Cheat Engine

andyh · How do I cheat? Reputation: 0 Joined: 14 Apr 2015 Posts: 5

Ok, so I promise I'm not an idiot but I couldn't find a solution to this. I did C++ programming as a career, but that was 15+ years ago.

Anyway, here's what I have.

I have a game and I'm trying to decode the memory to write something that will tell me what's in a chest.

Let's assume a chest is an object/struct where I have 10 copies of a smaller object inside it. That looks something like this:

ObjectID: 4 bytes
Quantity: 4 bytes
Bit Flag for something:
Pointer to an object with additional data, in this instance, color: 4 bytes

So repeat that 10 times and I'm looking at the memory viewer, no problem.

However, I want to set a memory address for the pointer in the main cheat engine viewer. If I set the data type to pointer, I get lost, because it's looking for an offset, but what I want is actually way easier than that. I need to tell it, the 4 byte value at 2D324BD8 is just straight up a memory address, and I want it to read the first 4 bytes there. If I wanted the second 4 bytes, I'd setup the offset, sure.

If I try and setup the address though, there doesn't seem to be a way to tell it that I just want it to look at the value at 2D324BD8, treat it as a memory address, and tell me what's there.

It seems like that would be pretty easy to do, but I'm struggling with the UI on how to do it, and the help files didn't clear it up for me.

Thanks, and while I did search, my apologies if this has been answered before.

--Andy

Zanzer · Posted: Tue Apr 14, 2015 7:07 pm Post subject:

Create the following auto assemble script and enable it.

justa_dude · Posted: Tue Apr 14, 2015 7:58 pm Post subject:

I don't understand why you can't just add a 4-byte entry and give it your address. You can optionally choose to have the value displayed in hex. If you'd rather have CE show the value that resides in the address your address holds, then you'd instead add a pointer to 4-byte entry and use an offset of zero.

Also, you should give the data dissector a look. It can make defining and browsing records and linked lists like this a breeze.

Zanzer · Posted: Tue Apr 14, 2015 8:19 pm Post subject:

Well he mentions that there are 10+ copies of the structure. I'm assuming they are all sequential in the memory view. So he wants to create a base pointer and then define those 40+ offset addresses. If he simply added an entry with the base address, he would need to recreate those 40+ addresses every time he reloads the game or finds a new container.

With this custom pointer, he is able to use that to define the address of those 40+ pointers. Now he only needs to set the value of that base pointer and all of the offsets will update appropriately. I'm sure you use base pointers all the time.

We just happen to hook them into the game code so that it automatically updates for us. I guess he's not at that stage yet and wants to continue finding the first value through memory scans and then simply setting his base pointer's value each time.

Yes, the data dissector is basically the same thing, but this is his first post. So I'm guessing he's not that familiar with CE. Smile

Click Memory View
Click Tools > Dissect data/structures
Click Structures > Define new structure
Let CE auto find values or not
You can then add all of your pointer offsets there, setting the base pointer at the top.

andyh · How do I cheat? Reputation: 0 Joined: 14 Apr 2015 Posts: 5

I'm new enough to CE that I'm probably leaving a lot of functionality on the table, not just this. Wink

However, even still I've used it for quite some time just as a really fast, efficient memory scanner because the tools are so good.

I suspect what I'm actually doing I'll end up needing to write a program to handle, because I don't think CE can handle it.

The game I'm scanning is a Minecraft clone. When you generate a new world, it's entirely loaded in memory. So there might be between 10-30 chests on the world, and I know the contents. I'm really only using CE to map out the data structures of each "cell" in the chest where items can be. From there, I'll probably write something that scans for the "chest" object and gets all of the data.

My desire isn't to change any of these values (it would be way easier to do that in sooo many other ways), it's to determine chest loot tables for a wiki.

I haven't had a chance to look at the various answers/options posted here, but I'm about to do that now. Thank you both very much. I'm certain one of the two will get me where I need to go.

--Andy

andyh · How do I cheat? Reputation: 0 Joined: 14 Apr 2015 Posts: 5

Ok, so that was actually way easier than I thought, and I've spent quite a bit of time since then checking out some of the extra tools you guys mentioned.

Basically, the issue I had was that when you manually add a pointer address, it MOVES where you put the base address. I was missing that.

It wasn't until I found the pointer with a different method and then edited it that I saw the syntax of how it was supposed to go in. Oops, oh well.

Now my eyes are bleeding, trying to brute force the next bit and I'm not having much luck.

So I can very easily find the 10 chest item slots for any chest in the game at this point. I've made a structure, and I can find any chest and then line it up with the address for the first slot and see all 10 items in the chest (or empty slots most of the time).

However, I know there are multiple chests on the world, and I know there's an array of chests somewhere in memory that addresses the structure I've made. I know it doesn't address the actual address of the first "loot slot" because that doesn't exist anywhere in memory. So I've tried finding a static pointer to it, and then traversing the intermediate objects and looking at those for anything that might be that array, but man, that's brutally painful.

I also have the item ID of the specific chest I'm looking for, and that limits having to traverse the list of 5 or so offsets for maybe 30 different memory locations, but even still, not having any luck.

I know I can link two structures/objects once I've found the parent object, but I'm really having a hard time finding it.

Could either of you recommend maybe something I'm missing that would make this a bit easier?

--Andy

Zanzer · Posted: Wed Apr 15, 2015 11:18 pm Post subject:

Right-click the Item ID of the chest and select Find out what accesses this address.
Open the chest to trigger the game code.
Trace that instruction backwards and maybe you'll get lucky.
Possibly some instruction like [ecx+ebx*4], where ECX is the address of an array of chests and EBX is the index of the chest you opened.

Also try right-clicking the chest item id and select Pointer scan for this address.
Reload the game, find the new address, and refine the pointer scan.
Once you get a good pointer, see if modifying one of the offsets gets you to a different chest.

andyh · How do I cheat? Reputation: 0 Joined: 14 Apr 2015 Posts: 5

Yeah, I've done pointer scans and most of what you've suggested there. Did forget to mention that if I attach the debugger to the process the game crashes, heh, so that's always helpful. :p

If I get a static pointer to the chest it works (tenuously) at least as long as I'm on the same world and don't move the chest.

I've tried getting my player location, and then using the location (changing it from a float to various other int sizes, since as a character I can exist anywhere within a block) but I'm not seeing that anywhere in the "map" structure. I'm guessing the map is a linked list of some variety so that they don't have to actually store the X, Y, Z of each object in the object itself.

Anyway, thanks for the suggestions. It's very much appreciated. If I make any more progress I'll definitely keep this thread updated in case anyone's curious.

--Andy