Cheat Engine

berkay2578 · Posted: Mon Dec 24, 2012 1:48 pm Post subject: [HELP REQUEST] C++ Trainer

Hi guys, So I have this problem with my project. I wanted to do a trainer in C++.

I'm the moderator of a crew called "HDW". We are doing trainers for NFS: World in Cheat Engine. It was fine until people started to make their own trainers with our script. And they said it was made by them. So we decided to use C++ on our next releases. The problem I have is, I can't "reach" to "static 'base' address". I'll give you an example. You'll understand it better.

TsTg · Posted: Mon Dec 24, 2012 2:18 pm Post subject:

In cheat engine's memory viewer window, press CTRL+G, then go to your address "nfsw.exe+443B44".

once there, open the 'View' menu, and uncheck 'Show Module Addresses', now you should be seeing the exact address without module relatives.

atom0s · Posted: Tue Dec 25, 2012 4:15 am Post subject:

nfsw.exe resolves to the symbol address. In this case its the main executables base address.

You can use the following API to get this information:
- CreateToolhelp32Snapshot
- Process32First / Process32Next
- Module32First / Module32Next

You can also use the PSAPI alternatives if you wish as well:
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684894(v=vs.85).aspx

There are a lot of examples of doing this around the web and on these forums.

berkay2578 · Posted: Tue Dec 25, 2012 11:12 am Post subject:

TsTg · Posted: Tue Dec 25, 2012 2:07 pm Post subject:

From what i understand, you are using a DLL of yours, as the trainer for a certain game with a variable base address?.

Anyway if this is, do the following:

1- Inject your DLL into the target by using CreateRemoteThread from your EXE, the thread function is the code of your dll to be executed.

2- In your injected DLL function,now:
-If your patching in the exe file(Target process itself), use GetModuleHandle to get the base address(use lpModuleName = NULL)

-If your patching a DLL inside the process, use LoadLibrary with the DLL name to get it's base address

3- Now your are ready to patch, just add your offset to the base address to get the correct target address, let's say here your 0x00C605D is in a dll that based at 0x00C0000 (For current session), so you know that offset is 0xC605D - 0xC0000 = 0x605D far from the base, so next time get the new base, add 0x605D to it, and patch your data, DONE Smile

.

berkay2578 · Posted: Tue Dec 25, 2012 2:19 pm Post subject:

I got it all working. Thanks for your help. [to both]