Cheat Engine

[STN]

So seems more games are using 64bit these days and even forcing you to use the 64bit version (thief e.g). Seems there isn't much info on trainer-making on 64bit or the search function above is failing me. So does anyone have a basic trainer template that i could look at and figure out the differences.

What i am more interested is in the WPM()/RPM() methods and if there's a change in that, also dll injection. I feel like such a newb and should have done this long ago but better late than never, eh.

[Dark Byte]

Compile your trainer in 64 will show the main issues (warnings and errors by the compiler)
Also, read the msdn about the api's you use.
Dont typecast pointers to dword, but to UINT_PTR (or QWORD if you know it's going to be 64 bit)

Also, dll injection is a bit different.
First read http://msdn.microsoft.com/en-us/library/ms235286.aspx
It explains how to do function calls

In short: allocate stackspace for at least 4 parameters (even if the function takes less)
And fill in the first 4 parameters in rcx,rdx,r8 and r9(floats get added to xmm0,xmm1,xmm2 and xmm3)
If you need more than 4 parameters allocate more stack and fill in the extra stack slots with the value)
And the rsp register must be aligned on a 16 byte boundary before the call instruction is executed.
Keep in mind that when a function is called, including createremotethread, the return address is pushed on the stack(8 bytes). This means the stack is misaligned on function entry. So when setting up the stack for a function call, keep that in mind (decrease rsp with 8 to fix that)

Another issue is that relative jumps can only do 32-bit distances (still 5 byte)
This can be problematic for code injections if you blindly allocate. Luckily VirtualAllocEx lets you specify the location to allocate, so you can allocate nearby the code you're hooking. But it has a few rules
1: The location must not be in use
2: The address must be aligned on the allocation granularity of the os (windows 7 is 64KB)

Alternatively, you could use an construction like this, which takes way more bytes:

[kik4444]

If you're generating a trainer through CE, I think there was an option to target 64-bit

[STN]

[++METHOS]