|
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
ExiMaster How do I cheat? Reputation: 0
Joined: 27 Nov 2016 Posts: 3
|
Posted: Sun Nov 27, 2016 10:13 pm Post subject: How can I completely lock these values? |
|
|
Hey all, I currently playing a game that uses a graphical bar for health. 0 is the minimum and 1116471296 is full health / full bar. When you get hit 3 times when the value is 0 you die. Let's just say combat can get pretty rough since it's a bullet hell / AoE spam game and setting the refresh rate to 10ms for freezing the value does not help in certain situations failing the whole level.
I did a scan of 1116471296 (4 Bytes) and found 1 static address and a whole bunch of other dynamic addresses you could inherit based on the level you are playing. Is there a way I could lock the value permanetly from even being written to so when I get hit the value does not change at all such as for example God Mode plugins in games where health is not affected and stays at the max value?
I have attached a screen shot of my scan for an example. I placed 2 addresses in the list. Active Health is the current address the level is using for my health bar. Static Address is the only green result on the top.
Thanks for any help!
Description: |
|
Filesize: |
137.96 KB |
Viewed: |
19311 Time(s) |
|
|
|
Back to top |
|
|
BanCheese Cheater Reputation: 0
Joined: 22 Oct 2014 Posts: 49
|
Posted: Sun Nov 27, 2016 11:12 pm Post subject: |
|
|
That's not a 4 byte -- it's a float. 1116471296 == 0x428C000 == 70.0.
Most of those values are probably used for other things. Try to narrow them down a bit more. Freezing all of them right now would probably result in a crash.
The static address may already be what you're looking for. To do a "weak" freeze, just click on that box in the lower left of the screenshot -- a red X should appear inside it. I say "weak" in that this will simply reset the value to its current state several times a second. However, if you happen to take three hits faster than it can refresh, you may need to nop out the code that's writing to it. If that's the case, reply in this thread and I can walk you through it.
If you haven't already done it, I'd highly recommend the Cheat Engine tutorial, found in the same directory where you installed Cheat Engine.
_________________
A guy who likes memory hacking. |
|
Back to top |
|
|
ExiMaster How do I cheat? Reputation: 0
Joined: 27 Nov 2016 Posts: 3
|
Posted: Mon Nov 28, 2016 12:19 am Post subject: |
|
|
Ah, you are correct, I have located the float value and froze that giving similar results to freezing the 1116471296 value too.
I have done the tutorial enough to fully understand finding any value I want scanning and whatnot. Just not advanced manipulation like the hex editing and code injection. I keep crashing the game.
But yeah if you could walk me through of a simple string that could nop out the code as you say that would be perfect. Maybe even finding the pointer for the float since I was on the wrong thing. I've tried many tutorial videos on how to get the pointer but just end up with thousands of results containing the same value in hex.
I don't know if this helps but the health bar has 4 different 'tickers' you could say on it. The first line constantly ticks forever throughout the level. The second line is just like the first (ticks slightly slower per second than first) but stops ticking when you get hit, then continues ticking after 3 seconds when you start regenerating health (assuming you don't get hit again). The third line indicates how many times you were hit throughout the whole level. The fourth line indicates how many times the enemy has brought your health (in the game it's called the shield) to 0. If you get hit 3 times at 0 health/shield in this mode you die or start regenerating again in 3 seconds if not hit.
Thanks again for your time!
Description: |
|
Filesize: |
30 KB |
Viewed: |
19291 Time(s) |
|
|
|
Back to top |
|
|
Lithium. Newbie cheater Reputation: 1
Joined: 21 Jan 2015 Posts: 17
|
Posted: Mon Nov 28, 2016 12:39 am Post subject: |
|
|
The 4th address being accessed is what you want most likely. Highlight it, and click "Show disassembler". Show us the area where the code breaks.
|
|
Back to top |
|
|
BanCheese Cheater Reputation: 0
Joined: 22 Oct 2014 Posts: 49
|
Posted: Mon Nov 28, 2016 12:44 am Post subject: |
|
|
Ah, yes, a simple nop won't work here -- the x87 FPU maintains an internal "stack" of registers (it's really bad; nobody really likes it). For the FPU instructions that "pop" the stack, you need to preserve that poping operation. The simplest way of doing that is to use
Which is a
Code: | f - floating point
st - store
p - and pop
st(0) - into st(0), which is the current top of the stack |
So essentially, this just moves the register into itself and then pops the stack.
You can think of it as
Code: | mov [esp], [esp] //this isn't a valid instruction, but whatever
add esp, 4 |
Try replacing each one of those instructions (one at a time, restarting if it crashes) with an fstp st(0) (be sure to say "yes" when asked whether or not to replace incomplete opcodes with NOPs).
If none of those modifications work, that's probably just a display value. Try filtering down the list of potential addresses a bit more and then fstp st(0)'ing their modifiers.
_________________
A guy who likes memory hacking. |
|
Back to top |
|
|
Betcha Expert Cheater Reputation: 4
Joined: 13 Aug 2015 Posts: 232 Location: Somewhere In Space
|
Posted: Mon Nov 28, 2016 2:36 am Post subject: |
|
|
First with most count, reads your health constantly, it would be the best place to do injection.
Cause if make any changes it will change your health instantly without getting any damage.
Can do inection and change in something like this:
Code: | fstp dword ptr [edi+64]
mov dword ptr [edi+64],(float)999.0 |
Second would be bad injection cause like you said it reads health till you get hit.
If do any changes, it would affect only on health regeneration.
Third is good place to do injection as well.
Cause if make any changes it would stop damage when enemies hit you.
Can do injection and change like BanCheese said:
Code: | fstp dword ptr [edi+64]
fstp st(0)
|
With fourth sounds like you can cheat the death.
By Nop that instruction, would make game think that you are alive.
While in real time health / shield is down and you would be dead.
Code: | fstp dword ptr [edi+64]
fstp st(0)
|
|
|
Back to top |
|
|
ExiMaster How do I cheat? Reputation: 0
Joined: 27 Nov 2016 Posts: 3
|
Posted: Mon Nov 28, 2016 8:52 pm Post subject: |
|
|
I have all the code for each ticker in respective order from my last post. Ill trying tweaking with them based off the replies. Thanks for so many replies! These are the 4 codes I will be variously adjusting then injecting.
EDIT:I have injected the codes Betcha has posted. The code mod for the constant health ticker worked aside from one side effect. Enemies get the invulnerability too. So it works, but doesn't, but really freaking close.
The code mod the Hit Counter just makes you die instantly upon being hit by anything but the health bar does not budge.
The code mod for the Shield Down causes the game to crash as soon as you kill an enemy.
Constant Health Ticker - First Ticker
Code: | alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fstp dword ptr [edi+64]
fld dword ptr [edi+64]
exit:
jmp returnhere
17F50074:
jmp newmem
nop
returnhere:
|
Health Regen Ticker - Second Ticker
Code: | alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fstp dword ptr [edi+64]
fld dword ptr [ebp-08]
exit:
jmp returnhere
17F500A5:
jmp newmem
nop
returnhere:
|
Hits Received Counter - Third Ticker
Code: | alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fstp dword ptr [esi+64]
fldz
exit:
jmp returnhere
17F90F9D:
jmp newmem
returnhere:
|
Shield Down Counter - Fourth Ticker
Code: | alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
fstp dword ptr [esi+64]
fld dword ptr [ebp+0C]
exit:
jmp returnhere
17F90FB4:
jmp newmem
nop
returnhere:
|
|
|
Back to top |
|
|
Betcha Expert Cheater Reputation: 4
Joined: 13 Aug 2015 Posts: 232 Location: Somewhere In Space
|
Posted: Tue Nov 29, 2016 1:27 am Post subject: |
|
|
ExiMaster wrote: | The code mod for the constant health ticker worked aside from one side effect. Enemies get the invulnerability too. |
Constant Health Ticker - First Ticker
Code: | alloc(newmem,2048)
label(returnhere)
label(RestoreYourHealth)
label(EnemyHealth)
label(exit)
newmem:
cmp [edi+offset],#
jne EnemyHealth
RestoreYourHealth:
fstp dword ptr [edi+64]
mov dword ptr [edi+64],(float)999.0
fld dword ptr [edi+64]
jmp exit
EnemyHealth:
fstp dword ptr [edi+64]
fld dword ptr [edi+64]
exit:
jmp returnhere
17F50074:
jmp newmem
nop
returnhere:
|
cmp = Compare
jne = Jump if not equal
je = Jump if equal
# = Replace with compare value
Follow this video and you should be good to make Unlimited Health for yourself.
https://www.youtube.com/watch?v=H6eH6eSAL2w&feature=youtu.be&t=9m10s
Edit:
Also can do this, but still need do dissect data structure like above in the link.
Hits Received Counter - Third Ticker
Code: | alloc(newmem,2048)
label(returnhere)
label(RestoreYourHealth)
label(EnemyHealth)
label(exit)
newmem:
cmp [esi+offset],#
jne EnemyHealth
RestoreYourHealth:
fstp dword ptr [esi+64]
mov dword ptr [esi+64],(float)999.0
jmp exit
EnemyHealth:
fstp dword ptr [esi+64]
fldz
exit:
jmp returnhere
17F90F9D:
jmp newmem
returnhere: |
|
|
Back to top |
|
|
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|