Cheat Engine

madeinqc · Last edited by madeinqc on Fri Aug 26, 2011 11:40 pm; edited 1 time in total

To make it short, I have a 64 bit Windows 7.
I try to hack a 32 bit game (Minecraft).

My problem is when I try to "Add adress Manually" to add a pointer.
I enter a 32 bit adress (C1E7BCD4 + 0) and it should give me a 32 adress in return (C1E7BCC0 in my case) but it return a 64 bit adress (C1E7BCC0C1E7BB80 which is 2 32bit adress concatenated).

Is there anyway to avoid that bug? Cause it's anoying and I can't use the pointers for this game.

Thanks for your answers.

Dark Byte · Posted: Fri Aug 26, 2011 5:31 pm Post subject:

You are sure it is a 32-bit process ?
I never played minecraft but I heard it is java based. Do you target javaw.exe? If so, on a 64-bit system this is a 64-bit process

If you look at instructions with a [xxxx] in them. What registers does it show? Exx or Rxx registers ?

Anyhow, try the 32-bit binary of CE

Oh yes, which ce version? 6.0 or 6.1 ?

Also, there are some anti-anti-cheat tools out that fake the bit type of a process to be 64-bit so they don't get infected by the anti cheat dll that doesn't handle 64-bit dll's and the other way around. That trick can also affect ce

madeinqc · Posted: Fri Aug 26, 2011 11:38 pm Post subject:

Hey, sorry my mistake, it's 64bit application cause my java is 64bit.
I tryed the 6.0 and 6.1 availiable in the download section, didn't saw the 32bit version link in the download page.

It does show extended registers and that's why I found it strange... Normally I'm used to 32bit and now in 64bit all seem work except pointers.

I can work around with auto-assambly to calculate them for me, but it's a pain in the neck.

Also, I'm not sure that the trick about faking 64bit apply here because it's, as you said, a java application.

I'll keep looking for the 32bit CE hopping I wont have to download delphi to compile Razz

PS: Edited 1st post to update the title, more accurate

Dark Byte · Posted: Sat Aug 27, 2011 2:52 pm Post subject:

The 32-bit version is installed automatically when you install ce. It's the cheatengine-i386.exe and also has a start menu shortcut

That the pointers are in 4 byte alignment in a 64-bit app is weird though (only explenation is that is is after all a 32-bit app, but ce detects it wrongly as 64-bit)

madeinqc · Posted: Sun Aug 28, 2011 10:24 am Post subject:

yeah kind of strange, well if you want any information about this bug, or testing just ask me, and with the 32bit version, the debugger won't attach... dunno why, well I'll try to work it out