Cheat Engine

[SaturnineSpy]

Hey peeps!

So glad I've started hacking with CE, I've always wanted to hack into my favourite childhood game and expand and make it more replayable!

I'm still a beginner but have managed to track down a few cool things like health and money etc however I'm stuck on raising the max cap of money.

So I've got the address which stores the money and I tracked which writes the address here

------------------------------------------
30114616:
3011460E - 01 C1 - add ecx,eax
30114610 - 0F88 EA0ADCD2 - js pcsx2.exe+2BD5100
30114616 - 66 89 11 - mov [ecx],dx <<
30114619 - 8B 0D 10A04901 - mov ecx,[pcsx2.exe+119A010]
3011461F - 81 C1 06010000 - add ecx,00000106

EAX=20000000
EBX=30114619
ECX=209F06D6
EDX=000026DD
ESI=0022BB5C
EDI=00000000
EBP=0E34FBB4
ESP=0E34FB84
EIP=30114619


First seen:16:39:19
Last seen:16:40:40
----------------------------------------

So the max cap of money in the base game is 9999, I can modify the value to say 15000 fine but when I buy something, it gets shifted back to 9999 instantly.

So in the addresses above, dx (which holds the calculated value after the transaction) moves into [ecx]. I was just wondering where I go from here in tracking down that max cap? I like to play the game legit so no infinite money I want to earn it all but want to earn a lot more than 9999

Also if I raise my money past 32000 then it glitches to a negative number so it's a signed 16bit integer right? any way to increase it to 32bit?

Thanks so much for your time and help!!

[ParkourPenguin]

Typically, I'd debug the code near what accesses the address and see where it got 9999 from. This isn't really a good option for an emulator, however. Even ones that JIT compile code aren't that great to debug.
It would be great if the emulator had a feature to debug and disassemble the emulated architecture.

Maybe you can search for the value and find it. Given it's a constant, it might be stored as a value in memory or it might be encoded as an immediate in an instruction (executable & unaligned memory).

There's no practical way of changing a 16-bit integer to a 32-bit integer without doing so in the source code.

[SaturnineSpy]

[ParkourPenguin]

My thoughts haven't changed much. Debugging an emulated architecture from the native architecture is annoying at best.
You'd need to scroll up to see what writes to that global. It could also be in a caller.

It's possible to set a break-on-write breakpoint at that address and only stop when 9999 was written to it; however, that's probably going to kill performance.

[SaturnineSpy]

[ParkourPenguin]

Good job finding that.

If changing `jb` (conditional jump) to `jmp` (unconditional jump) works, you can use the Auto Assembler to make a script that changes it for you. Memory Viewer -> Tools -> Auto Assemble, then Template -> AOB Injection. Delete some stuff you don't need, and you'll end up with something that looks like this:

[SaturnineSpy]

Hey mate! thanks so much for the tips! I didn't fully understand aobscans or the script you gave so I spent the last few days researching and it's finally making sense! Here's the script I came up with

[ParkourPenguin]