Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


what to do now
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
yadungon
Cheater
Reputation: 0

Joined: 20 Jul 2008
Posts: 35

PostPosted: Sun Aug 10, 2008 5:25 am    Post subject: what to do now Reply with quote

in this game there this bar line that decrease everyday, it mean the people courage. i have to go to town to full it up and to do it i have to give up all my gold,goods,and ships.i can freeze the bar but everytime i start the game address wouldnt work so the address is random. i try what write to this in the ce it came up with 4 thing and i didnt learn it in the Tutorials.i search in ce forum and there this group that make a trainer but it not what i wanted it only give you max $$ and another i forgot.









you can see the address in the last 2 image is different because in the top i want to know what the base pointer is so i use ce search base pointer and game crash so i have to start over

Back to top
View user's profile Send private message
Pingo
Grandmaster Cheater
Reputation: 8

Joined: 12 Jul 2007
Posts: 571

PostPosted: Sun Aug 10, 2008 7:40 pm    Post subject: Reply with quote

Try this

[enable]
00451ae2:
db 90 90 90

[disable]
00451ae2:
db 89 46 54

_________________
Back to top
View user's profile Send private message
yadungon
Cheater
Reputation: 0

Joined: 20 Jul 2008
Posts: 35

PostPosted: Sun Aug 10, 2008 9:04 pm    Post subject: Reply with quote

how to do that?
Back to top
View user's profile Send private message
Pingo
Grandmaster Cheater
Reputation: 8

Joined: 12 Jul 2007
Posts: 571

PostPosted: Mon Aug 11, 2008 1:24 am    Post subject: Reply with quote

press Ctrl+Alt+a
that brings up the auto assembler box. copy that script into it.
Then click file, and (assign to current cheat table)

Tick the box to enable it. See if that works for yah.

_________________
Back to top
View user's profile Send private message
MRDB512
Advanced Cheater
Reputation: 0

Joined: 31 Aug 2007
Posts: 60

PostPosted: Mon Aug 11, 2008 4:56 pm    Post subject: Reply with quote

Pingo Wrote:
Quote:

PostPosted: Sun Aug 10, 2008 7:40 pm Post subject:
Try this

[enable]
00451ae2:
db 90 90 90

[disable]
00451ae2:
db 89 46 54


Nicely put!

This is my first post at give advice so, please bear with me!
English is not my first language!
Right then Arrow
----------------------------------------

yadungon)) I know what you have done,
you have set the find out what writes to this address
and then continued to play the game! LOL! Wink
cos of the day for value to change factor!

What I suggest is you do, a new DMA value find address
right-Click Find out what writes to this address
if in window mode:
do nothing and let the Bar Value fall by 1 or more
if in fullscreen:
click game, wait for as long as it takes for the value to decrease

then ALT-TAB(or windows mode)(or dxwnd)

are you running this in a window or fullscreen??


then you should only have one and that one would be the SUB one

and post that one
also you need to display more code!
to do this |memory view| > Right-Click > GO TO address 004519bf
move up a page from this address

Click File > Save disassembled output >
enter 00451bb2 in the 2nd box
save to desktop, post this code under

Code:

 [code]
   your file data.txt
 [/code]


hover your mouse over the tab Code at the top of the screen
to get the syntax

What you want to do is
use option Find out what read from this address,

dont do anything in the game, and can you get it in to window mode
if not try using DXwnd [by doomsday] = google it

What it does is, you want your value to go up on get set on a value instantly
so when you click [enable] box [ ]

example abit about what the game does
[list]
right you have two codes the game use

one for increasing the value when you go to town
and one decreasing when not in town
one day that a long wait for the value to change
Note: you cant play the game and want to find the right value at the same time
CE only says yah that address got written to from there,
and so on!, so you could end up with 2 or more!
so wait for the value the decrease with the find out what read from
Post that, the code is simple
Code:

mov cl,63
mov [esi+54],cl
mov cl,01 or try 00

Done!
once you found the address along with the extra info (window) data REG and posted it!
Like you did in PIC form!
with the read from address, one page up and one page down, with Save Disassembled Output option!
should do the trick! Cool
from what you said!

you want to find the one that is decreasing your value
but you dont want to wait for it to write sub value to this address
so use read from this address
the first one is normally the correct one!

Write REF:
so when game reads address, that is where you should auto Asmemble it

also notice the SUB eax, edi

also notice ecx = 00000001
ecx = counter

so try...changing this to ecx,00000000
the best code for that is mov cl,00

try replacing this
004519c4 sub eax,edi
with
004519c4 mov eax,eax
to freeze the value
or
004519c4 add eax,edi
to increase the value, but the game would probably crash! with this option!


you can also try to hack the DMA by using a alloc memory

THIS IS WHAT YOU WANT Cos from your post you dont like using scripts
so all you need to do it set a script and forget about it!

[esi+54] is pointer
Eax or ebx is value
ecx = counter, and somewhere dec ecx

inject code at any of the opcode you posted!
with templete 1
so Ctrl+A = Auto assemble window
Template = Select 1 Code injection
where alloc is add new one called newmem1
this is the DMA fix address
in CE add new address newmem1+54 = pointer
so store esi in newmem1

here is a code example
Code:

//will be using 00451a8F for this example

alloc(newmem1,2048)
alloc(newmem,2048)
label(returnhere)
label(orginialcode)
label(exit)

newmem1:
db 00 00 00 00 00 00 00 00

00451a8F:
jmp newmem
returnhere:

newmem:

orginialcode:
mov [newmem1],esi
test edi,edi
mov [esi+54],ecx

exit:
jmp returnhere


Ref: DARK-BYTE did a great example of the above!
in some previous posts!


|Memory view| > TOOLS > Auto assemble
but first find which mov [esi+54] you want to work with

what you are looking for is a TEST opcode
and try using find out what reads from this address

now right - click and select Break and Trace instructions

now go back into your game do something which reads your value bar


now look at all the Registers(right side), and try and find your value
it will be in hex, so get your Start > RUn > Calc ----ready
then look for where to code writes the value

but if noping the last address found then thats cool
but if not then post some more code
Back to top
View user's profile Send private message
yadungon
Cheater
Reputation: 0

Joined: 20 Jul 2008
Posts: 35

PostPosted: Wed Aug 13, 2008 9:56 pm    Post subject: Reply with quote

@Pingo= i think you make it think i have food on the ship,i forgot to tell something when there food on the ship everyday the amount decrease will be smaller than those dont have food on the ship.even if it decrease smaller one day it will still run out.i use your idea and try all another three and it didnt work.especially 00451a91

[enable]
00451a91:
db 90 90 90

[disable]
00451a91:
db 89 46 54

the bar became empty

@MRDB512= im running in fullscreen.

are you worrying about when im in the ce that the bar will countine decrease if so then you dont have to worry about it because i can pause the game on the the sea and that the only time bar will decrease, when im in a town it wouldnt.

Quote:
one for increasing the value when you go to town
it dont increase when im simply go to town. it increase to full when i click on a treasure ceast that give everything i have away.

after the word "Done!" you completely lose me.but i understand this THIS IS WHAT YOU WANT Cos from your post you dont like using scripts
nope not that i dont like scripts it that i dont have experience with them but i want to learn them.
what is you can also try to hack the DMA by using a alloc memory

when i do what writes to this address it have 4 came out for each of the address and they all the same.



