Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


How can I completely lock these values?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
ExiMaster
How do I cheat?
Reputation: 0

Joined: 27 Nov 2016
Posts: 3

PostPosted: Sun Nov 27, 2016 10:13 pm    Post subject: How can I completely lock these values? Reply with quote

Hey all, I currently playing a game that uses a graphical bar for health. 0 is the minimum and 1116471296 is full health / full bar. When you get hit 3 times when the value is 0 you die. Let's just say combat can get pretty rough since it's a bullet hell / AoE spam game and setting the refresh rate to 10ms for freezing the value does not help in certain situations failing the whole level.

I did a scan of 1116471296 (4 Bytes) and found 1 static address and a whole bunch of other dynamic addresses you could inherit based on the level you are playing. Is there a way I could lock the value permanetly from even being written to so when I get hit the value does not change at all such as for example God Mode plugins in games where health is not affected and stays at the max value?

I have attached a screen shot of my scan for an example. I placed 2 addresses in the list. Active Health is the current address the level is using for my health bar. Static Address is the only green result on the top.

Thanks for any help!



capture.JPG
 Description:
 Filesize:  137.96 KB
 Viewed:  17462 Time(s)

capture.JPG


Back to top
View user's profile Send private message
BanCheese
Cheater
Reputation: 0

Joined: 22 Oct 2014
Posts: 49

PostPosted: Sun Nov 27, 2016 11:12 pm    Post subject: Reply with quote

That's not a 4 byte -- it's a float. 1116471296 == 0x428C000 == 70.0.

Most of those values are probably used for other things. Try to narrow them down a bit more. Freezing all of them right now would probably result in a crash.

The static address may already be what you're looking for. To do a "weak" freeze, just click on that box in the lower left of the screenshot -- a red X should appear inside it. I say "weak" in that this will simply reset the value to its current state several times a second. However, if you happen to take three hits faster than it can refresh, you may need to nop out the code that's writing to it. If that's the case, reply in this thread and I can walk you through it.

If you haven't already done it, I'd highly recommend the Cheat Engine tutorial, found in the same directory where you installed Cheat Engine.

_________________
A guy who likes memory hacking.
Back to top
View user's profile Send private message
ExiMaster
How do I cheat?
Reputation: 0

Joined: 27 Nov 2016
Posts: 3

PostPosted: Mon Nov 28, 2016 12:19 am    Post subject: Reply with quote

Ah, you are correct, I have located the float value and froze that giving similar results to freezing the 1116471296 value too.

I have done the tutorial enough to fully understand finding any value I want scanning and whatnot. Just not advanced manipulation like the hex editing and code injection. I keep crashing the game.

But yeah if you could walk me through of a simple string that could nop out the code as you say that would be perfect. Maybe even finding the pointer for the float since I was on the wrong thing. I've tried many tutorial videos on how to get the pointer but just end up with thousands of results containing the same value in hex.

I don't know if this helps but the health bar has 4 different 'tickers' you could say on it. The first line constantly ticks forever throughout the level. The second line is just like the first (ticks slightly slower per second than first) but stops ticking when you get hit, then continues ticking after 3 seconds when you start regenerating health (assuming you don't get hit again). The third line indicates how many times you were hit throughout the whole level. The fourth line indicates how many times the enemy has brought your health (in the game it's called the shield) to 0. If you get hit 3 times at 0 health/shield in this mode you die or start regenerating again in 3 seconds if not hit.

Thanks again for your time!



capture2.JPG
 Description:
 Filesize:  30 KB
 Viewed:  17442 Time(s)

capture2.JPG


Back to top
View user's profile Send private message
Lithium.
Newbie cheater
Reputation: 1

Joined: 21 Jan 2015
Posts: 17

PostPosted: Mon Nov 28, 2016 12:39 am    Post subject: Reply with quote

The 4th address being accessed is what you want most likely. Highlight it, and click "Show disassembler". Show us the area where the code breaks.
Back to top
View user's profile Send private message
BanCheese
Cheater
Reputation: 0

Joined: 22 Oct 2014
Posts: 49

PostPosted: Mon Nov 28, 2016 12:44 am    Post subject: Reply with quote

Ah, yes, a simple nop won't work here -- the x87 FPU maintains an internal "stack" of registers (it's really bad; nobody really likes it). For the FPU instructions that "pop" the stack, you need to preserve that poping operation. The simplest way of doing that is to use
Code:
fstp st(0)

Which is a
Code:
f     - floating point
st    - store
p     - and pop

st(0) - into st(0), which is the current top of the stack

So essentially, this just moves the register into itself and then pops the stack.

You can think of it as
Code:
mov [esp], [esp] //this isn't a valid instruction, but whatever
add esp, 4


Try replacing each one of those instructions (one at a time, restarting if it crashes) with an fstp st(0) (be sure to say "yes" when asked whether or not to replace incomplete opcodes with NOPs).

