| View previous topic :: View next topic |
| Author |
Message |
Rifters How do I cheat?
Reputation: 0
Joined: 19 Apr 2007 Posts: 7
|
Posted: Mon Apr 23, 2007 2:18 pm Post subject: More Fate Digging |
|
|
Okay I would have kept this with my initial thread but due to noone replying for a week and I can't double post and editing doesn't show up as a new reply so older ppl that have looked wouldn't check again I decided make new thread with what I been doing. Basically wanting to make cheat table that works for Fate. Starting to think due to DMA and codeshifting or by design I might never figure it out hence why I am asking for help even just thoughts if not answers sometimes thoughts can give push in right direction. well here is what I been working on and what I was originally going post in my other thread.
okay digging around little more in fate trying find a pattern I'm starting to lose my mind lol the address changes each time looking at address in memory viewer the base address listed changes but the addresses found are not in module fate.exe so guessing dynamic memory. well okay but finding what writes to that address finds me address in the fate module but that changes too! But doesn't change often getting info 20 different times writing it down I discovered the code that write to the dynamic gold address is one or the other still can't seem to find any sort of pattern I guess I'll list a few of my found addresses there base address then what writes to that address maybe someone else see something i'm not seeing or get an idea of what I can try next.
| Code: | ADDRESS ALLOCATEDBASE
0471BE40 04580000
FATE.EXE+12F9BF <- ADDRESS THAT WRITES
0461BA00 044A0000
FATE.EXE+15717A <- ADDRESS THAT WRITES
047BBE40 04620000
FATE.EXE+15717A <- ADDRESS THAT WRITES
0463BE40 044A0000
FATE.EXE+12F9BF <- ADDRESS THAT WRITES
0473BA00 045C0000
FATE.EXE+12F9BF <- ADDRESS THAT WRITES
046B1CA8 04530000
FATE.EXE+15717A <- ADDRESS THAT WRITES |
Guess should also say that sometimes the address would repeat itself but not often
|
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6301
|
Posted: Tue Apr 24, 2007 6:16 am Post subject: |
|
|
Show a screen shot of the whole memory view from CE.
Be sure the memory view is on the same address top and bottom windows as well.
I messed with this game a while back, But didnt bother making a trainer just cheated at it.
|
|
| Back to top |
|
 |
Rifters How do I cheat?
Reputation: 0
Joined: 19 Apr 2007 Posts: 7
|
Posted: Tue Apr 24, 2007 11:22 am Post subject: |
|
|
okay while i'm not really making a trainer just a way to save the cheats so i don't have to search them up each and every time and which screenie do you want the actual gold code or the code that writes too... the actual gold code is found in going assume allocated memory since no module name when i got modulename shown and the writes address is found in the fate module as can see from listing my results couple times
guess should also say this latest version of fate and it can only be started with the wildtangent loader starting fate directly is a no go anymore
|
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6301
|
Posted: Tue Apr 24, 2007 1:08 pm Post subject: |
|
|
Doesnt matter, just do gold i guess. "what writes to it"
All your wanting is to make a table correct.
You can do it almost the same way as if you was going to make a trainer and add it to the cheat table.
Be sure you are connecting to the game process also and not the loader as well.
|
|
| Back to top |
|
 |
Rifters How do I cheat?
Reputation: 0
Joined: 19 Apr 2007 Posts: 7
|
Posted: Tue Apr 24, 2007 2:41 pm Post subject: |
|
|
okay this is memory view of the writing address
and this is just the gold value view
|
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6301
|
Posted: Tue Apr 24, 2007 2:51 pm Post subject: |
|
|
FATE.EXE+12F9BF
FATE.EXE+15717A
I see it just shifting from this address to the other on these 2+base address.
I guess you could just write the script to alter both at the same time, providing it doesnt crash the game if you alter the one not being used at the time.
Try that and see what happens
|
|
| Back to top |
|
 |
Rifters How do I cheat?
Reputation: 0
Joined: 19 Apr 2007 Posts: 7
|
Posted: Tue Apr 24, 2007 8:41 pm Post subject: |
|
|
| I think i tried that replace with nothing for both those addresses and still really couldn't find that unless I'm adding to advanced codelist wrong which is probally the case found a value then the write to that address I replaced with nothing but for initial value do I keep it? in my list because next time its not being used again and the same mov [ ecx +08 ] , edx is in both addresses for each occurence whether the valid one is the FATE.EXE+12F9BF or the other one both carries the same function
|
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6301
|
Posted: Tue Apr 24, 2007 9:20 pm Post subject: |
|
|
They both carry the same function, Thats good.
You can alter each one, and it should work.
If one is not being used by anything else. You can alter it as well as the one that is being used at that time.
Fate.exe+12F9BF
Fate.exe+15717A
mov [ecx+08],edx
Something like this should work for this address. Fate.exe+12F9BF
| Code: |
[ENABLE]
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
Fate.exe+12F9BF:
jmp newmem
returnhere:
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov edx,3e7 // Move 999 Gold to edx
originalcode:
mov [ecx+08],edx
exit:
jmp returnhere
[DISABLE]
dealloc(newmem)
Fate.exe+12F9BF
mov [ecx+08],edx
|
|
|
| Back to top |
|
 |
|