| View previous topic :: View next topic |
| Author |
Message |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Sun Apr 27, 2014 10:25 am Post subject: Trials Fusion problem |
|
|
So, i want to hack Trials Fusion but im stuck.
I found the Baseadress for the Timer as a 4byte value with no problems.
Now im trying to find the baseadress for the Failscounter.
Picture 2 Counter
I tried the same method as i did with the Timer but its not really working.
What ive done i try to explain now, ill hope you understand as im no expert (trying now the first time).
Okay, i did search for the value 0 at the beginning and then used increased/decreased Value to narrow it down. Those are the results:
Picture 1
The Red marked value ist the visual counter on screen, when i try to freeze it it still goes up but flashes abnormally. I tried to find pointers for it but after the 1 pointer it gives me 0 results back.
same goes for the green marked values (timer had such values) but on level 5 i could find it for the timer. here on the fail one it doesnt seem to bring anything.
So, i tried to look for Floats and those are my results which are similiar to the 4byte one above.
Picture 3
Except this time i find 2 values corrosponding to the counter which i can freeze and edit, but the counter itself doesnt change (cant be freezed).
Picture 4 + 5
So, what can i do to find the baseadress of it ? I tried now serveral times to find the stuff and all ive found out is that the offset is always 4.
I tried to make an AOB Scan like in this Post to get something but the results dont match in any way, they are completly different, no similarities.
Thread: Rydian's Guide To Modern Pointers + AOB To Data
Sorry as i cant pictures right now directly, Forum doesnt allow me todo so ! Had to attach them :/
| Description: |
|
| Filesize: |
3.53 KB |
| Viewed: |
20803 Time(s) |

|
| Description: |
|
| Filesize: |
3.87 KB |
| Viewed: |
20803 Time(s) |

|
| Description: |
|
| Filesize: |
25.17 KB |
| Viewed: |
20803 Time(s) |

|
| Description: |
|
| Filesize: |
39.02 KB |
| Viewed: |
20803 Time(s) |

|
| Description: |
|
| Filesize: |
9.48 KB |
| Viewed: |
20803 Time(s) |

|
|
|
| Back to top |
|
 |
lamafao Expert Cheater
Reputation: 1
Joined: 17 Apr 2013 Posts: 130
|
Posted: Sun Apr 27, 2014 10:45 am Post subject: |
|
|
Have you tried to freeze all the values and see if they do anything? And have you tried to begin your search with unknown initial value and not with 0?
Also you can try 'All' search if you are not sure what type the value is
|
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Sun Apr 27, 2014 11:39 am Post subject: |
|
|
i tried to freeze all of them, but nothing changes. The counter just flashes again abnormally (1 value that causes this) and the others just keep changing back and forth (0 to xxx).
I tried unknown aswell but then i just get the values i normally searched via float or 4 byte.
I tried also the ALL search but it came just up with the same stuff.
What i also have seen is, that the adresses seem to reset when i pause the game (before pause the value as the counter, after pause/unpause they change to ??? or some other random numbers).
When i try to freeze the results of ALL search with unknown value i end up with like 500 results and none of them seem to work but i will try again, maybe i made a mistake.
//EDIT
Okay, now i got some different results. This time i broke the Counter ^^
i found the adress again as all types and i froze them which this time worked. The Counter stayed at 19 even the value i gave it was 0.
After i unfroze it the Counter didnt reset or go up and the values remain on 0.
So i finished the race and just seen i got 60 fails this round (pushed the reset button multiple times).
//EDIT 2
Freezing the adress crashes the game instantly.
changing the value for all value types of the adress to 0 and freezing it then works, but crashes the game after finishing the race.
So, what can i do, any other ways or methods to get this freaking baseadress ?
If someone more skilled has the game aswell, it would be nice to contact me for giving me a helping hand
|
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Mon Apr 28, 2014 6:57 am Post subject: |
|
|
Okay, i found now a Baseadress which is valid after every restart, but i still cant freeze the value ! I mean i can freeze it, but the game will still count somewhere else the failures and use those at the end of the race.
<VariableType>4 Bytes</VariableType>
<Address>"trials_fusion.exe"+00E06E68</Address>
<Offsets>
<Offset>4</Offset>
<Offset>0</Offset>
<Offset>50</Offset>
<Offset>10</Offset>
<Offset>10</Offset>
<Offset>10</Offset>
<Offset>58</Offset>
<Offset>100</Offset>
<Offset>90</Offset>
<Offset>178</Offset>
When i redo the Pointer scan after each restart i still get 28050 results so there must be something else im missing.
Anyone who can provide a clue/hint/solution ?
|
|
| Back to top |
|
 |
lamafao Expert Cheater
Reputation: 1
Joined: 17 Apr 2013 Posts: 130
|
Posted: Mon Apr 28, 2014 8:16 am Post subject: |
|
|
Try to look what accesses/writes to that address and nop/change the stuff.
| TheDaLexy wrote: | | i still cant freeze the value ! I mean i can freeze it, but the game will still count somewhere else the failures and use those at the end of the race. |
Well, i guess one of the random addresses you find in your search might be doing that, so you can try to change them to a low number at the very end near the finish, and see if your failures stay the same after you finish the map
|
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Mon Apr 28, 2014 9:54 am Post subject: |
|
|
There are plenty access but no write to the baseadress.
Tried to look into memory and nop the baseadress (if thats right) but then the game crashed.
I tried allready some variations when finishing the map, but the game always takes some other value to count the fails.
im lost ^^
|
|
| Back to top |
|
 |
lamafao Expert Cheater
Reputation: 1
Joined: 17 Apr 2013 Posts: 130
|
Posted: Tue Apr 29, 2014 6:13 pm Post subject: |
|
|
I couldn't find fails either, idk what to tell u ;d
Did you actually found an address that would change the number of your fails?
|
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Wed Apr 30, 2014 3:13 am Post subject: |
|
|
Noit really, the adress above (for Skidrow crack) wants to change it, but it wont let it happen.
When you set the freeze interval to 100ms and change the fail timer to 0 you can see that the counter flashes abnormally but it doesnt change.
seems like a really tricky one
I want to sort that out, it can be done for sure XD
You maybe /search/found other intresting values ?
|
|
| Back to top |
|
 |
lamafao Expert Cheater
Reputation: 1
Joined: 17 Apr 2013 Posts: 130
|
Posted: Wed Apr 30, 2014 9:43 am Post subject: |
|
|
| TheDaLexy wrote: | | When you set the freeze interval to 100ms and change the fail timer to 0 you can see that the counter flashes abnormally but it doesnt change. |
Game runs really slow for me but ill try to see if i can find it
| TheDaLexy wrote: | | You maybe /search/found other intresting values ? | Nah, i tried to look for coordinates but every single thing like wheels hands and stuff has their own coordinates.. I guess it's possible to create a fly or teleport hack but it would take a lot of time..
|
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Wed Apr 30, 2014 10:11 am Post subject: |
|
|
any possibility for adding me in skype/steam for faster exchange of informations ?
Let me know and send me a PM (im not able todo so at the moment, low postcount)
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Apr 30, 2014 5:51 pm Post subject: |
|
|
Reset fail counter (made through TeamViewer)
Game version: ski_d_row
| Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
newmem:
//call trials_fusion.exe+48740
xor eax,eax
jmp returnhere
"trials_fusion.exe"+4C73B:
jmp newmem
returnhere:
[DISABLE]
"trials_fusion.exe"+4C73B:
//call trials_fusion.exe+48740
db E8 00 C0 FF FF
dealloc(newmem) |
_________________
Last edited by mgr.inz.Player on Wed Apr 30, 2014 6:57 pm; edited 1 time in total |
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Wed Apr 30, 2014 5:53 pm Post subject: |
|
|
Awesome work you did there Its 3 hours i will never forget. +Rep for you !
|
|
| Back to top |
|
 |
lamafao Expert Cheater
Reputation: 1
Joined: 17 Apr 2013 Posts: 130
|
Posted: Wed Apr 30, 2014 5:57 pm Post subject: |
|
|
| mgr.inz.Player wrote: | | Reset fail counter (made through TeamViewer) |
How did you find it?
|
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Wed Apr 30, 2014 6:51 pm Post subject: |
|
|
Tracing
_________________
|
|
| Back to top |
|
 |
TheDaLexy Cheater
Reputation: 0
Joined: 26 Apr 2014 Posts: 46
|
Posted: Wed Apr 30, 2014 7:31 pm Post subject: |
|
|
| On my PC via teamviewer, 3 Hours of just watching the man himself doing his usual work XD
|
|
| Back to top |
|
 |
|