now each of the below image have # and it code is below them
1

Code:
0045197E - 66 89 ae 86 01 00 00       - mov [esi+00000186],ebp
00451985 - 33 ed                      - xor ebp,ebp
00451987 - 0f bf df                   - movsx ebx,di
0045198A - 0f bf c5                   - movsx eax,bp
0045198D - 8b cb                      - mov ecx,ebx
0045198F - 89 5c 24 1c                - mov [esp+1c],ebx
00451993 - 2b c8                      - sub ecx,eax
00451995 - 8b c1                      - mov eax,ecx
00451997 - c1 e0 04                   - shl eax,04
0045199A - 03 c1                      - add eax,ecx
0045199C - c1 e0 04                   - shl eax,04
0045199F - 03 c1                      - add eax,ecx
004519A1 - c1 e0 04                   - shl eax,04
004519A4 - 03 c1                      - add eax,ecx
004519A6 - 33 c9                      - xor ecx,ecx
004519A8 - 8d 04 40                   - lea eax,[eax+eax*2]
004519AB - 03 c0                      - add eax,eax
004519AD - 99                         - cdq
004519AE - f7 fb                      - idiv ebx
004519B0 - 8b 5e 54                   - mov ebx,[esi+54]
004519B3 - 03 d8                      - add ebx,eax
004519B5 - 66 8b 86 84 01 00 00       - mov ax,[esi+00000184]
004519BC - 66 3b c1                   - cmp ax,cx
004519BF - 89 5e 54                   - mov [esi+54],ebx
004519C2 - 7e 1d                      - jle 004519e1
004519C4 - 2b c7                      - sub eax,edi
004519C6 - 66 3b c1                   - cmp ax,cx
004519C9 - 66 89 86 84 01 00 00       - mov [esi+00000184],eax
004519D0 - 7d 0d                      - jnl 004519df
004519D2 - f7 d8                      - neg eax
004519D4 - 8b f8                      - mov edi,eax
004519D6 - 66 89 8e 84 01 00 00       - mov [esi+00000184],ecx
004519DD - eb 02                      - jmp 004519e1
004519DF - 33 ff                      - xor edi,edi
004519E1 - 89 4c 24 20                - mov [esp+20],ecx
004519E5 - c7 44 24 24 03 00 00 00    - mov [esp+24],00000003
004519ED - c7 44 24 28 01 00 00 00    - mov [esp+28],00000001
004519F5 - c7 44 24 2c 02 00 00 00    - mov [esp+2c],00000002
004519FD - 8d 6c 24 20                - lea ebp,[esp+20]
00451A01 - c7 44 24 14 04 00 00 00    - mov [esp+14],00000004
00451A09 - 8b 4d 00                   - mov ecx,[ebp+00]
00451A0C - 8b 84 8e 9c 00 00 00       - mov eax,[esi+ecx*4+0000009c]
00451A13 - 8d 9c 8e 9c 00 00 00       - lea ebx,[esi+ecx*4+0000009c]
00451A1A - 3d e8 03 00 00             - cmp eax,000003e8
00451A1F - 7c 35                      - jnge 00451a56
00451A21 - 66 85 ff                   - test di,di
00451A24 - 7e 30                      - jle 00451a56
00451A26 - 8a 55 00                   - mov dl,[ebp+00]
00451A29 - 68 e8 03 00 00             - push 000003e8
00451A2E - 52                         - push edx
00451A2F - 8b ce                      - mov ecx,esi
00451A31 - e8 fa f1 ff ff             - call 00450c30
00451A36 - 81 ef e8 03 00 00          - sub edi,000003e8
00451A3C - 66 85 ff                   - test di,di
00451A3F - 7c 0a                      - jnge 00451a4b
00451A41 - 81 3b e8 03 00 00          - cmp [ebx],000003e8
00451A47 - 7d d8                      - jnl 00451a21
00451A49 - eb 0b                      - jmp 00451a56
00451A4B - f7 df                      - neg edi
00451A4D - 66 89 be 84 01 00 00       - mov [esi+00000184],edi
00451A54 - 33 ff                      - xor edi,edi
00451A56 - 8b 44 24 14                - mov eax,[esp+14]
00451A5A - 83 c5 04                   - add ebp,04
00451A5D - 48                         - dec eax
00451A5E - 89 44 24 14                - mov [esp+14],eax
00451A62 - 75 a5                      - jne 00451a09
00451A64 - 0f bf c7                   - movsx eax,di
00451A67 - 8b 7c 24 1c                - mov edi,[esp+1c]
00451A6B - 8b cf                      - mov ecx,edi
00451A6D - 2b c8                      - sub ecx,eax
00451A6F - 8b c1                      - mov eax,ecx
00451A71 - c1 e0 04                   - shl eax,04
00451A74 - 03 c1                      - add eax,ecx
00451A76 - c1 e0 04                   - shl eax,04
00451A79 - 03 c1                      - add eax,ecx
00451A7B - c1 e0 04                   - shl eax,04
00451A7E - 03 c1                      - add eax,ecx
00451A80 - 8b 4e 54                   - mov ecx,[esi+54]
00451A83 - 8d 04 c0                   - lea eax,[eax+eax*8]
00451A86 - 99                         - cdq
00451A87 - f7 ff                      - idiv edi
00451A89 - 8b 7c 24 18                - mov edi,[esp+18]
00451A8D - 03 c8                      - add ecx,eax
00451A8F - 85 ff                      - test edi,edi
00451A91 - 89 4e 54                   - mov [esi+54],ecx
00451A94 - 74 40                      - je 00451ad6
00451A96 - 6a 00                      - push 00
00451A98 - 8b cf                      - mov ecx,edi
00451A9A - e8 21 c5 fe ff             - call 0043dfc0
00451A9F - 25 ff 00 00 00             - and eax,000000ff
00451AA4 - 8b 5e 54                   - mov ebx,[esi+54]
00451AA7 - c1 e0 10                   - shl eax,10
00451AAA - 8b c8                      - mov ecx,eax
00451AAC - b8 99 99 99 99             - mov eax,99999999
00451AB1 - f7 e9                      - imul ecx
00451AB3 - c1 fa 02                   - sar dl,02
00451AB6 - 8b ca                      - mov ecx,edx
00451AB8 - c1 e9 1f                   - shr ecx,1f
00451ABB - 03 d1                      - add edx,ecx
00451ABD - 03 da                      - add ebx,edx
00451ABF - 89 5e 54                   - mov [esi+54],ebx
00451AC2 - 8a 8f 15 01 00 00          - mov cl,[edi+00000115]
00451AC8 - f6 c1 02                   - test cl,02
00451ACB - 8b c3                      - mov eax,ebx
00451ACD - 74 07                      - je 00451ad6
00451ACF - 05 00 00 fe ff             - add eax,fffe0000
00451AD4 - eb 08                      - jmp 00451ade
00451AD6 - 8b 46 54                   - mov eax,[esi+54]
00451AD9 - 05 00 80 fd ff             - add eax,fffd8000
00451ADE - 5f                         - pop edi
00451ADF - 5d                         - pop ebp
00451AE0 - 85 c0                      - test eax,eax
00451AE2 - 89 46 54                   - mov [esi+54],eax
00451AE5 - 5b                         - pop ebx
00451AE6 - 7d 07                      - jnl 00451aef
00451AE8 - c7 46 54 00 00 00 00       - mov [esi+54],00000000
00451AEF - 8a 46 56                   - mov al,[esi+56]
00451AF2 - 3c 64                      - cmp al,64
00451AF4 - 7f 40                      - jg 00451b36
00451AF6 - 84 c0                      - test al,al
00451AF8 - 7c 07                      - jnge 00451b01
00451AFA - 0f be c0                   - movsx eax,al
00451AFD - 3c 14                      - cmp al,14
00451AFF - 7d 35                      - jnl 00451b36
00451B01 - 80 7c 24 07 14             - cmp byte ptr [esp+07],14
00451B06 - 7c 2e                      - jnge 00451b36
00451B08 - 8a 15 28 73 60 00          - mov dl,[00607328] : 60
00451B0E - 68 ff ff 00 00             - push 0000ffff
00451B13 - 6a ff                      - push ff
00451B15 - 6a ff                      - push ff
00451B17 - 52                         - push edx
00451B18 - 6a 14                      - push 14
00451B1A - b9 b0 5f 60 00             - mov ecx,00605fb0
00451B1F - e8 4c 9f 03 00             - call 0048ba70
00451B24 - 6a 00                      - push 00
00451B26 - 6a 00                      - push 00
00451B28 - 6a 00                      - push 00
00451B2A - 6a 21                      - push 21
00451B2C - b9 b0 5f 60 00             - mov ecx,00605fb0
00451B31 - e8 aa a9 03 00             - call 0048c4e0
00451B36 - 8b 46 54                   - mov eax,[esi+54]
00451B39 - 85 c0                      - test eax,eax
00451B3B - 75 07                      - jne 00451b44
00451B3D - 8b ce                      - mov ecx,esi
00451B3F - e8 9c 00 00 00             - call 00451be0
00451B44 - 5e                         - pop esi
00451B45 - 83 c4 20                   - add esp,20
00451B48 - c3                         - ret
00451B49 - 90                         - nop
00451B4A - 90                         - nop
00451B4B - 90                         - nop
00451B4C - 90                         - nop
00451B4D - 90                         - nop
00451B4E - 90                         - nop
00451B4F - 90                         - nop
00451B50 - 83 ec 08                   - sub esp,08
00451B53 - 56                         - push esi
00451B54 - 8b f1                      - mov esi,ecx
00451B56 - 80 be 91 00 00 00 01       - cmp byte ptr [esi+00000091],01
00451B5D - 75 6b                      - jne 00451bca
00451B5F - 8b 86 80 01 00 00          - mov eax,[esi+00000180]
00451B65 - f6 c4 08                   - test ah,08
00451B68 - 74 0e                      - je 00451b78
00451B6A - c7 46 54 ff ff 64 00       - mov [esi+54],_stl::basic_string<char,_stl::char_traits<char>,_stl::allocator<char> >::_m_range_initialize+1f
00451B71 - 5e                         - pop esi
00451B72 - 83 c4 08                   - add esp,08
00451B75 - c2 04 00                   - ret 0004
00451B78 - 0f bf 46 74                - movsx eax,word ptr [esi+74]
00451B7C - 99                         - cdq
00451B7D - 8b c8                      - mov ecx,eax
00451B7F - 8b 44 24 10                - mov eax,[esp+10]
00451B83 - 57                         - push edi
00451B84 - 8b fa                      - mov edi,edx
00451B86 - 99                         - cdq
00451B87 - 0f a4 c2                   - shld edx,eax
00451B8A - 10 57 51                   - adc [edi+51],dl
00451B8D - c1 e0 10                   - shl eax,10
00451B90 - 52                         - push edx
00451B91 - 50                         - push eax
00451B92 - e8 49 6c 15 00             - call 005a87e0
00451B97 - 85 d2                      - test edx,edx
00451B99 - 5f                         - pop edi
00451B9A - 7c 16                      - jnge 00451bb2
00451B9C - 7f 07                      - jg 00451ba5
00451B9E - 3d 00 00 64 00             - cmp eax,_stl::basic_ostream<char,_stl::char_traits<char> >::_m_put_widen_aux+20
00451BA3 - 76 0d                      - jna 00451bb2
00451BA5 - b8 00 00 64 00             - mov eax,_stl::basic_ostream<char,_stl::char_traits<char> >::_m_put_widen_aux+20
00451BAA - c7 44 24 08 00 00 00 00    - mov [esp+08],00000000