If none of those modifications work, that's probably just a display value. Try filtering down the list of potential addresses a bit more and then fstp st(0)'ing their modifiers.

_________________
A guy who likes memory hacking.
Back to top
View user's profile Send private message
Betcha
Expert Cheater
Reputation: 4

Joined: 13 Aug 2015
Posts: 232
Location: Somewhere In Space

PostPosted: Mon Nov 28, 2016 2:36 am    Post subject: Reply with quote

First with most count, reads your health constantly, it would be the best place to do injection.
Cause if make any changes it will change your health instantly without getting any damage.
Can do inection and change in something like this:
Code:
fstp dword ptr [edi+64]
mov dword ptr [edi+64],(float)999.0


Second would be bad injection cause like you said it reads health till you get hit.
If do any changes, it would affect only on health regeneration.

Third is good place to do injection as well.
Cause if make any changes it would stop damage when enemies hit you.
Can do injection and change like BanCheese said:
Code:
fstp dword ptr [edi+64]
fstp st(0)


With fourth sounds like you can cheat the death.
By Nop that instruction, would make game think that you are alive.
While in real time health / shield is down and you would be dead.
Code:
fstp dword ptr [edi+64]
fstp st(0)
Back to top
View user's profile Send private message
ExiMaster
How do I cheat?
Reputation: 0

Joined: 27 Nov 2016
Posts: 3

PostPosted: Mon Nov 28, 2016 8:52 pm    Post subject: Reply with quote

I have all the code for each ticker in respective order from my last post. Ill trying tweaking with them based off the replies. Thanks for so many replies! These are the 4 codes I will be variously adjusting then injecting.

EDIT:I have injected the codes Betcha has posted. The code mod for the constant health ticker worked aside from one side effect. Enemies get the invulnerability too. So it works, but doesn't, but really freaking close.

The code mod the Hit Counter just makes you die instantly upon being hit by anything but the health bar does not budge.

The code mod for the Shield Down causes the game to crash as soon as you kill an enemy.


Constant Health Ticker - First Ticker
Code:
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fstp dword ptr [edi+64]
fld dword ptr [edi+64]

exit:
jmp returnhere

17F50074:
jmp newmem
nop
returnhere:



Health Regen Ticker - Second Ticker
Code:
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fstp dword ptr [edi+64]
fld dword ptr [ebp-08]

exit:
jmp returnhere

17F500A5:
jmp newmem
nop
returnhere:



Hits Received Counter - Third Ticker
Code:
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fstp dword ptr [esi+64]
fldz

exit:
jmp returnhere

17F90F9D:
jmp newmem
returnhere:



Shield Down Counter - Fourth Ticker
Code:
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
fstp dword ptr [esi+64]
fld dword ptr [ebp+0C]

exit:
jmp returnhere

17F90FB4:
jmp newmem
nop
returnhere:

Back to top
View user's profile Send private message
Betcha
Expert Cheater
Reputation: 4

Joined: 13 Aug 2015
Posts: 232
Location: Somewhere In Space

PostPosted: Tue Nov 29, 2016 1:27 am    Post subject: Reply with quote

ExiMaster wrote:
The code mod for the constant health ticker worked aside from one side effect. Enemies get the invulnerability too.


Constant Health Ticker - First Ticker
Code:
alloc(newmem,2048)
label(returnhere)
label(RestoreYourHealth)
label(EnemyHealth)
label(exit)

newmem:
  cmp [edi+offset],#
  jne EnemyHealth

RestoreYourHealth:
  fstp dword ptr [edi+64]
  mov dword ptr [edi+64],(float)999.0
  fld dword ptr [edi+64]
  jmp exit

EnemyHealth:
fstp dword ptr [edi+64]
fld dword ptr [edi+64]

exit:
jmp returnhere

17F50074:
jmp newmem
nop
returnhere:


cmp = Compare
jne = Jump if not equal
je = Jump if equal
# = Replace with compare value

Follow this video and you should be good to make Unlimited Health for yourself.
https://www.youtube.com/watch?v=H6eH6eSAL2w&feature=youtu.be&t=9m10s


Edit:
Also can do this, but still need do dissect data structure like above in the link.

Hits Received Counter - Third Ticker

Code:
alloc(newmem,2048)
label(returnhere)
label(RestoreYourHealth)
label(EnemyHealth)
label(exit)

newmem:
  cmp [esi+offset],#
  jne EnemyHealth

RestoreYourHealth:
  fstp dword ptr [esi+64]
  mov dword ptr [esi+64],(float)999.0
  jmp exit

EnemyHealth:
fstp dword ptr [esi+64]
fldz

exit:
jmp returnhere

17F90F9D:
jmp newmem
returnhere:
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites