Cheat Engine

[private00x]

Hi there,

I'm trying to get a pointer for an address of a game. All pointers have multiple levels. The problem is that, for any address I have tried so far, after like 1 or 2 levels the next opcode scan will return an opcode that suggests me the same hex value to search for as the previous one. This will obviousely not be possible. I copied the opcode where it returns the same hex value again, resulting in a dead end:

[Dark Byte]

Remember the text at the bottom of the more info window? All register values are shown AFTER the instruction has been executed.

mov eax,[eax+edx*4+0c] will affect EAX, which is a problem, since eax is part of the calculation. (small part)

2 ways to get by this
1: use exceptions instead of hardware bp's (can cause crashes so you may only be able to use it once)

2: my preferred, use basic math to figure it out:
Let's look at the instruction: mov eax,[eax+edx*4+0c]
Means that eax+edx*4+c will result into the address you've chosen the option "Find what accesses" on
fun thing is, you KNOW that address

what we can find out is that edx*4+c = 3*4+c=c+c=18

so:
eax+18=known address
known address-18=eax=base pointer value to scan for


Also, what are you looking for? The instructions you're looking at are for array's. If it's the units health in a RTS, I recommend going with code injection instead

[private00x]

[FreeFry]

Hi Tom. :p

You might explain that you're writing a bot for a game, and that you wont be able to use the cheat-engine features(such as the auto assembler).

[private00x]

[Dark Byte]

looking at the screenshot it looks like you only tried one pointer path
Try finding with accesses other addresses and go from there (e.g if they result in a different offset, really look into it)

And really, a 25+ level pointer, I usually go with auto assembler after the 5th level (and if you don't use ce, you could always rip out ce's aa and make a dll/lib from it and use it in your own app, it's open source, or even just look at the bytecode aa generates and make your trainer inject that instead, keeping in mind the relative jumps)

Also, usually when an array is involved it means trouble with pointers, because it is possible that the array won't be filled exactly the same way the next time the game is run (Especially on emulator games like those running in flash)

[private00x]