 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
SunBeam
I post too much
 Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
 Posted: Fri Oct 28, 2005 6:42 pm Post subject: |
 |
|
Man, why aren't you on MSN ? I need to learn structures from scratch. You said ' look in the struct ' What struct ? I dun even know what to look for...A concise tutorial would do the trick...
I am talking ASM level, not C++...Implementing caving with structures at asm level...
|
|
| Back to top |
|
 |
Zhoul
Master Cheater
![]() Reputation: 1
Joined: 19 Sep 2005
Posts: 394
|
| Posted: Sat Oct 29, 2005 4:33 am Post subject: |
|
|
| SunBeam wrote: | That reminds me of an even greater problem. STRUCTURES. Is there any way to find let's say a pointer that tells me a direction, an address, and starting from that pointer with adding a certain offset to get to the correct module instruction, like in this case ?
Or better and simple put : there are games that use same routines for player/enemy healths. I found no differences in the code instructions being used [yeah, I managed to play as the enemy in the same game] and none differs...
My question : how does the game differentiate player/enemy if all instructions contain same registers all the time... ?
EX : WarHammer 4k. Building the same unit as player/enemy. If debugger used, i get some codes [being the player]. I find the address for the building bar for the enemy using breakpoints. Looked at what accesses both addresses [mine/enemy's] and found no differences at all [not a single register different - except the involved one containing player/enemy pointers]. Problem : pointers are DMA. If i start the game I won't be able to work it. Pointer changes...How do I retrieve it always and use it in the code-injection ???? |
1. There is *ALWAYS* a base pointer, even if further pointers are DMA, else the game wouldn't be able to find the values.
2. Any pointer past 1 level is almost always in dynamic memory
3. Just because the one op code that changes all things is not any different, doesnt mean that the register(s) were derived the same exact way.
In the black & white 2 trainer/table ive created, I too had an issue with finding certain elements that would differentiate between the CPU's creature and my own creature.
It's very hard to explain how I ended up with the current pointers/values I have now, without 'walking you through it' - but I'll briefly describe it...
1. Find the value you'd like to change
2. Find out what "Accesses" the value.. This gave me a much greater understanding of how my own creatures values were derived, VS the CPU's.
3. I then 'back tracked' , using the debugger features "Toggle break point" and "Step".
4. Usually, you won't find a difference in the current 'code block', and have to step until it returns, *then* scroll up , to before it jumped to the previous code block, and see if there are any differences there.
In example, if mov [edx+00000048], 00000001 was the code that changed the value, you want to find out how EDX became EDX. You'll eventually find things like jumps, which help define which value it mod's.
Another method is:
1. Find the value you want to mess with
2. Find out what writes to that value
3. Find out what *that* code writes to (in the instance of health, and say 20 units, drop about 5 of those into your CE list)
4. Find out what "accesses" your value
5. Find out what "accesses" the other values
6. Usually, in the case of player VS CPU - there will be at least 1 op code that accesses yours, or theirs, but not both.
7. If this is the case, you can use the method above... OR
8. Make a code cave/jump that writes *your* address to an allocated piece of memory, then use *that* as a pointer.
9. If you dont want to allocate memory, find a place to 'stash' your tiny code and address, and pray its not used for anything, ever =)
The best place ive found to stash tiny code is between defined memory blocks, since they are usually force-separated by at least 16-32 bytes.
If you can find a pointer, you can use this to your advantage, as , once again, defined memory blocks are usually separated, and you can use the pointer plus a negative offset to define where you place your tiny code.
- Zhoul
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
