Cheat Engine

[wizboy11]

For some strange reason, my quake 4 trainer that I just made and want to release to the "masses" dosn't seem to work without cheat engine running in the backround.

I'm not sure if this has to do with the fact that the game hides itself from the applications list in the Windows Task Manager. But it shows its self in the process tab of the Windows Task Manager, so should't the trainer be able to attach itself to that w/o CE running in the backround

Now when I say "running", I mean click on the desktop shortcut then minimize it w/o loading or doing anything, then my trainer works fine. W/o CE there, the trainer does not work at all!

Cheat Engine Running in backround is v5.1.1 with kernal debugger on and the trainer was made with version 4.4 to avoid the Range Check Error Problem.

dragonx

P.S. I made that trainer, just for the record.

[Dark Byte]

Quake 4 loads gamex86 in a dll at a random spot each time.
Ce 5.1.1 has a small bug where it doesn't save the module name of the routinme it is in, so only works as long as you don't close CE. (you can restart the game as often as you want, just don't close ce else it'll forget the module name)

And about the trainer, that doesn't save it either because ce forgot to save the modulename.

(4.4 certainly doesn't do it)

[wizboy11]

Is there away around it? Like using a hex editor or something?

[Dark Byte]

No sorry, not in this case.


well, you could add it as a pointer to a array of byte, and see if you can find a memory address that always points to gamex86.dll each time quake runs, and then modify the offset to point to your code and write the nops there.

[Dark Byte]

I'm not sure if this is the right address because I can't seem to get the dll to load at a different address the 3 times I tried (but I know it changes often)

Anyhow, I hope address 103FE204 contains the pointer to the dll

[wizboy11]

So how would I go about finding that pointer that points to the dll. Just a little more detailed instructions please , I know all about adressing code, I never really use pointers since I find adressing code to a nope is faster and easyer than, for example, going through 6 levels to find a pointer in KOTOR.

Thx, dragonx

[Dark Byte]

a combination of memory view->view->Enumerate DLL's and memory view->view-> memory regions

use the dll list to see in which dll it is, and the memory regions to be sure it's in the region of the dll (combined write copy's allocation protect)

when you know the dll just scan for the base address of the dll

[wizboy11]

Alright... I'll try to do that. Also it is ok if I IM you, I find it's a lot better than posting, waiting, posting again, waiting again, if you catch my drift.

dragonx

[Dark Byte]

No prob, you can IM me. (although I do live in europe so may be offline or away when you're on)