2

Code:
00451972 - 39 9e ac 00 00 00          - cmp [esi+000000ac],ebx
00451978 - 7d e2                      - jnl 0045195c
0045197A - eb 0b                      - jmp 00451987
0045197C - f7 dd                      - neg ebp
0045197E - 66 89 ae 86 01 00 00       - mov [esi+00000186],ebp
00451985 - 33 ed                      - xor ebp,ebp
00451987 - 0f bf df                   - movsx ebx,di
0045198A - 0f bf c5                   - movsx eax,bp
0045198D - 8b cb                      - mov ecx,ebx
0045198F - 89 5c 24 1c                - mov [esp+1c],ebx
00451993 - 2b c8                      - sub ecx,eax
00451995 - 8b c1                      - mov eax,ecx
00451997 - c1 e0 04                   - shl eax,04
0045199A - 03 c1                      - add eax,ecx
0045199C - c1 e0 04                   - shl eax,04
0045199F - 03 c1                      - add eax,ecx
004519A1 - c1 e0 04                   - shl eax,04
004519A4 - 03 c1                      - add eax,ecx
004519A6 - 33 c9                      - xor ecx,ecx
004519A8 - 8d 04 40                   - lea eax,[eax+eax*2]
004519AB - 03 c0                      - add eax,eax
004519AD - 99                         - cdq
004519AE - f7 fb                      - idiv ebx
004519B0 - 8b 5e 54                   - mov ebx,[esi+54]
004519B3 - 03 d8                      - add ebx,eax
004519B5 - 66 8b 86 84 01 00 00       - mov ax,[esi+00000184]
004519BC - 66 3b c1                   - cmp ax,cx
004519BF - 89 5e 54                   - mov [esi+54],ebx
004519C2 - 7e 1d                      - jle 004519e1
004519C4 - 2b c7                      - sub eax,edi
004519C6 - 66 3b c1                   - cmp ax,cx
004519C9 - 66 89 86 84 01 00 00       - mov [esi+00000184],eax
004519D0 - 7d 0d                      - jnl 004519df
004519D2 - f7 d8                      - neg eax
004519D4 - 8b f8                      - mov edi,eax
004519D6 - 66 89 8e 84 01 00 00       - mov [esi+00000184],ecx
004519DD - eb 02                      - jmp 004519e1
004519DF - 33 ff                      - xor edi,edi
004519E1 - 89 4c 24 20                - mov [esp+20],ecx
004519E5 - c7 44 24 24 03 00 00 00    - mov [esp+24],00000003
004519ED - c7 44 24 28 01 00 00 00    - mov [esp+28],00000001
004519F5 - c7 44 24 2c 02 00 00 00    - mov [esp+2c],00000002
004519FD - 8d 6c 24 20                - lea ebp,[esp+20]
00451A01 - c7 44 24 14 04 00 00 00    - mov [esp+14],00000004
00451A09 - 8b 4d 00                   - mov ecx,[ebp+00]
00451A0C - 8b 84 8e 9c 00 00 00       - mov eax,[esi+ecx*4+0000009c]
00451A13 - 8d 9c 8e 9c 00 00 00       - lea ebx,[esi+ecx*4+0000009c]
00451A1A - 3d e8 03 00 00             - cmp eax,000003e8
00451A1F - 7c 35                      - jnge 00451a56
00451A21 - 66 85 ff                   - test di,di
00451A24 - 7e 30                      - jle 00451a56
00451A26 - 8a 55 00                   - mov dl,[ebp+00]
00451A29 - 68 e8 03 00 00             - push 000003e8
00451A2E - 52                         - push edx
00451A2F - 8b ce                      - mov ecx,esi
00451A31 - e8 fa f1 ff ff             - call 00450c30
00451A36 - 81 ef e8 03 00 00          - sub edi,000003e8
00451A3C - 66 85 ff                   - test di,di
00451A3F - 7c 0a                      - jnge 00451a4b
00451A41 - 81 3b e8 03 00 00          - cmp [ebx],000003e8
00451A47 - 7d d8                      - jnl 00451a21
00451A49 - eb 0b                      - jmp 00451a56
00451A4B - f7 df                      - neg edi
00451A4D - 66 89 be 84 01 00 00       - mov [esi+00000184],edi
00451A54 - 33 ff                      - xor edi,edi
00451A56 - 8b 44 24 14                - mov eax,[esp+14]
00451A5A - 83 c5 04                   - add ebp,04
00451A5D - 48                         - dec eax
00451A5E - 89 44 24 14                - mov [esp+14],eax
00451A62 - 75 a5                      - jne 00451a09
00451A64 - 0f bf c7                   - movsx eax,di
00451A67 - 8b 7c 24 1c                - mov edi,[esp+1c]
00451A6B - 8b cf                      - mov ecx,edi
00451A6D - 2b c8                      - sub ecx,eax
00451A6F - 8b c1                      - mov eax,ecx
00451A71 - c1 e0 04                   - shl eax,04
00451A74 - 03 c1                      - add eax,ecx
00451A76 - c1 e0 04                   - shl eax,04
00451A79 - 03 c1                      - add eax,ecx
00451A7B - c1 e0 04                   - shl eax,04
00451A7E - 03 c1                      - add eax,ecx
00451A80 - 8b 4e 54                   - mov ecx,[esi+54]
00451A83 - 8d 04 c0                   - lea eax,[eax+eax*8]
00451A86 - 99                         - cdq
00451A87 - f7 ff                      - idiv edi
00451A89 - 8b 7c 24 18                - mov edi,[esp+18]
00451A8D - 03 c8                      - add ecx,eax
00451A8F - 85 ff                      - test edi,edi
00451A91 - 89 4e 54                   - mov [esi+54],ecx
00451A94 - 74 40                      - je 00451ad6
00451A96 - 6a 00                      - push 00
00451A98 - 8b cf                      - mov ecx,edi
00451A9A - e8 21 c5 fe ff             - call 0043dfc0
00451A9F - 25 ff 00 00 00             - and eax,000000ff
00451AA4 - 8b 5e 54                   - mov ebx,[esi+54]
00451AA7 - c1 e0 10                   - shl eax,10
00451AAA - 8b c8                      - mov ecx,eax
00451AAC - b8 99 99 99 99             - mov eax,99999999
00451AB1 - f7 e9                      - imul ecx
00451AB3 - c1 fa 02                   - sar dl,02
00451AB6 - 8b ca                      - mov ecx,edx
00451AB8 - c1 e9 1f                   - shr ecx,1f
00451ABB - 03 d1                      - add edx,ecx
00451ABD - 03 da                      - add ebx,edx
00451ABF - 89 5e 54                   - mov [esi+54],ebx
00451AC2 - 8a 8f 15 01 00 00          - mov cl,[edi+00000115]
00451AC8 - f6 c1 02                   - test cl,02
00451ACB - 8b c3                      - mov eax,ebx
00451ACD - 74 07                      - je 00451ad6
00451ACF - 05 00 00 fe ff             - add eax,fffe0000
00451AD4 - eb 08                      - jmp 00451ade
00451AD6 - 8b 46 54                   - mov eax,[esi+54]
00451AD9 - 05 00 80 fd ff             - add eax,fffd8000
00451ADE - 5f                         - pop edi
00451ADF - 5d                         - pop ebp
00451AE0 - 85 c0                      - test eax,eax
00451AE2 - 89 46 54                   - mov [esi+54],eax
00451AE5 - 5b                         - pop ebx
00451AE6 - 7d 07                      - jnl 00451aef
00451AE8 - c7 46 54 00 00 00 00       - mov [esi+54],00000000
00451AEF - 8a 46 56                   - mov al,[esi+56]
00451AF2 - 3c 64                      - cmp al,64
00451AF4 - 7f 40                      - jg 00451b36
00451AF6 - 84 c0                      - test al,al
00451AF8 - 7c 07                      - jnge 00451b01
00451AFA - 0f be c0                   - movsx eax,al
00451AFD - 3c 14                      - cmp al,14
00451AFF - 7d 35                      - jnl 00451b36
00451B01 - 80 7c 24 07 14             - cmp byte ptr [esp+07],14
00451B06 - 7c 2e                      - jnge 00451b36
00451B08 - 8a 15 28 73 60 00          - mov dl,[00607328] : 60
00451B0E - 68 ff ff 00 00             - push 0000ffff
00451B13 - 6a ff                      - push ff
00451B15 - 6a ff                      - push ff
00451B17 - 52                         - push edx
00451B18 - 6a 14                      - push 14
00451B1A - b9 b0 5f 60 00             - mov ecx,00605fb0
00451B1F - e8 4c 9f 03 00             - call 0048ba70
00451B24 - 6a 00                      - push 00
00451B26 - 6a 00                      - push 00
00451B28 - 6a 00                      - push 00
00451B2A - 6a 21                      - push 21
00451B2C - b9 b0 5f 60 00             - mov ecx,00605fb0
00451B31 - e8 aa a9 03 00             - call 0048c4e0
00451B36 - 8b 46 54                   - mov eax,[esi+54]
00451B39 - 85 c0                      - test eax,eax
00451B3B - 75 07                      - jne 00451b44
00451B3D - 8b ce                      - mov ecx,esi
00451B3F - e8 9c 00 00 00             - call 00451be0
00451B44 - 5e                         - pop esi
00451B45 - 83 c4 20                   - add esp,20
00451B48 - c3                         - ret
00451B49 - 90                         - nop
00451B4A - 90                         - nop
00451B4B - 90                         - nop
00451B4C - 90                         - nop
00451B4D - 90                         - nop
00451B4E - 90                         - nop
00451B4F - 90                         - nop
00451B50 - 83 ec 08                   - sub esp,08
00451B53 - 56                         - push esi
00451B54 - 8b f1                      - mov esi,ecx
00451B56 - 80 be 91 00 00 00 01       - cmp byte ptr [esi+00000091],01
00451B5D - 75 6b                      - jne 00451bca
00451B5F - 8b 86 80 01 00 00          - mov eax,[esi+00000180]
00451B65 - f6 c4 08                   - test ah,08
00451B68 - 74 0e                      - je 00451b78
00451B6A - c7 46 54 ff ff 64 00       - mov [esi+54],_stl::basic_string<char,_stl::char_traits<char>,_stl::allocator<char> >::_m_range_initialize+1f
00451B71 - 5e                         - pop esi
00451B72 - 83 c4 08                   - add esp,08
00451B75 - c2 04 00                   - ret 0004
00451B78 - 0f bf 46 74                - movsx eax,word ptr [esi+74]
00451B7C - 99                         - cdq
00451B7D - 8b c8                      - mov ecx,eax
00451B7F - 8b 44 24 10                - mov eax,[esp+10]
00451B83 - 57                         - push edi
00451B84 - 8b fa                      - mov edi,edx
00451B86 - 99                         - cdq
00451B87 - 0f a4 c2                   - shld edx,eax
00451B8A - 10 57 51                   - adc [edi+51],dl
00451B8D - c1 e0 10                   - shl eax,10
00451B90 - 52                         - push edx
00451B91 - 50                         - push eax
00451B92 - e8 49 6c 15 00             - call 005a87e0
00451B97 - 85 d2                      - test edx,edx
00451B99 - 5f                         - pop edi
00451B9A - 7c 16                      - jnge 00451bb2
00451B9C - 7f 07                      - jg 00451ba5
00451B9E - 3d 00 00 64 00             - cmp eax,_stl::basic_ostream<char,_stl::char_traits<char> >::_m_put_widen_aux+20
00451BA3 - 76 0d                      - jna 00451bb2
00451BA5 - b8 00 00 64 00             - mov eax,_stl::basic_ostream<char,_stl::char_traits<char> >::_m_put_widen_aux+20
00451BAA - c7 44 24 08 00 00 00 00    - mov [esp+08],00000000

3

Code:
00451964 - 8b ce                      - mov ecx,esi
00451966 - e8 c5 f2 ff ff             - call 00450c30
0045196B - 2b eb                      - sub ebp,ebx
0045196D - 66 85 ed                   - test bp,bp
00451970 - 7c 0a                      - jnge 0045197c
00451972 - 39 9e ac 00 00 00          - cmp [esi+000000ac],ebx
00451978 - 7d e2                      - jnl 0045195c
0045197A - eb 0b                      - jmp 00451987
0045197C - f7 dd                      - neg ebp
0045197E - 66 89 ae 86 01 00 00       - mov [esi+00000186],ebp
00451985 - 33 ed                      - xor ebp,ebp
00451987 - 0f bf df                   - movsx ebx,di
0045198A - 0f bf c5                   - movsx eax,bp
0045198D - 8b cb                      - mov ecx,ebx
0045198F - 89 5c 24 1c                - mov [esp+1c],ebx
00451993 - 2b c8                      - sub ecx,eax
00451995 - 8b c1                      - mov eax,ecx
00451997 - c1 e0 04                   - shl eax,04
0045199A - 03 c1                      - add eax,ecx
0045199C - c1 e0 04                   - shl eax,04
0045199F - 03 c1                      - add eax,ecx
004519A1 - c1 e0 04                   - shl eax,04
004519A4 - 03 c1                      - add eax,ecx
004519A6 - 33 c9                      - xor ecx,ecx
004519A8 - 8d 04 40                   - lea eax,[eax+eax*2]
004519AB - 03 c0                      - add eax,eax
004519AD - 99                         - cdq
004519AE - f7 fb                      - idiv ebx
004519B0 - 8b 5e 54                   - mov ebx,[esi+54]
004519B3 - 03 d8                      - add ebx,eax
004519B5 - 66 8b 86 84 01 00 00       - mov ax,[esi+00000184]
004519BC - 66 3b c1                   - cmp ax,cx
004519BF - 89 5e 54                   - mov [esi+54],ebx
004519C2 - 7e 1d                      - jle 004519e1
004519C4 - 2b c7                      - sub eax,edi
004519C6 - 66 3b c1                   - cmp ax,cx
004519C9 - 66 89 86 84 01 00 00       - mov [esi+00000184],eax
004519D0 - 7d 0d                      - jnl 004519df
004519D2 - f7 d8                      - neg eax
004519D4 - 8b f8                      - mov edi,eax
004519D6 - 66 89 8e 84 01 00 00       - mov [esi+00000184],ecx
004519DD - eb 02                      - jmp 004519e1
004519DF - 33 ff                      - xor edi,edi
004519E1 - 89 4c 24 20                - mov [esp+20],ecx
004519E5 - c7 44 24 24 03 00 00 00    - mov [esp+24],00000003
004519ED - c7 44 24 28 01 00 00 00    - mov [esp+28],00000001
004519F5 - c7 44 24 2c 02 00 00 00    - mov [esp+2c],00000002
004519FD - 8d 6c 24 20                - lea ebp,[esp+20]
00451A01 - c7 44 24 14 04 00 00 00    - mov [esp+14],00000004
00451A09 - 8b 4d 00                   - mov ecx,[ebp+00]
00451A0C - 8b 84 8e 9c 00 00 00       - mov eax,[esi+ecx*4+0000009c]
00451A13 - 8d 9c 8e 9c 00 00 00       - lea ebx,[esi+ecx*4+0000009c]
00451A1A - 3d e8 03 00 00             - cmp eax,000003e8
00451A1F - 7c 35                      - jnge 00451a56
00451A21 - 66 85 ff                   - test di,di
00451A24 - 7e 30                      - jle 00451a56
00451A26 - 8a 55 00                   - mov dl,[ebp+00]
00451A29 - 68 e8 03 00 00             - push 000003e8
00451A2E - 52                         - push edx
00451A2F - 8b ce                      - mov ecx,esi
00451A31 - e8 fa f1 ff ff             - call 00450c30
00451A36 - 81 ef e8 03 00 00          - sub edi,000003e8
00451A3C - 66 85 ff                   - test di,di
00451A3F - 7c 0a                      - jnge 00451a4b
00451A41 - 81 3b e8 03 00 00          - cmp [ebx],000003e8
00451A47 - 7d d8                      - jnl 00451a21
00451A49 - eb 0b                      - jmp 00451a56
00451A4B - f7 df                      - neg edi
00451A4D - 66 89 be 84 01 00 00       - mov [esi+00000184],edi
00451A54 - 33 ff                      - xor edi,edi
00451A56 - 8b 44 24 14                - mov eax,[esp+14]
00451A5A - 83 c5 04                   - add ebp,04
00451A5D - 48                         - dec eax
00451A5E - 89 44 24 14                - mov [esp+14],eax
00451A62 - 75 a5                      - jne 00451a09
00451A64 - 0f bf c7                   - movsx eax,di
00451A67 - 8b 7c 24 1c                - mov edi,[esp+1c]
00451A6B - 8b cf                      - mov ecx,edi
00451A6D - 2b c8                      - sub ecx,eax
00451A6F - 8b c1                      - mov eax,ecx
00451A71 - c1 e0 04                   - shl eax,04
00451A74 - 03 c1                      - add eax,ecx
00451A76 - c1 e0 04                   - shl eax,04
00451A79 - 03 c1                      - add eax,ecx
00451A7B - c1 e0 04                   - shl eax,04
00451A7E - 03 c1                      - add eax,ecx
00451A80 - 8b 4e 54                   - mov ecx,[esi+54]
00451A83 - 8d 04 c0                   - lea eax,[eax+eax*8]
00451A86 - 99                         - cdq
00451A87 - f7 ff                      - idiv edi
00451A89 - 8b 7c 24 18                - mov edi,[esp+18]
00451A8D - 03 c8                      - add ecx,eax
00451A8F - 85 ff                      - test edi,edi
00451A91 - 89 4e 54                   - mov [esi+54],ecx
00451A94 - 74 40                      - je 00451ad6
00451A96 - 6a 00                      - push 00
00451A98 - 8b cf                      - mov ecx,edi
00451A9A - e8 21 c5 fe ff             - call 0043dfc0
00451A9F - 25 ff 00 00 00             - and eax,000000ff
00451AA4 - 8b 5e 54                   - mov ebx,[esi+54]
00451AA7 - c1 e0 10                   - shl eax,10
00451AAA - 8b c8                      - mov ecx,eax
00451AAC - b8 99 99 99 99             - mov eax,99999999
00451AB1 - f7 e9                      - imul ecx
00451AB3 - c1 fa 02                   - sar dl,02
00451AB6 - 8b ca                      - mov ecx,edx
00451AB8 - c1 e9 1f                   - shr ecx,1f
00451ABB - 03 d1                      - add edx,ecx
00451ABD - 03 da                      - add ebx,edx
00451ABF - 89 5e 54                   - mov [esi+54],ebx
00451AC2 - 8a 8f 15 01 00 00          - mov cl,[edi+00000115]
00451AC8 - f6 c1 02                   - test cl,02
00451ACB - 8b c3                      - mov eax,ebx
00451ACD - 74 07                      - je 00451ad6
00451ACF - 05 00 00 fe ff             - add eax,fffe0000
00451AD4 - eb 08                      - jmp 00451ade
00451AD6 - 8b 46 54                   - mov eax,[esi+54]
00451AD9 - 05 00 80 fd ff             - add eax,fffd8000
00451ADE - 5f                         - pop edi
00451ADF - 5d                         - pop ebp
00451AE0 - 85 c0                      - test eax,eax
00451AE2 - 89 46 54                   - mov [esi+54],eax
00451AE5 - 5b                         - pop ebx
00451AE6 - 7d 07                      - jnl 00451aef
00451AE8 - c7 46 54 00 00 00 00       - mov [esi+54],00000000
00451AEF - 8a 46 56                   - mov al,[esi+56]
00451AF2 - 3c 64                      - cmp al,64
00451AF4 - 7f 40                      - jg 00451b36
00451AF6 - 84 c0                      - test al,al
00451AF8 - 7c 07                      - jnge 00451b01
00451AFA - 0f be c0                   - movsx eax,al
00451AFD - 3c 14                      - cmp al,14
00451AFF - 7d 35                      - jnl 00451b36
00451B01 - 80 7c 24 07 14             - cmp byte ptr [esp+07],14
00451B06 - 7c 2e                      - jnge 00451b36
00451B08 - 8a 15 28 73 60 00          - mov dl,[00607328] : 60
00451B0E - 68 ff ff 00 00             - push 0000ffff
00451B13 - 6a ff                      - push ff
00451B15 - 6a ff                      - push ff
00451B17 - 52                         - push edx
00451B18 - 6a 14                      - push 14
00451B1A - b9 b0 5f 60 00             - mov ecx,00605fb0
00451B1F - e8 4c 9f 03 00             - call 0048ba70
00451B24 - 6a 00                      - push 00
00451B26 - 6a 00                      - push 00
00451B28 - 6a 00                      - push 00
00451B2A - 6a 21                      - push 21
00451B2C - b9 b0 5f 60 00             - mov ecx,00605fb0
00451B31 - e8 aa a9 03 00             - call 0048c4e0
00451B36 - 8b 46 54                   - mov eax,[esi+54]
00451B39 - 85 c0                      - test eax,eax
00451B3B - 75 07                      - jne 00451b44
00451B3D - 8b ce                      - mov ecx,esi
00451B3F - e8 9c 00 00 00             - call 00451be0
00451B44 - 5e                         - pop esi
00451B45 - 83 c4 20                   - add esp,20
00451B48 - c3                         - ret
00451B49 - 90                         - nop
00451B4A - 90                         - nop
00451B4B - 90                         - nop
00451B4C - 90                         - nop
00451B4D - 90                         - nop
00451B4E - 90                         - nop
00451B4F - 90                         - nop
00451B50 - 83 ec 08                   - sub esp,08
00451B53 - 56                         - push esi
00451B54 - 8b f1                      - mov esi,ecx
00451B56 - 80 be 91 00 00 00 01       - cmp byte ptr [esi+00000091],01
00451B5D - 75 6b                      - jne 00451bca
00451B5F - 8b 86 80 01 00 00          - mov eax,[esi+00000180]
00451B65 - f6 c4 08                   - test ah,08
00451B68 - 74 0e                      - je 00451b78
00451B6A - c7 46 54 ff ff 64 00       - mov [esi+54],_stl::basic_string<char,_stl::char_traits<char>,_stl::allocator<char> >::_m_range_initialize+1f
00451B71 - 5e                         - pop esi
00451B72 - 83 c4 08                   - add esp,08
00451B75 - c2 04 00                   - ret 0004
00451B78 - 0f bf 46 74                - movsx eax,word ptr [esi+74]
00451B7C - 99                         - cdq
00451B7D - 8b c8                      - mov ecx,eax
00451B7F - 8b 44 24 10                - mov eax,[esp+10]
00451B83 - 57                         - push edi
00451B84 - 8b fa                      - mov edi,edx
00451B86 - 99                         - cdq
00451B87 - 0f a4 c2                   - shld edx,eax
00451B8A - 10 57 51                   - adc [edi+51],dl
00451B8D - c1 e0 10                   - shl eax,10
00451B90 - 52                         - push edx
00451B91 - 50                         - push eax
00451B92 - e8 49 6c 15 00             - call 005a87e0
00451B97 - 85 d2                      - test edx,edx
00451B99 - 5f                         - pop edi
00451B9A - 7c 16                      - jnge 00451bb2
00451B9C - 7f 07                      - jg 00451ba5
00451B9E - 3d 00 00 64 00             - cmp eax,_stl::basic_ostream<char,_stl::char_traits<char> >::_m_put_widen_aux+20
00451BA3 - 76 0d                      - jna 00451bb2
00451BA5 - b8 00 00 64 00             - mov eax,_stl::basic_ostream<char,_stl::char_traits<char> >::_m_put_widen_aux+20
00451BAA - c7 44 24 08 00 00 00 00    - mov [esp+08],00000000
Back to top
View user's profile Send private message
MRDB512
Advanced Cheater
Reputation: 0

Joined: 31 Aug 2007
Posts: 60

PostPosted: Thu Aug 14, 2008 4:43 am    Post subject: Reply with quote

if you look at the line numbers you can see that all the code is the same
from 00451964
....
.....
....
to 00451BAA

Note: the values in the game change, but the code does not!
you change that to suit! LOL Cool


so these values are just taken from the sea and not the market??

What you want to do is find out what value gets writ to on the return to market

so you can write that value into the bar,

mean while, I will have a crack at what you posted,


ALT* 1.1
it looks like your top value is fffd8000, so you need to go to the market
to find that out
and every day it -dec [esi+54] by 000003e8

and when you been at sea to long value
Code:
 
00451AE8 - c7 46 54 00 00 00 00       - mov [esi+54],00000000

gets writ

so try changing the above to
from
mov [esi+54],00000000
to
mov [esi+54],fffd8000

just to see if thats correct, if so then when you run out of food and its game over you get full health/food again!


this code could be the real value
Code:

00451AEF - 8a 46 56                   - mov al,[esi+56]
00451AF2 - 3c 64                      - cmp al,64


Anyway when get the MAX value from the market.

Then I would use the
Code:

00451AFF - 7d 35                      - jnl 00451b36
00451B06 - 7c 2e                      - jnge 00451b36



00451B36 - 8b 46 54                   - mov eax,[esi+54]  //this one
cos of
00451A80 - 8b 4e 54                   - mov ecx,[esi+54]


I can tell this is not the right place to inject the code!
I would much rather be working with read from address only
Note: you can still write to these!
they have the quickest response times

So like I said theres no day wait for the value to change its instant!
but the above addresses should do something in the right direction!
but only when value gets writ to...


cos all the REF to it!

do an AA script

open |memory view|
right-click > goto address > 004519BF
Tools > auto assemble...
|template| > 1 and 4
copy address:
to [disable] tab in script

copy everything under orginialcode:
to just before the next label(exit)

copy under [disable] tab and address:

so it looks like this

Note: i've done the code for you so all you have to do, is copy and
paste it, but I want you to generate the code yourself so you learn AA scripting, just like you wanted!


Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

004519BF:
jmp newmem
returnhere:

newmem: //this is allocated memory, you have read,write,execute access
//place your code here


originalcode:
//add this line
mov ebx,003eb32e  //your value see if that works
mov [esi+54],ebx
jle 004519e1


exit:
jmp returnhere
 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
004519BF:
mov [esi+54],ebx
jle 004519e1



Now

|file| > Assign to currect Cheat table
it will appear in the bottom of your addresses list
Click the [ ] box make it [X] and your ready to go
Try that let me know how you got on!

004519BF - 89 5e 54 - mov [esi+54],ebx
//eax,00000000
//ebx,003eb32e //bar value
//ecx,00000000
//edx,00000000
//esi,14f6f778
//edi,0fd80190
//esp,0012fa2c
//ebp,0fd80190
//eip,004519c2

_________________
DATABASE

Its a good learn trip, but at the end you would want to know
how you got there!
Back to top
View user's profile Send private message
Pingo
Grandmaster Cheater
Reputation: 8

Joined: 12 Jul 2007
Posts: 571

PostPosted: Thu Aug 14, 2008 6:18 am    Post subject: Reply with quote

Is this Tortuga Two Treasures
Im downloading the demo.
Those instructions that writes to your addy are all different. the more info shows that. I'll have a look when my download has finished.

_________________
Back to top
View user's profile Send private message
MRDB512
Advanced Cheater
Reputation: 0

Joined: 31 Aug 2007
Posts: 60

PostPosted: Thu Aug 14, 2008 6:21 am    Post subject: Reply with quote

mean while....
you could learn more about registers and AA scripting
by doing CTRL+A and F1 or/and checking out

To learn more about AA scripting try
http://forum.cheatengine.org/viewtopic.php?t=95363


Quote:
I can tell this is not the right place to inject the code!
I would much rather be working with read from address only


Agreed!

Could you post the link?

_________________
DATABASE

Its a good learn trip, but at the end you would want to know
how you got there!
Back to top
View user's profile Send private message
yadungon
Cheater
Reputation: 0

Joined: 20 Jul 2008
Posts: 35

PostPosted: Thu Aug 14, 2008 11:31 pm    Post subject: Reply with quote

this is a quick reply about the game i hadnt try the code yet.
@Pingo= you downloading a different version. it call Tortuga - Pirates of the New World in UK in USA they call it Pirate Hunter.
the homepage is
http://www.ascaron.com/gb/gb_tortuga/ and download demo would be
http://www.ascaron.com/gb/gb_tortuga/demo/tortugademo.exe
i can expalin how the game is play you two can try to play the demo.
Back to top
View user's profile Send private message
MRDB512
Advanced Cheater
Reputation: 0

Joined: 31 Aug 2007
Posts: 60

PostPosted: Fri Aug 15, 2008 8:49 am    Post subject: Reply with quote

Aurthor: DARK BYTE
http://forum.cheatengine.org/viewtopic.php?t=268528

??

_________________
DATABASE

Its a good learn trip, but at the end you would want to know
how you got there!
Back to top
View user's profile Send private message
yadungon
Cheater
Reputation: 0

Joined: 20 Jul 2008
Posts: 35

PostPosted: Fri Aug 15, 2008 10:17 pm    Post subject: Reply with quote

@MRDB512= i think your code workes but in a different way.The bar is not full but it pause in the middle.

"Note: i've done the code for you so all you have to do, is copy and
paste it, but I want you to generate the code yourself so you learn AA scripting, just like you wanted! "
Is that a test that you want me make the bar full? i only copy your code and paste it then do the rest.

what all those mean?
004519BF - 89 5e 54 - mov [esi+54],ebx
//eax,00000000
//ebx,003eb32e //bar value
//ecx,00000000
//edx,00000000
//esi,14f6f778
//edi,0fd80190
//esp,0012fa2c
//ebp,0fd80190
//eip,004519c2

@MRDB512= that was a link i ask DARK BYTE to post because at first i cant post link,
i need to show the image. you might ask why i post another topic in here is because
everyday i look at and and nobody post anything so i post another one here.

did two of you download the game and try it ?
Back to top
View user's profile Send private message
Pingo
Grandmaster Cheater
Reputation: 8

Joined: 12 Jul 2007
Posts: 571

PostPosted: Sat Aug 16, 2008 8:25 am    Post subject: Reply with quote

Yeah i just downloaded the demo. I found the addy and created the script.
It probably wont work for the full version though. Plus my value was alot different then yours.

Code
[enable]
alloc(morale,1024)
morale:
mov [ecx+a0],64
jmp 004d906a

004d9064:
jmp morale

[disable]
dealloc(morale)

004d9064:
mov [ecx+a0],eax


I'll explain what i did if this doent work for you.
It was the morale bar you were asking for right?

_________________
Back to top
View user's profile Send private message
MRDB512
Advanced Cheater
Reputation: 0

Joined: 31 Aug 2007
Posts: 60

PostPosted: Sat Aug 16, 2008 9:56 am    Post subject: Reply with quote

Just for fun
Debug of code
Pingo wrote:


[enable] //used for when you have Clicked [X]
alloc(morale,1024) //make/alloc (E)memory name is morale
morale: //this is the morale Extended memory addy

mov [ecx+a0],64 //this movs 64 = hex, dec = 100 into [ecx+0a]
//also changed from original, put the 100% bar
//value into [ecx+0a]

jmp 004d906a //this, What does this DO ??????
//unconditional jmp to 004d906a that the return jmp
//but why do it manually when CE does it for you //via labels, I just noticed theres no labels in this script??

004d9064: //this is the game code copy jmp
jmp morale //jmp to the above extended memory alloc

[disable] //for when you click the [ ]
dealloc(morale) //remove from (E)memory, not necessary, but good
//code practice, unload what has been loaded, so as not to use
//more (E)memory than needed!

004d9064:
mov [ecx+a0],eax //put back what was destroyed, from the jmp
//jmp opcodes = 5 and a call = E8, What??


Look MAA.... NO SPACES LOL!
I dont know how to post Spaced Text!
please PM on this!



Just some finer updating and changes....
ALT* 1.4

Pingo Wrote:
Quote:

Yeah i just downloaded the demo. I found the addy and created the script.
It probably wont work for the full version though.


Agreed!

Quote:
Pingo
004d9064:

did you use a write address, if so then the player would have to wait
for a day to pass before the values got updated, try using read address only, but sometime its not possible, but the only why to get player only is
to access a display routine, Hope this helps!
It took me along time to understand this Wink

Did you all look at my post
http://forum.cheatengine.org/viewtopic.php?t=276332

Note: I Post in reverse order, so the Post starts at the bottem
With ALT* 1.0 in-bet-tween


Anyway from ref to this post.
This post was about how to get the morale value, bar to full and keep it there, so here goes
Noted: it takes 2-3 days to have 1 less cargo item dec by..
[note]: for all the others(how to...) just post me
Quote:
Pingo
try my table on your demo, Tell me what you think!


morale

is a bar value
is 100% full, when hex 64 = 100 dec

Code:

How to find...


speed game up to max!
do a
Scan Type: Unknown Initial Value
Value Type: byte or 2 bytes(word) doesn't matter!

Activated your CheatEngine Hotkeys
via |Settings| top-right icon, just below
so
|settings| > Configure Hotkeys
Scroll down, and find Next scan-increased value Double-Click change to your hotkey
next
do that same for Next scan-decrased value
now your all setup for game training...
I used Ctrl+< for has decreased value and
Ctrl+> for has increased value

so for ref, I will use these in the example!

go into game, load or start a new, get to the open sea
use space bar to make bar go quicker...
after a day, do a Ctrl+< = bug, you must Alt-tab out for the
First and second Hotkey Usage
now ALT-Tab back in or click the game

Repeat for 4 to 5 times,
now wait a day again, but this time, pause the game
ALT-Tab, do a has Decreased, now do [unchanged value] =
Keep pressing the Next Scan until the Found: xxxxxxx does not decrease in number, now go back into game, get to a town, do a Chest Thing, you know, now morale restored, now do a Ctrl+>, now ALT-Tab back into CE, you should have two addresses

add to address list and change the value for each, for example
1 = 50 and 2 = 70, now go back into the game, see if bar is half or more!
if more then 2 and 1 otherwise

now Right-Click the Correct Address, do a Find out what read from this address

now, click |Yes| and move the new window to the Top of screen, out of the way, now double click the address found, note the values, Click |Close|, now |Show disassembler|, now you code might look different
Code:

[b]
so, post the code and I will continue!
[/b]

mean while... I recommend that you to should be listing all you do in a .txt file or similer!, so you can know what your doing, there no other way of telling from opening saved code, weather its Read address or write address.... with out the comments REF //writes //read

weather??


//player moral *******************************************************
//read
004C8F36 - 8a 4b 56 - mov cl,[ebx+56]




ALT 1.3*

i think your code workes but in a different way.The bar is not full but it pause in the middle.

Quote:
"Note: i've done the code for you so all you have to do, is copy and
paste it, but I want you to generate the code yourself so you learn AA scripting, just like you wanted! "
Is that a test that you want me make the bar full? i only copy your code and paste it then do the rest.


DID you get the value for max, how to change it! and why it does what it does!!
then you replace the value in [esi+54] with your new found max value, that was the test, how did you do!


The reason your bar only went to the middle and stayed there, it because
when you found the value the bar was there,
mov ebx,003eb32e, was your current value,

You dont want to miss out on the Rapid Fire, It is Fun! Fun!
I will let Pingo, tell you about it cos hes in the same boat and hes more to the point then I.

Another thing I want to do is, when the Pirates Fire the Slow you down
ammo= then I want to write the value that Fights that, LOL
No holes in the sails HERE! Cool

Its a HIDDEN value, you can use the player health, but the sails, still have holes in them!.

ALT 1.2*

Quote:

what all those mean?
004519BF - 89 5e 54 - mov [esi+54],ebx
//eax,00000000
//ebx,003eb32e //bar value
//ecx,00000000
//edx,00000000
//esi,14f6f778
//edi,0fd80190
//esp,0012fa2c
//ebp,0fd80190
//eip,004519c2

the // = comments in AA script
and eax,00000000 = registers and there values at that time
useful if you want to find out what value is what for player only!

ALT 1.1*


Right
Demo Version 1.0.0.0

all works!

Stay away from the *** in the table cos Im still testing

Note: if you want me to explain this all in detail I will
example, how I got the address and How I changed it, and how I made
a player only mod of it!, so It wont matter what version you got, cos you
will be learning by doing!, and making your own codes


But FIRST, I need to know how much you want to Sorry, Train...
I need you to say if you want me the explain how to....
Then we can get started!
So let me know!

for the reason you saying only about the morale...
but I can help, with the help of Pingo, Breaking it down, if I take to long!
Tell me how I did!

I had fun training this game, Nice game! Wink


Did you read about the AA scripting??

Which one would you like to start with, I say money and then
morale and then (player only) health
how does that sound!

but what I found for you is

    Morale of course! = 100% Full

    (Player only) Health

    (player only) Instant Cannon for both side = a really found mod

    AKA Rapid fire[] Cool

    Cannon Ammo = inf, but only at 20 cos of the cargo

    sailers/ crew onboard = to stop enermy fleeing! LOL

    Ship Speed = *** still working on!

    Cargo/stores = *** still working on!



if I missed any out here is the list!

Code:

//Cargo/stores *********************************************************

//possible write


//sub
0043FB9C - 89 11                      - mov [ecx],edx

/add
0043FBEB - 89 11                      - mov [ecx],edx


//writes
0044FA2A - 89 46 60                   - mov [esi+60],eax
0044C5F4 - 89 5e 60                   - mov [esi+60],ebx



//read
004A52E0 - 8b 41 60                   - mov eax,[ecx+60]
//read +
0044F137 - 8b 56 60                   - mov edx,[esi+60]



//0044CEA2 - 8b 84 81 3c 01 00 00       - mov eax,[ecx+eax*4+0000013c]


//sailers onboard *******************************************************
//ebx,0013fb34

//writes
0050DFB3 - 89 42 24                   - mov [edx+24],eax
00543B44 - 88 43 1d                   - mov [ebx+1d],al  //might be display address


//read
0050DF7F - 39 48 24                   - cmp [eax+24],ecx


//player health  ********************************************************
//writes
0054397F - 89 43 08                   - mov [ebx+08],eax

//reads
004C982E - 8b 41 08                   - mov eax,[ecx+08]


//player moral  *******************************************************
//read
004C8F36 - 8a 4b 56                   - mov cl,[ebx+56]


//cannon ammo *********************************************************8
//writes
//at market
0044F2B6 - 89 84 b7 3c 01 00 00       - mov [edi+esi*4+0000013c],eax



//read
0044CEA2 - 8b 84 81 3c 01 00 00       - mov eax,[ecx+eax*4+0000013c]
0044F262 - 8b 84 b7 3c 01 00 00       - mov eax,[edi+esi*4+0000013c]

//in battle
0044CEA2 - 8b 84 81 3c 01 00 00       - mov eax,[ecx+eax*4+0000013c]



//instant cannon ******************************************************

//right side @@@@@@@@@@@@@@@@@@@@@@@@@@
//read
0050E98F - 66 83 bd 40 01 00 00 00    - cmp word ptr [ebp+00000140],00



//left side  @@@@@@@@@@@@@@@@@@@@@@@@@@
//
//writes
0053BA29 - 66 ff 0f                   - dec word ptr [edi]
0053BA2C - 66 83 3f 00                - cmp word ptr [edi],00
0053BA30 - 75 21                      - jne 0053ba53


//read
//
0050E748 - 66 83 bd 42 01 00 00 00    - cmp word ptr [ebp+00000142],00  //this one
0050E7F5 - 66 3b 95 42 01 00 00       - cmp dx,[ebp+00000142]
00539E95 - 66 2b 83 42 01 00 00       - sub ax,[ebx+00000142]
0050E808 - 66 8b 95 42 01 00 00       - mov dx,[ebp+00000142]
0050E831 - 66 8b 85 42 01 00 00       - mov ax,[ebp+00000142]

//esp,0013fad0

_________________
DATABASE

Its a good learn trip, but at the end you would want to know
how you got there!


Last edited by MRDB512 on Tue Aug 19, 2008 10:52 am; edited 1 time in total
Back to top
View user's profile Send private message
yadungon
Cheater
Reputation: 0

Joined: 20 Jul 2008
Posts: 35

PostPosted: Sat Aug 16, 2008 10:04 pm    Post subject: Reply with quote

@Pingo= it the morale bar im talking about, the code didnt work.

@MRDB512= At first i found 2 address
" for example 1 = 50 and 2 = 70"
so i change first one with 50 and second with 70 and then the game crash. i think i misunderstand what you mean. the second time i didnt find 2 but 3 address.and one of them is 100 and i change to 80 and the bar change.

