sun Aug 14, 2011 9:57 pm    Post subject: Reply with quote

i already tried that, it works perfectly Very Happy
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Mon Aug 15, 2011 9:15 am    Post subject: Reply with quote

Could you paste AA script?
_________________
Back to top
View user's profile Send private message MSN Messenger
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Tue Aug 16, 2011 1:46 am    Post subject: Reply with quote

i overwrote it with another game's cheat table -_- but nevermind i will try to reproduce it. but first of all, can you tell me how to make it non-full screen? by using 3d ripper, it crashes so often.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Tue Aug 16, 2011 3:24 am    Post subject: Reply with quote

www.imagebam.com/image/42a917125877560
_________________
Back to top
View user's profile Send private message MSN Messenger
low_density
Expert Cheater
Reputation: 1

Joined: 08 Aug 2009
Posts: 156

PostPosted: Tue Aug 16, 2011 4:24 am    Post subject: Reply with quote

hmm that method crashes alot for me... when i try to use toggle breakpoint, after it breaks and i got the value i want, i removed the breakpoint and closed the viewer, when i go back to the game, either the camera gets stuck, or the whole game gets stuck.

EDIT:
ok after a lot of trouble i managed to come up with a script that's almost bugless... do help me test if there's any bugs with it Very Happy

Code:

[ENABLE]
alloc(newmem,256)
label(returnAccess)
label(originalAccess)
label(infKnives)
label(debugKnives1)
registersymbol(infKnives)
registersymbol(debugKnives1)

"ACBSP.exe"+7EDED0:
jmp newmem
db 90 90 90 90
returnAccess:

newmem:
movzx eax,word ptr [ecx+1A]
cmp ecx,esi
je originalAccess
cmp word ptr [esp],6859
jne originalAccess
mov [debugKnives1],ecx
cmp [infKnives],1
jne originalAccess
movzx eax,byte ptr [ecx+02]

originalAccess:
and eax,00003FFF
jmp returnAccess

debugKnives1:
dd 0

infKnives:
dd 1

[DISABLE]
"ACBSP.exe"+7EDED0:
movzx eax,word ptr [ecx+1A]
and eax,00003FFF

unregistersymbol(debugKnives1)
unregistersymbol(infKnives)

dealloc(newmem)


this script ignores your maximum allowed knives and automatically sets it to 19.
Back to top
View user's profile Send private message
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Tue Aug 16, 2011 8:53 am    Post subject: Reply with quote

You are sure about this thing?
Code:
cmp word ptr [esp],6859


ESP - extended stack pointer register.



And this:
Code:
movzx eax,byte ptr [ecx+02]

Why?

_________________
Back to top
View user's profile Send private message MSN Messenger
Dark Byte
Site Admin
Reputation: 473

Joined: 09 May 2003
Posts: 25909
Location: The netherlands

PostPosted: Tue Aug 16, 2011 9:06 am    Post subject: Reply with quote

esp thing:
if the hook is done at a spot with no stackframe setup yet (so no pushes) this routine can be used to find out if the function was called from a specific address (or else if it contains the pushed address of a function table it's useful as well)
And word would be used to deal with the exe/dll address randomization

_________________
Tools give you results. Knowledge gives you control.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Tue Aug 16, 2011 9:48 am    Post subject: Reply with quote

Nevermind. He has different AC:B version. For me, it would be
"cmp word ptr [esp],6639"

"cmp ecx,esi and je" isn't necessary (no difference if you use this or not)

But this "movzx eax,byte ptr [ecx+02]" sets 76 knives for me, for him 19. This would be better: "xor eax,eax; mov al,5" (or "mov eax,5").


Code:
newmem:
movzx eax,word ptr [ecx+1A]
cmp word ptr [esp],6859
jne originalAccess

mov [debugKnives1],ecx
cmp [infKnives],1
jne originalAccess
////movzx eax,word ptr [ecx+1A]     // debug purpose (try "find out what addresses this instruction accesses")
mov eax,5

originalAccess:
and eax,00003FFF
jmp returnAccess

_________________
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites