Cheat Engine

low_density · Posted: Fri Dec 10, 2010 4:25 am Post subject: Auto Assembler Problems

hi, just wanna ask, i've seen a lot of scripts for games that checks if the base address is the player's, for example, with this code:

Dark Byte · Posted: Fri Dec 10, 2010 4:44 am Post subject:

yes, it checks if the value at edi-dc is 065c
the word ptr in front of it means only check the first 2 bytes of the value at that location

this kind of notation is used in object oriented games where the player class is it's own class, but is used for other class objects as well.
e.g: CGameCharacter would be the base class and then you could have CPlayer and CComputer classes that inherit from CGameCharacter.

The CGameCharacter class contains the setHealth routine, so when CPlayer.setHealth is called the CGameCharacter's setHealth is called as well

Because the hook is placed at the setHealth of CGameCharacter you have to find out what the classtype is that called the setHealth routine, and you can often do that using the first pointer in the structure of the class which tends to point to a static address defining either CPlayer or CComputer
Of course, due to memory relocation not all 4 bytes are always the same, but the first 2 are always the same (2 and a half actually)

low_density · Posted: Fri Dec 10, 2010 11:04 am Post subject:

hi, then if my game has this section:

Dark Byte · Posted: Fri Dec 10, 2010 11:41 am Post subject:

I have no idea what you're looking at or why you're looking at that, but this is just a function call in a class
Is this game code or code of a routine you injected ?

anyhow,
edx gets the class info structure (basically a list of pointers to functions)
place in eax the address of function which is stored at edx+1d8

set ecx (the class pointer in c++ ) to the start of the structure (edi-dc)
call the routine

assuming that edi does not get changed by the function call you can assume that the base address of the structure is still edi-dc, and the previous call was just to get the value that has to be set.

low_density · Posted: Fri Dec 10, 2010 12:15 pm Post subject:

that is a game code, for the game half life 2 episode 1.... no, the value of edi isn't changed at all throughout the routine... if it's like what you said, the base structure address is at edi-dc, how do you compare the digit? for example, when an antlion hit my character, i get these address when i toggle breakpoint at "mov [edi],ecx"...

Dark Byte · Posted: Fri Dec 10, 2010 1:14 pm Post subject:

BC E6 51 18 means address 1851e6bc
because the first 3 digits of this address can change quite often do a check for the lower bytes (so bc e6)
So do something like:

cmp word ptr [edi-dc],e6bc
je exit