"Show disassembler|, now you code might look different"
when you said Show disassembler do you mean click "memory view" then right go to the address paste the address i find and copy the code.The code address i found is 14BD1BAE

Code:

14BD1A58 - 01 00                      - add [eax],eax
14BD1A5A - 00 00                      - add [eax],al
14BD1A5C - 26 00 00                   - add es:[eax],al
14BD1A5F - 00 03                      - add [ebx],al
14BD1A61 - 00 04 00                   - add [eax+eax],al
14BD1A64 - 1c 01                      - sbb al,01
14BD1A66 - 08 04 00                   - or [eax+eax],al
14BD1A69 - d7                         - xlatb
14BD1A6A - dc 14 1b                   - fcom qword ptr [ebx+ebx]
14BD1A6D - 00 00                      - add [eax],al
14BD1A6F - 00 01                      - add [ecx],al
14BD1A71 - 1c bf                      - sbb al,bf
14BD1A73 - 14 ff                      - adc al,ff
14BD1A75 - ff                         - db ff
14BD1A76 - ff                         - db ff
14BD1A77 - ff 05 00 03 00 1f          - inc [1f000300] : 1EEBBF4E
14BD1A7D - 01 08                      - add [eax],ecx
14BD1A7F - 04 01                      - add al,01
14BD1A81 - 81 c5 14 ff ff ff          - add ebp,ffffff14
14BD1A87 - ff 01                      - inc [ecx]
14BD1A89 - e2 eb                      - loop 14bd1a76
14BD1A8B - 3d 05 00 00 00             - cmp eax,00000005
14BD1A90 - 00 1c 1c                   - add [esp+ebx],bl
14BD1A93 - 1c 01                      - sbb al,01
14BD1A95 - 00 00                      - add [eax],al
14BD1A97 - 00 01                      - add [ecx],al
14BD1A99 - 15 16 19 2d 00             - adc eax,002d1916
14BD1A9E - 00 00                      - add [eax],al
14BD1AA0 - 03 00                      - add eax,[eax]
14BD1AA2 - 05 00 04 01 08             - add eax,08010400
14BD1AA7 - 04 00                      - add al,00
14BD1AA9 - 75 c3                      - jne 14bd1a6e
14BD1AAB - 14 2d                      - adc al,2d
14BD1AAD - 00 00                      - add [eax],al
14BD1AAF - 00 01                      - add [ecx],al
14BD1AB1 - 00 00                      - add [eax],al
14BD1AB3 - 00 21                      - add [ecx],ah
14BD1AB5 - 00 00                      - add [eax],al
14BD1AB7 - 00 02                      - add [edx],al
14BD1AB9 - 00 03                      - add [ebx],al
14BD1ABB - 00 07                      - add [edi],al
14BD1ABD - 01 0f                      - add [edi],ecx
14BD1ABF - 04 f8                      - add al,f8
14BD1AC1 - 01 d4                      - add esp,edx
14BD1AC3 - 00 f8                      - add al,bh
14BD1AC5 - 01 d4                      - add esp,edx
14BD1AC7 - 00 02                      - add [edx],al
14BD1AC9 - 00 02                      - add [edx],al
14BD1ACB - 00 09                      - add [ecx],cl
14BD1ACD - 01 08                      - add [eax],ecx
14BD1ACF - 04 01                      - add al,01
14BD1AD1 - df 47 13                   - fild word ptr [edi+13]
14BD1AD4 - 1d 00 00 00 02             - sbb eax,02000000
14BD1AD9 - 00 02                      - add [edx],al
14BD1ADB - 00 0b                      - add [ebx],cl
14BD1ADD - 01 0f                      - add [edi],ecx
14BD1ADF - 04 d8                      - add al,d8
14BD1AE1 - 01 d4                      - add esp,edx
14BD1AE3 - 00 d8                      - add al,bl
14BD1AE5 - 01 d4                      - add esp,edx
14BD1AE7 - 00 05 00 02 00 0d          - add [0d000200],al
14BD1AED - 01 08                      - add [eax],ecx
14BD1AEF - 04 00                      - add al,00
14BD1AF1 - 82                         - db 82
14BD1AF2 - c5 14 03                   - lds edx,[ebx+eax]
14BD1AF5 - 00 00                      - add [eax],al
14BD1AF7 - 00 01                      - add [ecx],al
14BD1AF9 - 00 00                      - add [eax],al
14BD1AFB - 00 02                      - add [edx],al
14BD1AFD - 00 00                      - add [eax],al
14BD1AFF - 00 01                      - add [ecx],al
14BD1B01 - 00 00                      - add [eax],al
14BD1B03 - 00 03                      - add [ebx],al
14BD1B05 - 00 00                      - add [eax],al
14BD1B07 - 00 01                      - add [ecx],al
14BD1B09 - 00 00                      - add [eax],al
14BD1B0B - 00 2d 00 00 00 03          - add [03000000],ch : 00
14BD1B11 - 00 05 00 32 01 08          - add [08013200],al
14BD1B17 - 04 00                      - add al,00
14BD1B19 - 74 c3                      - je 14bd1ade
14BD1B1B - 14 2d                      - adc al,2d
14BD1B1D - 00 00                      - add [eax],al
14BD1B1F - 00 01                      - add [ecx],al
14BD1B21 - 00 00                      - add [eax],al
14BD1B23 - 00 68 00                   - add [eax+00],ch
14BD1B26 - 00 00                      - add [eax],al
14BD1B28 - 02 00                      - add al,[eax]
14BD1B2A - 03 00                      - add eax,[eax]
14BD1B2C - 35 01 08 04 01             - xor eax,walmalloc+46ac1
14BD1B31 - 83 d2 0f                   - adc edx,0f
14BD1B34 - 31 00                      - xor [eax],eax
14BD1B36 - 00 00                      - add [eax],al
14BD1B38 - 03 00                      - add eax,[eax]
14BD1B3A - 02 00                      - add al,[eax]
14BD1B3C - 37                         - aaa
14BD1B3D - 01 0c 04                   - add [esp+eax],ecx
14BD1B40 - 40                         - inc eax
14BD1B41 - 1b bd 14 40 1b bd          - sbb edi,[ebp-42e4bfec]
14BD1B47 - 14 01                      - adc al,01
14BD1B49 - 00 00                      - add [eax],al
14BD1B4B - 00 24 00                   - add [eax+eax],ah
14BD1B4E - 00 00                      - add [eax],al
14BD1B50 - 3b 00                      - cmp eax,[eax]
14BD1B52 - 03 00                      - add eax,[eax]
14BD1B54 - 3a 01                      - cmp al,[ecx]
14BD1B56 - 0c 04                      - or al,04
14BD1B58 - bc 49 5c 00 00             - mov esp,00005c49
14BD1B5D - 00 00                      - add [eax],al
14BD1B5F - 00 00                      - add [eax],al
14BD1B61 - ff                         - db ff
14BD1B62 - ff 00                      - inc [eax]
14BD1B64 - 00 00                      - add [eax],al
14BD1B66 - 10 0f                      - adc [edi],cl
14BD1B68 - 00 00                      - add [eax],al
14BD1B6A - 4e                         - dec esi
14BD1B6B - 0b fd                      - or edi,ebp
14BD1B6D - 0e                         - push cs
14BD1B6E - 46                         - inc esi
14BD1B6F - 0b 00                      - or eax,[eax]
14BD1B71 - 00 00                      - add [eax],al
14BD1B73 - 00 00                      - add [eax],al
14BD1B75 - 00 00                      - add [eax],al
14BD1B77 - 00 00                      - add [eax],al
14BD1B79 - 00 00                      - add [eax],al
14BD1B7B - 00 09                      - add [ecx],cl
14BD1B7D - 00 00                      - add [eax],al
14BD1B7F - 00 01                      - add [ecx],al
14BD1B81 - 00 00                      - add [eax],al
14BD1B83 - 00 00                      - add [eax],al
14BD1B85 - 00 00                      - add [eax],al
14BD1B87 - 00 01                      - add [ecx],al
14BD1B89 - 00 00                      - add [eax],al
14BD1B8B - 00 00                      - add [eax],al
14BD1B8D - 00 00                      - add [eax],al
14BD1B8F - 00 00                      - add [eax],al
14BD1B91 - 00 00                      - add [eax],al
14BD1B93 - 00 22                      - add [edx],ah
14BD1B95 - 00 0f                      - add [edi],cl
14BD1B97 - 04 98                      - add al,98
14BD1B99 - 6e                         - outsb
14BD1B9A - e4 0f                      - in al,0f
14BD1B9C - 00 00                      - add [eax],al
14BD1B9E - 00 00                      - add [eax],al
14BD1BA0 - 00 00                      - add [eax],al
14BD1BA2 - 00 00                      - add [eax],al
14BD1BA4 - ff                         - db ff
14BD1BA5 - ff                         - db ff
14BD1BA6 - ff                         - db ff
14BD1BA7 - ff 00                      - inc [eax]
14BD1BA9 - 00 00                      - add [eax],al
14BD1BAB - 00 00                      - add [eax],al
14BD1BAD - 00 50 00                   - add [eax+00],dl
14BD1BB0 - 80 38 01                   - cmp byte ptr [eax],01
14BD1BB3 - 00 00                      - add [eax],al
14BD1BB5 - 0b 00                      - or eax,[eax]
14BD1BB7 - 00 90 65 00 00 d6          - add [eax-29ffff9b],dl
14BD1BBD - 09 7e 11                   - or [esi+11],edi
14BD1BC0 - 00 00                      - add [eax],al
14BD1BC2 - 00 00                      - add [eax],al
14BD1BC4 - 00 00                      - add [eax],al
14BD1BC6 - 00 00                      - add [eax],al
14BD1BC8 - 10 00                      - adc [eax],al
14BD1BCA - 00 00                      - add [eax],al
14BD1BCC - 32 00                      - xor al,[eax]
14BD1BCE - 00 00                      - add [eax],al
14BD1BD0 - ff                         - db ff
14BD1BD1 - ff 01                      - inc [ecx]
14BD1BD3 - 64 03 00                   - add eax,fs:[eax]
14BD1BD6 - ff                         - db ff
14BD1BD7 - ff ac 00 ac 00 ff ff       - jmp [eax+eax+0000ff54]
14BD1BDE - ff                         - db ff
14BD1BDF - ff 8c 01 ff ff 6a 10       - dec [ecx+eax+106affff]
14BD1BE6 - 00 00                      - add [eax],al
14BD1BE8 - 00 01                      - add [ecx],al
14BD1BEA - 05 ff 02 fa 00             - add eax,cresrccompiledmesh::addrange+1078f
14BD1BEF - 00 00                      - add [eax],al
14BD1BF1 - 00 00                      - add [eax],al
14BD1BF3 - 00 88 13 00 00 00          - add [eax+00000013],cl
14BD1BF9 - 00 00                      - add [eax],al
14BD1BFB - 00 00                      - add [eax],al
14BD1BFD - 00 00                      - add [eax],al
14BD1BFF - 00 00                      - add [eax],al
14BD1C01 - 00 00                      - add [eax],al
14BD1C03 - 00 88 13 00 00 00          - add [eax+00000013],cl
14BD1C09 - 00 00                      - add [eax],al
14BD1C0B - 00 00                      - add [eax],al
14BD1C0D - 00 00                      - add [eax],al
14BD1C0F - 00 00                      - add [eax],al
14BD1C11 - 00 00                      - add [eax],al
14BD1C13 - 00 00                      - add [eax],al
14BD1C15 - 00 00                      - add [eax],al
14BD1C17 - 00 00                      - add [eax],al
14BD1C19 - 00 00                      - add [eax],al
14BD1C1B - 00 00                      - add [eax],al
14BD1C1D - 00 00                      - add [eax],al
14BD1C1F - 00 00                      - add [eax],al
14BD1C21 - 00 00                      - add [eax],al
14BD1C23 - 00 00                      - add [eax],al
14BD1C25 - 00 00                      - add [eax],al
14BD1C27 - 00 00                      - add [eax],al
14BD1C29 - 00 00                      - add [eax],al
14BD1C2B - 00 00                      - add [eax],al
14BD1C2D - 00 00                      - add [eax],al
14BD1C2F - 00 00                      - add [eax],al
14BD1C31 - 00 00                      - add [eax],al
14BD1C33 - 00 00                      - add [eax],al
14BD1C35 - 00 00                      - add [eax],al
14BD1C37 - 00 00                      - add [eax],al
14BD1C39 - 00 00                      - add [eax],al
14BD1C3B - 00 00                      - add [eax],al
14BD1C3D - 00 00                      - add [eax],al
14BD1C3F - 00 00                      - add [eax],al
14BD1C41 - 00 00                      - add [eax],al
14BD1C43 - 00 00                      - add [eax],al
14BD1C45 - 00 00                      - add [eax],al
14BD1C47 - 00 00                      - add [eax],al
14BD1C49 - 00 00                      - add [eax],al
14BD1C4B - 00 00                      - add [eax],al
14BD1C4D - 00 00                      - add [eax],al
14BD1C4F - 00 00                      - add [eax],al
14BD1C51 - 00 00                      - add [eax],al
14BD1C53 - 00 00                      - add [eax],al
14BD1C55 - 00 00                      - add [eax],al
14BD1C57 - 00 00                      - add [eax],al
14BD1C59 - 00 00                      - add [eax],al
14BD1C5B - 00 00                      - add [eax],al
14BD1C5D - 00 00                      - add [eax],al
14BD1C5F - 00 00                      - add [eax],al
14BD1C61 - 00 00                      - add [eax],al
14BD1C63 - 00 00                      - add [eax],al
14BD1C65 - 00 00                      - add [eax],al
14BD1C67 - 00 00                      - add [eax],al
14BD1C69 - 00 00                      - add [eax],al
14BD1C6B - 00 00                      - add [eax],al
14BD1C6D - 00 00                      - add [eax],al
14BD1C6F - 00 00                      - add [eax],al
14BD1C71 - 00 00                      - add [eax],al
14BD1C73 - 00 00                      - add [eax],al
14BD1C75 - 00 00                      - add [eax],al
14BD1C77 - 00 00                      - add [eax],al
14BD1C79 - 00 00                      - add [eax],al
14BD1C7B - 00 00                      - add [eax],al
14BD1C7D - 00 00                      - add [eax],al
14BD1C7F - 00 00                      - add [eax],al
14BD1C81 - 00 00                      - add [eax],al
14BD1C83 - 00 00                      - add [eax],al
14BD1C85 - 00 00                      - add [eax],al
14BD1C87 - 00 00                      - add [eax],al
14BD1C89 - 00 00                      - add [eax],al
14BD1C8B - 00 00                      - add [eax],al
14BD1C8D - 00 00                      - add [eax],al
14BD1C8F - 00 00                      - add [eax],al
14BD1C91 - 00 00                      - add [eax],al
14BD1C93 - 00 00                      - add [eax],al
14BD1C95 - 00 00                      - add [eax],al
14BD1C97 - 00 00                      - add [eax],al
14BD1C99 - 00 00                      - add [eax],al
14BD1C9B - 00 40 01                   - add [eax+01],al
14BD1C9E - 00 00                      - add [eax],al
14BD1CA0 - 40                         - inc eax
14BD1CA1 - 01 00                      - add [eax],eax
14BD1CA3 - 00 40 01                   - add [eax+01],al
14BD1CA6 - 00 00                      - add [eax],al
14BD1CA8 - 10 00                      - adc [eax],al
14BD1CAA - 00 00                      - add [eax],al
14BD1CAC - 00 00                      - add [eax],al
14BD1CAE - 00 00                      - add [eax],al
14BD1CB0 - 00 00                      - add [eax],al
14BD1CB2 - 00 00                      - add [eax],al
14BD1CB4 - 00 00                      - add [eax],al
14BD1CB6 - 00 00                      - add [eax],al
14BD1CB8 - 00 00                      - add [eax],al
14BD1CBA - 00 00                      - add [eax],al
14BD1CBC - 00 00                      - add [eax],al
14BD1CBE - 00 00                      - add [eax],al
14BD1CC0 - 00 00                      - add [eax],al
14BD1CC2 - 00 00                      - add [eax],al
14BD1CC4 - 00 26                      - add [esi],ah
14BD1CC6 - 00 00                      - add [eax],al
14BD1CC8 - ff                         - db ff
14BD1CC9 - ff d4                      - call esp
14BD1CCB - 00 00                      - add [eax],al
14BD1CCD - 00 00                      - add [eax],al
14BD1CCF - 00 00                      - add [eax],al
14BD1CD1 - 00 00                      - add [eax],al
14BD1CD3 - 00 00                      - add [eax],al
14BD1CD5 - 00 00                      - add [eax],al
14BD1CD7 - 00 00                      - add [eax],al
14BD1CD9 - 00 00                      - add [eax],al
14BD1CDB - 00 00                      - add [eax],al
14BD1CDD - 00 00                      - add [eax],al
14BD1CDF - 00 00                      - add [eax],al
14BD1CE1 - 00 00                      - add [eax],al
14BD1CE3 - 00 10                      - add [eax],dl
14BD1CE5 - 01 08                      - add [eax],ecx
14BD1CE7 - 04 00                      - add al,00
14BD1CE9 - 8f                         - db 8f



