Cheat Engine

[CruZ]

Hi all,

this is my problem:

I found a pointer by pointer scanner, but this pointer use threadstack0
and i need a normal module pointer
if i find pointer manually i not found address


what is the problem ¿?

Bye all

Sorry for my bad english

[Dark Byte]

Try more levels (and/or a bigger structsize)

[CruZ]

Thanks !! fun, but is very slow process and use full computer and use much GB of disk,

is posible reduce use disk space by the ptr files ?


PD: I found 6.000.000.000 pointers and stop..... 6.000.000.000 converted in 888 fun xD

[Dark Byte]

If you use ce 6.4 you can use compressed ptr files (and a lot faster scan)

[CruZ]

[Dark Byte]

a tip in case you have issues, seeing you use an undetected CE you may have trouble starting the pointerscan. In that case, use your own build to find the address, then suspend the target process(and related processes) and use 6.4 to scan.

[CruZ]

... one question

i have 1000 fun pointers never fail in my computer
but i give this pointers to friend to test it and 0 fun
i check md5 of my files and he files

what is problem ?
(unique diference is i have windows 7 and he windows 8 )


Sorry for my bad english

[Dark Byte]

perhaps those pointerpaths went through a route unique for your system (e.g it interpreted your username as an address...)

but are there really no other pointerpaths ? (Did you give him the .ptr files ?)

Also, never ever click stop in a pointerscan. It'll give you mostly a useless result, as the best pointers are usually the ones it finds last (I don't know why, but it's just like that)

[CruZ]

i found 11000 millions of pointers (4096 7 levels) but my disk is full xD and i stoped it

i rescaning but is very slow, i waiting better results

6.4 have a good compress and is fast but 11000 millions use 162 GB of disk


Pd: yes i give he ptr files and all pointers was null

pd2: not is possible cheat engine compress with winzip/winrar and uncompress went use files ?


Bye, CruZ


Sorry for my bad english

[Dark Byte]

You can compress even more by using compressed folders in windows and let ce output to those
Also, only increase level with 1 at a time. Don't increase it to 8 from 5 as that may take too long

But yeah, it might be an option to get a new disk (e.g some people bought a 2TB disk just for pointerscans)
And if you have a lot of systems you could use the distributed pointerscan (they don't do compressed ptrs though)

[mgr.inz.Player]

my tip:
1) launch game in window mode, launch your full modified CE
2) find address, do simple "find out what",

You will get instruction which access (or writes) to your address. It will be something like this:
[REG32+offset] (example: mov [rbx+0C],edx)

or
[REG64+offset] (example: fstp dword ptr [rax+0C])

that 'offset', you can use it as "ending offset"



In your case, "fstp dword ptr [esi+04]", ending offset you can try will be 4.
You can also analyze the code above this instruction, that way you can get more "ending offsets" (last two ending offsets, or last three ending offsets). Go above and find instruction which writes to ESI register. (you can also right click "fstp dword ptr [esi+04]" and choose select current function, CTRL+C, click 'copy' button, paste it here).

Then, do a pointer scan (CE6.4) with those options (for the sake of this example, we assume that you found 3 ending offsets, they are 24,8,C; where C is our last offset):

(of course you will find different ending offsets, like XX,YY, 4 )

As you see, that way we can use way bigger "max level". For example max level 9. Because we already set three offsets, CE will search other 6 offsets. Scanning results should be, more or less, as fast as normal 'full' scan with max level 6.





Of course this is not a perfect method. For example, Borderlands 2, I found address which keeps last fired bullet position (btw. I used this address to make "blink" teleport cheat), and above method wouldn't work.

The only valid pointers left, 16 after many many rescans, have those ending offsets: 5DC (penultimate), 1BC (last).

This address is updated with this instruction "fstp dword ptr [eax+14]"
and accessed by this: "ucomiss xmm0,[ecx-08]"

as you see, there's no 1BC.

[++METHOS]

It can also help to reduce your max offset while increasing max levels. For example, you can set your max offset to 500 while increasing your levels without using up too much space/time, as most games do not need such high offset values for a reliable pointer. For emulated console games, you might do the opposite (e.g. set max offset to 99999, but limit max levels to 2 or 3). Of course, you can always just use injection and not even mess with finding pointers.

[mgr.inz.Player]

max offset 500 could be to small.

Pointer to last bullet position, in Borderlands 2
[[[[[[pointerBase]+40]+190]+6A4]+68]+5DC]+1BC

As you see, 0x5DC = 1500, 0x6A4 = 1700

[++METHOS]

There are no set rules. 500-700 usually works for me.

If you want to be specific.

[CruZ]

i full scan 2048 6 levels... and pointer not fun i go to test your method....



Edit: Your method not found pointers.... i set final offsets c, 8, 24 and and max offset 700 max lvl 9

this is impossible


i need found 3 pointers and 0 found....
i losing hope

sorry for my bad english....