Cheat Engine

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

Hello friends,

So I'm trying to create a trainer where I can adjust the FOV by pressing a keystroke.

I've found that adjusting the FOV in the game settings (adjusting slider and pressing apply) executes the following code:

mov [rcx+000027C0],eax

By changing this to:

mov [rcx+000027C0],(float)70

I fake the game into adjusting it to 70 instead of whatever value is set in the options (50-60 max ranges by default) when I hit apply in the settings.

How can I write a piece of code that executes that injection on a key press?

I suppose this would work the same as someone using a trainer to LOCK health or ammo.

Thanks fellas!

ParkourPenguin · Posted: Tue Apr 26, 2016 8:12 pm Post subject:

Right click on the AA script in the address list.
Select "Set/Change hotkeys".
You should be able to make the hotkey from there.

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

++METHOS · Posted: Wed Apr 27, 2016 4:10 am Post subject:

It would work, you just have to set up your script to support it by creating a boolean trigger and assigning a hotkey to it. For example:

newmem:
cmp byte ptr [fov_enable],1
je fov_cheat
jmp originalcode

You can allocate memory for fov_enable, then set up a child script that will toggle fov_enable value to 1/0 in the enable/disable sections.

Alternatively, you can control everything inside of your script by setting up a conditional jump that checks if a particular key/button is being pressed, then execute your code only when that is happening.

However, I don't see how this would be any different than what ParkourPenguin has suggested. Perhaps you can elaborate on what it is that you are wanting to accomplish, specifically?

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

++METHOS · Posted: Wed Apr 27, 2016 11:15 am Post subject:

The value that you're interested in is inside [rcx+000027C0]. Try right-clicking on the instruction inside of memory viewer and checking to see what address(es) it accesses. Change the FOV value by hitting apply. In the new window that popped up earlier, you should see your address show up. Add it to your cheat table. Click 'stop' and close the new window. Right-click on the address in your cheat table to see what is accessing it. If an instruction pops up that is constantly accessing the address, then you can use that for your injection point. If not, you'll have to find a better injection point or just use a pointer.

Once you have done that, you can determine how to proceed.

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

++METHOS · Posted: Wed Apr 27, 2016 11:28 am Post subject:

If that instruction is actually accessing the address constantly, and not accessing any other addresses, then you can use that for your injection point.

Let CE build the script for you using Auto Assemble with AOB Injection template.

Once you have your script, add it to your table. Setting it up to do what you want will be easy at that point.

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

So I've already done the Auto Assembler script as well, I'll try and link that here for you also.

Main Window with new Script:

IMGUR HRr56p3.png

The script:

++METHOS · Posted: Wed Apr 27, 2016 11:33 am Post subject:

Like I said already......

You have to use an instruction that is constantly accessing the address.

When you change the value of the address in your cheat table, does it change the FOV in-game?

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

You've been a wonderful help METHOS thank you so much. I suppose I'm doing things right but this instruction is just the wrong one to use.

I would have no idea how to find an instruction that is constantly adjusting the FOV (I don't think there is one) but that will be my new task then Smile

++METHOS · Posted: Wed Apr 27, 2016 11:35 am Post subject:

If changing the value in your cheat table changes the FOV in-game, in real time, then do as I explained above and right-click on it to see what is 'accessing' it (not what is writing to it). In the new debugger window that pops up, if there is an instruction that populates the list and is constantly accessing the address, you can use that one.

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

Ah, that's new. Yes I've just checked what is accessing it and I do get multiple different instructions.

They all come up with this instruction:

movss xmm0,[rax+08]

I tried changing one of those with:

mov [rcx+000027C0],(float)70

But the game then crashed, let me fiddle with this. Any easier way for us to communicate? You're being an amazing help and I really appreciate it.

++METHOS · Posted: Wed Apr 27, 2016 11:42 am Post subject:

The game is probably crashing because the instructions are accessing multiple addresses. You can check this by right-click on the empty, white space inside the debugger window that pops up (when you right-click the address to see what is accessing it), and check to see if found opcodes are accessing other addresses. You will see extra numbers populate in the count column that will be between 1 and 8. If any of them say 1, and are constantly accessing the address, then you can use that. If not, you'll need to incorporate a filter or find a different instruction to use (e.g. an instruction that handles one of the other offsets/addresses inside that same data structure).

Liquidious · How do I cheat? Reputation: 0 Joined: 26 Apr 2016 Posts: 8

They are all saying (1) but so far I have tried the first and second one, they both crashed the game.

IMGUR aaMqM2t.png

Am I OK to keep using:

mov [rcx+000027C0],(float)70

EDIT: So they are all crashing the game if I use the original code, but maybe that's wrong: