Cheat Engine

Masonjar13 · How do I cheat? Reputation: 0 Joined: 26 Feb 2016 Posts: 9

I've been looking myself for quite a bit, but I can't seem to find it. I'm looking for (the pointer of) a variable in memory that will be 0 if you are NOT in a match, and 1 (or any positive number) while in a match. When I say "in a match," I mean when the map is rendered and you can move your character. The logic may be reversed as well (1/positive while not in a match, 0 while in a match), it just has to be distinguishable and constant, across solo and multiplayer. If there isn't a constant between the two modes, two variables will work as well.

Again, this is not a cheat or to be used for cheating. I'll be using it directly with ReadProcessMemory() from the Windows API.

++METHOS

Masonjar13 · How do I cheat? Reputation: 0 Joined: 26 Feb 2016 Posts: 9

Not quite.. I figured most would think my reasoning is kind of stupid. I'm basically going to replace the music, by muting the game volume and unpausing VLC. When it goes into a match, it'll unmute the game volume, and pause VLC. So, no, I'm not using it for an in-game advantage.

++METHOS · Posted: Fri Feb 26, 2016 7:13 am Post subject:

In that case, finding a value to work with should be easy. Are you not able to find anything viable?

Masonjar13 · How do I cheat? Reputation: 0 Joined: 26 Feb 2016 Posts: 9

I thought I found one (from 0 to 1), but it it still flashed to 0 while in a match, making it non-viable. Besides that, the only way I know how to get a pointer is through debugging, but attaching a debugger will immediately close the game. As a note, the game currently uses FairFight anti-cheat software.

++METHOS · Posted: Fri Feb 26, 2016 9:55 am Post subject:

I wouldn't limit yourself to simple booleans.
Regarding the debugger, have you tried using the VEH debugger? I wrote an ammo script for this game a while back, as a test, so I know it's possible to attach. You'll still have to circumvent the anti-cheat, though.

Masonjar13 · How do I cheat? Reputation: 0 Joined: 26 Feb 2016 Posts: 9

I wasn't at first, but thought that I should probably try boolean to see if I could or not. I didn't get very far with 0 and positive, too many results, CE crashed. Even with boolean, I have to get in and search for 1 first, then 0.
And no, I haven't tried VEH, I'll try that in a while, when I can.
I did find the 'isLoaded' variable, but it changes to 1 far before the match actually starts.

++METHOS · Posted: Fri Feb 26, 2016 10:17 am Post subject:

If 'isLoaded' works, you can try setting a timer/sleep, if it's consistent.

Masonjar13 · How do I cheat? Reputation: 0 Joined: 26 Feb 2016 Posts: 9

Found a perfect variable that works reliably (0 out of match, 1 in match), but the actual address changes (the base address). How can I accommodate for that? The address is [RainbowSix.exe+4BCED10]

ulysse31 · Posted: Tue Mar 01, 2016 5:02 am Post subject:

++METHOS · Posted: Tue Mar 01, 2016 9:46 am Post subject:

Masonjar13 · How do I cheat? Reputation: 0 Joined: 26 Feb 2016 Posts: 9

That was really obvious. I've made pointer tables before, but being a static address, I thought I had to do something else. I've found the pointer: ["RainbowSix.exe"+04BBCA10]+90

Now.. How can I get that base exe address? It changes every reset.. kind of. When making a pointer to just the process, it gives me back 300905A4D consistently, but this isn't the correct address. This is also mathematically incorrect, as "rainbowsix.exe"+04BBCA10=1449E3B60 this session, where 300905A4D+04BBCA10=3054C245D. I'm clearly doing something wrong here, please remedy my stupid.

++METHOS · Posted: Tue Mar 01, 2016 1:49 pm Post subject:

It's a pointer. It's showing you what it's pointing to. It's dynamically allocated, otherwise, it would be static and a pointer would not be needed.

Daijobu · Posted: Wed Mar 02, 2016 1:17 pm Post subject:

I'll be the obvious party pooper for once (hah, who am I kidding?). ReadProcessMemory() will very likely trigger anti-cheat.

++METHOS · Posted: Wed Mar 02, 2016 4:04 pm Post subject:

Injection can be used on this target with SE plugin. Very Happy