Cheat Engine

ml · How do I cheat? Reputation: 0 Joined: 01 Apr 2016 Posts: 3

Hello,

Complete noob to CE reaching out for help please, in the hope somebody might be able and would like to assist...

I have an older game called Silent Hunter 5, which has a first person view with a fixed FOV. I'm not too sure what the value is, nor how it is stored but although some cameras in the game are adjustable via an external camera editor, this one and a few others are fixed.

So I'm trying to find out how to change that, and I'm stuck unfortunately.

There are 3 easily/quickly accessible cameras, first person, uzo, and binoculars.

With CE I'm monitoring a value that switches as follows:

FP: 97
bins: 70
uzo: 70

When I click what writes to this address when switching views, I see:

014CC1D8 - D9 5E 04 - fstp dword ptr [esi+04] <<
014CC1DB - 55 - push ebp
014CC1DC - DD 44 24 08 - fld qword ptr [esp+08]

And when I click what accesses this address when switching views:

014CC1D8 - D9 5E 04 - fstp dword ptr [esi+04]
014CC20B - F3 0F10 46 04 - movss xmm0,[esi+04]
014CBF2E - 0F2F 46 04 - comiss xmm0,[esi+04]
014CBF39 - F3 0F10 46 04 - movss xmm0,[esi+04]

Instructions from 11C1D8 which also includes the 2nd line from above:

sh5.exe+11C1D8 - D9 5E 04 - fstp dword ptr [esi+04]
sh5.exe+11C1DB - 55 - push ebp
sh5.exe+11C1DC - DD 44 24 08 - fld qword ptr [esp+08]
sh5.exe+11C1E0 - 33 D2 - xor edx,edx
sh5.exe+11C1E2 - D9 5E 08 - fstp dword ptr [esi+08]
sh5.exe+11C1E5 - 8B 3E - mov edi,[esi]
sh5.exe+11C1E7 - 8B CF - mov ecx,edi
sh5.exe+11C1E9 - 8D 69 01 - lea ebp,[ecx+01]
sh5.exe+11C1EC - 8D 64 24 00 - lea esp,[esp+00]
sh5.exe+11C1F0 - 8A 01 - mov al,[ecx]
sh5.exe+11C1F2 - 41 - inc ecx
sh5.exe+11C1F3 - 84 C0 - test al,al
sh5.exe+11C1F5 - 75 F9 - jne sh5.exe+11C1F0
sh5.exe+11C1F7 - 2B CD - sub ecx,ebp
sh5.exe+11C1F9 - 85 C9 - test ecx,ecx
sh5.exe+11C1FB - 7E 0E - jle sh5.exe+11C20B
sh5.exe+11C1FD - 8D 49 00 - lea ecx,[ecx+00]
sh5.exe+11C200 - 80 3C 17 0A - cmp byte ptr [edi+edx],0A { 10 }
sh5.exe+11C204 - 74 17 - je sh5.exe+11C21D
sh5.exe+11C206 - 42 - inc edx
sh5.exe+11C207 - 3B D1 - cmp edx,ecx
sh5.exe+11C209 - 7C F5 - jl sh5.exe+11C200
sh5.exe+11C20B - F3 0F10 46 04 - movss xmm0,[esi+04]
sh5.exe+11C210 - 0F2F 05 80C07301 - comiss xmm0,[sh5.exe+38C080] { [350.00] }
sh5.exe+11C217 - 0F86 FA000000 - jbe sh5.exe+11C317
sh5.exe+11C21D - 8B 4E 18 - mov ecx,[esi+18]
sh5.exe+11C220 - 85 C9 - test ecx,ecx
sh5.exe+11C222 - 0F84 EF000000 - je sh5.exe+11C317
sh5.exe+11C228 - 83 79 50 00 - cmp dword ptr [ecx+50],00 { 0 }
sh5.exe+11C22C - 0F84 E5000000 - je sh5.exe+11C317
sh5.exe+11C232 - 6A 00 - push 00 { 0 }
sh5.exe+11C234 - 6A 00 - push 00 { 0 }
sh5.exe+11C236 - 8D 44 24 1C - lea eax,[esp+1C]
sh5.exe+11C23A - 50 - push eax
sh5.exe+11C23B - BD C01B6B01 - mov ebp,sh5.exe+301BC0 { [013CD060] }
sh5.exe+11C240 - 6A 01 - push 01 { 1 }
sh5.exe+11C242 - C7 44 24 28 00000000 - mov [esp+28],00000000 { 0 }
sh5.exe+11C24A - C7 44 24 2C 00000000 - mov [esp+2C],00000000 { 0 }
sh5.exe+11C252 - C7 44 24 30 04000000 - mov [esp+30],00000004 { 4 }
sh5.exe+11C25A - C7 44 24 34 00000000 - mov [esp+34],00000000 { 0 }
sh5.exe+11C262 - 89 6C 24 24 - mov [esp+24],ebp
sh5.exe+11C266 - 8B 49 50 - mov ecx,[ecx+50]
sh5.exe+11C269 - 68 5E010000 - push 0000015E { 350 }
sh5.exe+11C26E - 51 - push ecx
sh5.exe+11C26F - 8B C7 - mov eax,edi
sh5.exe+11C271 - E8 4A670F00 - call sh5.exe+2129C0

I have tried the following injection:
08A80000 - D9 5E 04 - fstp dword ptr [esi+04]
08A80003 - C7 46 04 00000042 - mov [esi+04],42000000 { [0.27] }
08A8000A - 55 - push ebp
08A8000B - DD 44 24 08 - fld qword ptr [esp+08]
08A8000F - E9 CCC1A4F8 - jmp sh5.exe+11C1E0

However although the adjusted value does appear when watched by CE at it appears to have no effect on gameplay. This tells me I'm adjusting the wrong address (ie the value at that address isn't actually FOV after all), or that I'm injecting at the wrong location.

I'd really appreciate any advice (and apologies, that my assembly is weak).

Many thanks.

deama1234 · Posted: Fri Apr 01, 2016 12:12 pm Post subject:

If there's no effect on gameplay, you probably found the wrong address.

Try nopping the "fstp" and "fld" ones (from the "writing" section) and see what happens, if there isn't an affect, find another address; some games use double instead of float.

ml · How do I cheat? Reputation: 0 Joined: 01 Apr 2016 Posts: 3

Ok thanks. I tried nooping those and no effect. Think it must be elsewhere yet looking through double and 4 byte and float this is the only value that appears to be 'obvious'. Too obvious I guess, in that it seems to be misleading me.

I'm not sure what to look for now; and wondering if the values are stored in structures somewhere then loaded onto the stack and destroyed immediately after the camera change.

I do know many of the cameras are adjustable via the editor and read in from external binary files, but apparently not the camera I need to alter.

Are there any tricks for catching or finding that sort of thing?

deama1234 · Posted: Sat Apr 02, 2016 6:36 am Post subject:

Go to the scan settings and tick all the memory regions, maybe it's in a weird place or something.

The way I find FOV is just scan for float between 40-100, then either decrease or increase depending on what I'm doing to change that (e.g. iron-sights, binoculars).

ml · How do I cheat? Reputation: 0 Joined: 01 Apr 2016 Posts: 3

Thanks. I didn't find anything else unfortunately.

Latest is that messing around with that 70/97 value does actually make a change when I switch camera elsewhere in the submarine. Nop there did remove the zoomed in appearance of the periscope when set to 97, but then I loaded 120 in for returning to the main first person view and I was left with complete graphical corruption.

Not sure where to go from here. It might have me beaten, which is a shame as I don't like to quit on stuff; just seems it's not been coded to accept a fov change to this camera.