what does it mean Read address or write address?

I want to learn everything you did and and how to do it myself next time with another game.

Quote:
I had fun training this game, Nice game!

it nice to you like the game but how you felt about the bar? You have to give up everything you have all the ship,goods, and gold just to refill it?

[quote]Did you read about the AA scripting?? [quote/]
ya i read the AA but there still dont thing i dont get and thing im unsure of.
Those are in the AA topic:
Quote:
mov [ebx],eax //Move eax (which is the value of 0100200A) into the value of ebx

when he said move eax into the ebx did he mean add them together or jsut replace the value.


Quote:
Which one would you like to start with, I say money and then
morale and then (player only) health
how does that sound!

ok that sound good.


about the test, this is the code i get, put the value 003eb32e in the search with the hex checked, and uncheck hex add a 0 in the end and check hex and copy the new value [0272FFCC] replace the old one and bar is full.
Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

004519BF:
jmp newmem
returnhere:

newmem: //this is allocated memory, you have read,write,execute access
//place your code here


originalcode:
//add this line
mov ebx,0272FFCC  //your value see if that works
mov [esi+54],ebx
jle 004519e1


exit:
jmp returnhere
 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
004519BF:
mov [esi+54],ebx

jle 004519e1



when i was playing witht the code i found a hyper speed boat but very unstable
Code:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

004519BF:
jmp newmem
returnhere:

newmem: //this is allocated memory, you have read,write,execute access
//place your code here


originalcode:
//add this line
mov ebx,003eb32e  //your value see if that works
mov [esi+60],ebx
jle 004519e1


exit:
jmp returnhere
 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
004519BF:
mov [esi+60],ebx
jle 004519e1

very very fast speed boat but also very very unstable use at your own risk!!!!! just push space bar.
ps i dont know what i did, all i did is replace 54 with 60 in the mov "[esi+60],ebx " .

the Piraten_demo.CT crash my game maybe i check too much i test one by one later


when you got no ship left the bar will alway be full and nobody cant came attack,here how i did it:
find the right address and add to the list dont click what write to the address yet, the bar must be less than 100 or not full find some boat you know you cant win, and before the battle there a pop ask you what you want to do, go to ce click what write to the and back to game fight the enemy.after the battle start just go to the enemy boat and lose your ship when you return youll get one of a kind ship

show disassember
tools
auto assemble
template
code injection.
code is here:
Code:

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

004518BE:
jmp newmem
nop
nop
returnhere:

newmem: //this is allocated memory, you have read,write,execute access
//place your code here


originalcode:
mov [esi+54],_stl::basic_string<char,_stl::char_traits<char>,_stl::allocator<char> >::_m_range_initialize+1f

exit:
jmp returnhere


close what write to this address thing then go to a town they give you a free boat. and then click what write to the address and run day pass the four thing pop up i use the replace button
Code:
Change of 004518be - c7 46 54 ff ff 64 00 - mov [esi+54],_stl::basic_string<char,_stl::char_traits<char>,_stl::allocator<char> >::_m_range_initialize+1f
with all four of them and the bar freeze
let discuss this thing later after done with the another code.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Goto page 1, 2, 3  Next
Page 1 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites