Cheat Engine

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

I made a lua script that breaks upon a certain value being written to a certain memory address.
Here is the script

Dark Byte · Posted: Thu Aug 08, 2019 6:35 am Post subject:

Try this:

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

I tried both of them and neither of them broke nor printed any values.

Dark Byte · Posted: Thu Aug 08, 2019 7:13 am Post subject:

Which debugger interface do you use ? Try the windows interface

And are you using ce 6.7 or later ?

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

I'm not sure what a debugger interface is and I'm using ce 6.8.3 I used the lua function debug_getCurrentDebuggerInterface to determine my interface and it was 1 which according to the wiki is windows.

Dark Byte · Posted: Thu Aug 08, 2019 7:58 am Post subject:

then i'm not sure. (besides it being the wrong process, kernel memory, or emulator memory)

When you use "find what writes to this address" it does find them all ?

the address is correct?

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

Nothing appears when I use find what writes to this address.

I did get it to crash once. I set a breakpoint on the address 20801000 after pressing the execute script button it crashed upon breaking.

Dark Byte · Posted: Thu Aug 08, 2019 8:26 am Post subject:

ok, what are you trying to do?

What is the process? An emulator? Physical memory ?
Is it a kernel controlled address like the timer ?

Is cheat engine even attached to the process?

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

The process is Jet Set Radio PC port.
I am trying to figure out how the game reads its character model files. It copies what I think is characters model file into memory. At the beginning of every file there are 4 bytes 504C4159 in ascii they are PLAY.

To figure out when process writes the bytes into memory I used the script in my first post. It always writes to the same address 0x20801000. So the script checks that address for the first byte in the file 50 which is P. If it finds it supposed to break and alert me, if it doesn't then it continues.

Cheat engine is attached to process and I do not know what kernel controlled address is.

Dark Byte · Posted: Thu Aug 08, 2019 9:06 am Post subject:

It likely doesn't write the bytes but maps it into memory instead

look into mapviewofsection and mapviewoffile and try hooking there

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

I can't find the address for mapviewofsection and mapviewoffile isn't listed the referenced functions list nor does is it break when a breakpoint is placed on it. Also I attempted to use break on access instead of break on write and it did break. Both via the script and manually in the memory editor.

Dark Byte · Posted: Thu Aug 08, 2019 10:52 am Post subject:

also check readfile as that read happens in kernelmode it won't be caughtbusing usermode bp's

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

placing bps on readfile works it breaks, breaks and traces, and finds out what address the instruction writes to, but the script doesnt fire, even with pressing the execute button.

Dark Byte · Posted: Thu Aug 08, 2019 1:10 pm Post subject:

there is no usermode code that writes there. Maybe not even kernelmode code if it uses DMA transfer
so breakpoints won't trigger

m_miro · Newbie cheater Reputation: 0 Joined: 31 Jul 2019 Posts: 19

I'm not sure what you're saying, breakpoint triggered at ReadFile. Are you saying the break on write trigger wont break?

I don't know why, but it is working now. I placed a breakpoint on 0x2080100 of size 4 bytes and one on 0x20801008 which is another consistently loaded character 'l'. When it loaded in the character data it broke and said "ding ding ding". I am confused.