Cheat Engine

[lethalbo]

This is for SRW Alpha 2 in PCSX2 (not an online game).

I am trying to change pilot stats. For example my pilot has Melee of 158 (9E), and I want it to be 400 (190).

I've changed the freeze interval to 1ms and 10ms, and read the following forum posts:

* Can't freeze values (sid=7c4b819be975ce2ff93004b24653587a)
* super freeze.. (sid=21ffc90d11346f9b8fd3c7ae636a4816)

But I am still unable to freeze the value.

When in a particular menu, launching "Find What Accesses This Address" or "Find What Writes To This Address" shows a rapid increasing count, it seems like it can go on forever, with the following assembly code:

3002BFA5 - 89 11 - mov [ecx],edx

The EDX register has the current pilot stat (e.g. 9E), and ECX is the address that holds the current value.

Even with the pointer, the address value can never be frozen or changed. It will always go back to the original value.

I even edited the save state using HxD and still get the same results.

I can change money with no problem, so I don't think there's a hook preventing the hack, but not pilot stats.

Please help!

p.s.

Here is the result when running "Find What Writes To This Address"

3002BF9D - 01 C1 - add ecx,eax
3002BF9F - 0F88 9B225FD1 - js pcsx2-r5350.exe+49E240
3002BFA5 - 89 11 - mov [ecx],edx <<
3002BFA7 - BA 208C6A01 - mov edx,pcsx2-r5350.exe+528C20
3002BFAC - 8B 0D 008C6A01 - mov ecx,[pcsx2-r5350.exe+528C00]

EAX=20000000
EBX=3002BFA7
ECX=2114CE70
EDX=0000009E
ESI=0023C254
EDI=00000000
ESP=0939FB20
EBP=0939FB28
EIP=3002BFA7

[++METHOS]

Can you manipulate the value with the address that you found? If not, find a new address.

If you can manipulate the address, but not freeze it, you can try injecting a script with the following:

[lethalbo]

I can change it, but it flickers between the changed and actual value, and it won't let me subtract more than what I actually have.

If you look at the two images below, you can see that I tried to freeze the PP to 1000, but when increase the Melee by 2 it still subtracts off the actual value (18).

It's like the value is stored somewhere else that is not in memory.

I tried the code you posted, and it crashed the game.

Four things access the same address at the same time:

3002BF11 - 01 C1 - add ecx,eax
3002BF13 - 0F88 27235FD1 - js pcsx2-r5350.exe+49E240
3002BF19 - 89 11 - mov [ecx],edx <<
3002BF1B - BA 208C6A01 - mov edx,pcsx2-r5350.exe+528C20
3002BF20 - 8B 0D 008C6A01 - mov ecx,[pcsx2-r5350.exe+528C00]

EAX=20000000
EBX=3002BF1B
ECX=2114CE70
EDX=0000009E
ESI=0023C254
EDI=00000000
ESP=0939FB20
EBP=0939FB28
EIP=3002BF1B
------------------------------------------------------------------
3003B626 - 01 C1 - add ecx,eax
3003B628 - 0F88 522A5ED1 - js pcsx2-r5350.exe+49E080
3003B62E - 8B 01 - mov eax,[ecx] <<
3003B630 - 99 - cdq
3003B631 - A3 808A6A01 - mov [pcsx2-r5350.exe+528A80],eax

EAX=0000009E
EBX=3003B630
ECX=2114CE70
EDX=00000000
ESI=0026F344
EDI=00000000
ESP=0939FB20
EBP=0939FB28
EIP=3003B630
------------------------------------------------------------------
3003BE26 - 01 C1 - add ecx,eax
3003BE28 - 0F88 52225ED1 - js pcsx2-r5350.exe+49E080
3003BE2E - 8B 01 - mov eax,[ecx] <<
3003BE30 - 99 - cdq
3003BE31 - A3 808A6A01 - mov [pcsx2-r5350.exe+528A80],eax

EAX=0000009E
EBX=3003BE30
ECX=2114CE70
EDX=00000000
ESI=0026F3A0
EDI=00000000
ESP=0939FB20
EBP=0939FB28
EIP=3003BE30
------------------------------------------------------------------
3003C84A - 01 C1 - add ecx,eax
3003C84C - 0F88 2E185ED1 - js pcsx2-r5350.exe+49E080
3003C852 - 8B 01 - mov eax,[ecx] <<
3003C854 - 99 - cdq
3003C855 - A3 808A6A01 - mov [pcsx2-r5350.exe+528A80],eax

EAX=0000009E
EBX=3003C854
ECX=2114CE70
EDX=000000E0
ESI=0026F468
EDI=00000000
ESP=0939FB20
EBP=0939FB28
EIP=3003C854

[++METHOS]

You said the game is not online, so if the value is flickering after you change it, it probably means that you have not found the correct address (or all of the addresses).

Redo your search and change your search settings to search for all value types.

In any game, the first thing you should do (before pointer scan and/or injection), is test the address to ensure that it is correct. If you can't even change the value to achieve what you want, there is no sense in freezing the value at that address.

[lethalbo]

Hahahahaha, I've spent all weekend trying to figure it out and you SIR are completely right.

I did a scan for all value types (instead of 4 bytes) and found the actual address (which was a single byte).

GNIREENIGNE, where can I send you a beer???

[++METHOS]

I'm glad you got it resolved.