Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


MMF game engine question.

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
AngelPearl
Newbie cheater
Reputation: 0

Joined: 08 Nov 2013
Posts: 20

PostPosted: Mon Nov 25, 2013 10:00 am    Post subject: MMF game engine question. Reply with quote

A game named Tango Strike developed by Fallen Angel Industries bugged me very bad.. It's really hard to beat the game. Thanks to some nice guys, I was able to hack ammo and money cheats but even after trying hard many times could not hack health. This game was created with MMF engine. My question is whether this MMF is written in c++ ?

I will delete this thread if I get no replies withing 48 hours. Smile

_________________
Hi to all cheaters Smile
Special thanks to DarkByte , Gniarf and Steve Smile
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Tue Nov 26, 2013 8:41 am    Post subject: Reply with quote

The engine itself is most likely written in C++: open the .exe with an hex editor (or notepad) and you'll find several instances of the "Microsoft Visual C++ Runtime Library" string, so is was probably made with visual C++.
My hunch tells me the game however is made of some sort of scripts that are packed into the exe.

As for health, it's an unaligned (deactivate the "fast scan" option) 4 byte integer, where full health is about -16, and -1 means death.

Here's a little godmode script I cooked and tested for like 30s, so it's probably buggy:
Code:
[ENABLE]
alloc(NewMem,1024)
label(Return)
label(NormalBehavior)

Tango Strike.exe+3D607:
jmp NewMem
nop
Return:

NewMem:
  cmp dword [esp+30],"Tango Strike.exe"+397BF   //just found via comparison vs when this piece of code is used
  jne short NormalBehavior                      //for menu navigation, ammo in clip, and another thing I don't know
    cmp dword [esp+34],"Tango Strike.exe"+39446 //same as above, just found via comparison.
    jne short NormalBehavior
      mov dword [esi+14a],-10 //-10 in hex means -16 hitpoints=full health
  NormalBehavior:
  mov ecx,dword [esi+0000014A]
jmp Return


 
 
[DISABLE]
dealloc(NewMem,1024)
Tango Strike.exe+3D607:
mov ecx,dword [esi+0000014A]

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
AngelPearl
Newbie cheater
Reputation: 0

Joined: 08 Nov 2013
Posts: 20

PostPosted: Tue Nov 26, 2013 11:33 am    Post subject: Reply with quote

thank you so much, Grandmaster Smile You mentioned "comparison" thing in your post.. I never used it before. would you please explain how to perform it ? how did you find those two addresses ?
_________________
Hi to all cheaters Smile
Special thanks to DarkByte , Gniarf and Steve Smile
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Tue Nov 26, 2013 3:08 pm    Post subject: Reply with quote

1-Obviously, start by finding health in memory.
2-Right click on it->"find out what accesses..."
3-Right click in the window that just popped up->enable "check if found opcodes also..."
4-Go play for a sec...
5-Cheat engine will have found several opcodes that accessed your health, the number between parenthesis is the number of different addresses that this opcode accessed. I picked one that had a "(3)" because it sounded like it accessed the health for all 3 characters (that theory will be proven wrong later on).
6-So I made a simple script that had only that in the NewMem region:
Code:
NewMem:
  mov dword [esi+14a],-10
  mov ecx,dword [esi+0000014A]
jmp Return

7-Problem is that I'm stuck in the briefing with this script and it also does a noreload hack, so (disable your godmode, if any) go into memory viewer->upper pane->press ctrl+G, go to where that "mov ecx,dword [esi+0000014A]" was (Tango Strike.exe+3D607), right click on it->"find out what addresses this opcode accesses".
8-Watch a briefing, shoot a bullet, and get hurt.
9-The "Changed addresses" window will contain several results results: one that popped up during the briefing, one when you shot, and one that popped up when you got shot.
10-Right click on each result->show register states->"S" (for Stack view). On each stack view, I suggest also right click->"esp+*".
11-Now compare your stack views and look for a line that can help you identify when you're accessing health and when you're accessing something else. In other words a line that has some value for the health's stack view, and another value for the other variables' stack view. Prefer using lines that have a "secondary" that is like a static address (Tango strike.exe+*****) because it's likely to be the address of a function that called the function that called..... the function you're hacking, which means that after restarting the game that stack view will likely have the same value.
12-When you've reached the point where you can say "If [esp+XXX] is equal to YYY then the opcode is going to access my health" then craft yourself an asm script like I did - just that I had to check 2 stack lines because I was lazy, so XXX1=30, YYY1="Tango Strike.exe"+397BF, and XXX2=34, YYY2="Tango Strike.exe"+39446.

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
AngelPearl
Newbie cheater
Reputation: 0

Joined: 08 Nov 2013
Posts: 20

PostPosted: Wed Nov 27, 2013 12:24 am    Post subject: Reply with quote

Thanks for your excellent explanation and tutorial. Smile Hacking this game was by bar different than the games I have ever hacked. BTW , your god mode script works great and I don't die. One last thing I wanted to ask you.. what if you want to alter the enemy's behavior and make them stupid so that they don't shoot you. Give me tips to search for enemy's addresses.
_________________
Hi to all cheaters Smile
Special thanks to DarkByte , Gniarf and Steve Smile
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Wed Nov 27, 2013 11:42 pm    Post subject: Reply with quote

1-(optional) I don't know if all missions have a timer, but try to freeze time so as to have more time to experiment.
2-There are 2 things you could try:
2A-Play hide and seek: search for unknown initial value, go see a baddie, he'll get into "Alerted" state, filter with "changed value", hide and wait until he gives up seeking you, filter with changed value, wait, do some "unchanged value" filters, go see the baddie again, filter with changed,... rinse and repeat you find the right address then apply the method I thaught you in my previous post.

OR

2B-Hack the chase timer: There seem to be a timer after which the guys give up chasing you, so you can try hacking it so that they instantly give up on running after you. So get chased, hide, and look for an unknown initial value that keeps increasing (or decreasing) as long as you're hidden. Obviously this timer resets the moment they lose sight of you, where you filter with decreased (or increased) value.


Since I'm a bit busy irl atm, I haven't had the time to do the hack myself.

EDIT: Oh and disable fast scan, health was unaligned so other variables might be aswell.

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
AngelPearl
Newbie cheater
Reputation: 0

Joined: 08 Nov 2013
Posts: 20

PostPosted: Thu Nov 28, 2013 11:10 am    Post subject: Reply with quote

I think you told me everything I need to know to hack this game as well as I learned new things( fast scan and unaligned variables). thanks Smile
_________________
Hi to all cheaters Smile
Special thanks to DarkByte , Gniarf and Steve Smile
Back to top
View user's profile Send private message
Gniarf
Grandmaster Cheater Supreme
Reputation: 43

Joined: 12 Mar 2012
Posts: 1285

PostPosted: Thu Nov 28, 2013 1:19 pm    Post subject: Reply with quote

I didn't explain properly what (un)aligned variables are, so in a nutshell:
*32bit-aligned variables are on addresses that is a multiple of 4, so such addresses end with 0, 4, 8, or C. This is the most common alignment.
*64bit-aligned -> multiple of 8 -> end with 0 or 8.
*unaligned -> multiple of 1 -> end with anything.

For a more in-depth explanation you can read: http://www.geeksforgeeks.org/structure-member-alignment-padding-and-data-packing/

_________________
DO NOT PM me if you want help on making/fixing/using a hack.
Back to top
View user's profile Send private message
AngelPearl
Newbie cheater
Reputation: 0

Joined: 08 Nov 2013
Posts: 20

PostPosted: Thu Nov 28, 2013 10:45 pm    Post subject: Reply with quote

thanks buddy Smile
_________________
Hi to all cheaters Smile
Special thanks to DarkByte , Gniarf and Steve Smile
Back to top
View user's profile Send private message
kumbitz
How do I cheat?
Reputation: 0

Joined: 29 Aug 2014
Posts: 1

PostPosted: Fri Aug 29, 2014 3:17 am    Post subject: Is anyone still around this thread ? Reply with quote

hi angelpearl, i would like to know how you change the money and ammo for this game. i've been trying with no result.
thx. would be really appreciated if you could help me
Back to top
View user's profile Send private message Send e-mail
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites