Cheat Engine

rsce · How do I cheat? Reputation: 0 Joined: 13 Mar 2022 Posts: 4

In Notepad I am attempting to write "Hello world!" to the contents of a live session by use of an external program. So far I have successfully managed to write the individual characters to memory where the file contents buffer is stored.

However I also need to modify the size of the buffer in order for the text to appear. It is possible to fill in gibberish text to artificially increase the buffer size, and then run the script to replace said text with "Hello world!". But I would like to write to the buffer size so that this step is not necessary.

The issue is with obtaining a static address to the buffer size, as it is dynamically allocated for each new live session. Interestingly it was very easy to find the buffer contents via pointer scan. But the buffer size seems to be elusive, and I am not sure why.

Another approach I attempted was to reverse trace the assembly code to find the origin of the base address written for buffer size. Also to no avail, as after having gone back far enough up the stack trace I found a literal disconnect between processes (one DLL call to another) where the information stored in the register was lost in translation. This might be a whole separate topic, and not one I am eager to pursue at this time.

So back to the pointer scan - what might prevent me from locating a static address? There are always zero results on the second (repeat) pointer scan filter when locating the new address for a follow-on session. I am dealing with 64-bit addresses, so I am sure to yield 8-byte results for each search. Not sure what more to try to get a static address. Any recommendations would be greatly appreciated.

See attached the instructions that get run when the buffer size is modified, if that may be helpful. It at least shows there is a final offset of +10. For clarification, when characters are deleted from the contents buffer the top line gets executed, and when characters are added the bottom line is run.

EDIT:
Attached pointer scan search settings.

Frouk · Posted: Mon Mar 14, 2022 1:27 am Post subject:

just call the function, is it hard for ya?

rsce · How do I cheat? Reputation: 0 Joined: 13 Mar 2022 Posts: 4

ParkourPenguin · Posted: Mon Mar 14, 2022 11:27 am Post subject:

I'm confused by what you're asking. It seems like you already found a buffer that stores the characters drawn to the screen, and you found a pointer path that leads to that address. You say you can't find a pointer path to that buffer's length, but did you even find the address of the buffer's length to begin with?
And do you have any plans to deal with the capacity of the container using that buffer? The program might have initialized the container with a few KiB, but it could resize the buffer later on if needed. You can't just write a larger value to the capacity- that's a buffer overflow. Resizing the buffer correctly isn't an easy thing to do.

You could call one or several functions related to managing the buffer (use ultimap to find it), but that's far easier said than done.

rsce · How do I cheat? Reputation: 0 Joined: 13 Mar 2022 Posts: 4

Foremost thank you for your reply, it's much appreciated.

ParkourPenguin · Posted: Tue Mar 15, 2022 1:01 am Post subject:

rsce · How do I cheat? Reputation: 0 Joined: 13 Mar 2022 Posts: 4

Here are my latest settings.

Though I have tried a plethora of other combinations as well, to no avail. For instance, not including the ending offset, using a lower max level with higher offsets, etc.

At this point I would invite anyone else to perhaps try this same exercise to determine if this is even feasible. To scan for this address is simple - its value is equal to the number of characters displayed. And it can be overwritten to modify the character count. But finding a static address? I wish I knew how...

Thank you for your help, @ParkourPenguin. It may be an oversight, or something else, but I have temporarily given up hope.