Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Hacking Bunny Black - Pointer Issues

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Bosparan
Cheater
Reputation: 1

Joined: 30 Apr 2015
Posts: 36

PostPosted: Thu Apr 30, 2015 2:23 am    Post subject: Hacking Bunny Black - Pointer Issues Reply with quote

Hi Guys,

I've just (very) recently started trying my luck with Cheat Engine and I've hit a snag. After running my head into a wall for a couple of days I got smart and decided to ask for help (thus this post).

Objective I'm trying to reach:
Edit Character Stats of the main character.

Attempt 1: Static values
Finding the stats was trivial, changing them worked reliably. Only problem: They don't persist, meaning I'd have to write the table again after next start.
However: The structure of the stats is static (So "CurrentStrength" is always 4 bytes after "CurrentHealth" etc.).
Hm, why? Doing a search turned up a simple answer:
"Don't skip the tutorial" - a good answer as it turns out. Moving on to ...

Attempt 2: Pointers - Manually
The tutorial on Pointers and Multi-Pointers (6 and 8 I believe) was great - managed to clear both without undue difficulties.
Applying this to Bunny.exe turns out to be somewhat more problematical though:
"The values of the pointer needed"-Results weren't stored anywhere.
I tried the other addresses stored in memory that were highlighted, with no greater result.

Attempt 3: Pointers - Scanning for Pointers
The scanning for Pointers option was more fruitful, giving a bounty of potential pointers.
Only downside: None of those pointers persisted through a game restart.
Damn.

Attempt 4: Assembling a pointer
When all pointers fail, that left me with trying to do this the Assembler way. Maybe I could simply get the game to tell me where the character stats are when it changes them?
So I searched on how to do this, and found these two helpful posts:
forum.cheatengine.org/viewtopic.php?t=570083
Rydian's Guide To Basic AOBs And Scripts

forum.cheatengine.org/viewtopic.php?t=573548&sid=228562f444bcb5485ec432f80aa42025]
Gniarf's reply in "Static addresses and pointers question aimed at Gurus"
(Sorry, can't post urls yet)

So what I have is the exact location where the values are processed, it's always in the same space. Then I know the name of the variable that - only while executing this code apparently - holds the information I want (The starting address of character stats).

Now my idea was that if I replaced that code with my own code (that does the exact same thing as the original), I could somehow write that address to a separate location and use that location as pointer.
To do this I imagine I'd simply use mov to write the address to a different slot in memory and that's my pointer.
Problem: How do I determine the slot to use?

Scratching things together from these two posts I got this far, but have absolutely no idea on where to store the data:

Code:
{ Game   : Bunny.exe
  Version:
  Date   : 2015-04-30
  Author : Bosparan

  This script does blah blah blah
}

[ENABLE]

alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
//Store ecx in dedicated pointer
mov edx,[ecx]
add [eax],edx
mov edx,[ecx+04]
add [eax+04],edx
mov edx,[ecx+08]
add [eax+08],edx
mov edx,[ecx+0C]
add [eax+0C],edx
mov edx,[ecx+10]
add [eax+10],edx
mov edx,[ecx+14]
add [eax+14],edx
mov edx,[ecx+18]
add [eax+18],edx
mov edx,[ecx+1C]
add [eax+1C],edx
mov edx,[ecx+20]
add [eax+20],edx

originalcode:
mov edx,[ecx]
add [eax],edx
mov edx,[ecx+04]
add [eax+04],edx
mov edx,[ecx+08]
add [eax+08],edx
mov edx,[ecx+0C]
add [eax+0C],edx
mov edx,[ecx+10]
add [eax+10],edx
mov edx,[ecx+14]
add [eax+14],edx
mov edx,[ecx+18]
add [eax+18],edx
mov edx,[ecx+1C]
add [eax+1C],edx
mov edx,[ecx+20]
add [eax+20],edx


exit:
jmp returnhere

"Bunny.exe"+32400:
jmp newmem
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
returnhere:

aobscanmodule(StatPointer,Bunny.exe,8B 11 01 10 8B 51 04 01 50 04 8B 51 08 01 50 08 8B 51 0C 01 50 0C 8B 51 10 01 50 10 8B 51 14 01 50 14 8B 51 18 01 50 18 8B 51 1C 01 50 1C 8B 51 20 01 50 20) // should be unique
alloc(newmem1,$1000)

label(code1)
label(return1)

newmem1:

code1:
  mov edx,[ecx]
  add [eax],edx
  mov edx,[ecx+04]
  add [eax+04],edx
  mov edx,[ecx+08]
  add [eax+08],edx
  mov edx,[ecx+0C]
  add [eax+0C],edx
  mov edx,[ecx+10]
  add [eax+10],edx
  mov edx,[ecx+14]
  add [eax+14],edx
  mov edx,[ecx+18]
  add [eax+18],edx
  mov edx,[ecx+1C]
  add [eax+1C],edx
  mov edx,[ecx+20]
  add [eax+20],edx
  jmp return1

StatPointer+02:
  jmp code1
  nop
  nop
return1:
registersymbol(StatPointer)

[DISABLE]

StatPointer+02:
  db 8B 11 01 10 8B 51 04 01 50 04 8B 51 08 01 50 08 8B 51 0C 01 50 0C 8B 51 10 01 50 10 8B 51 14 01 50 14 8B 51 18 01 50 18 8B 51 1C 01 50 1C 8B 51 20 01 50 20

unregistersymbol(StatPointer)
dealloc(newmem1)

{
// ORIGINAL CODE - INJECTION POINT: "Bunny.exe"+32400

"Bunny.exe"+323F6: C3                 -  ret
"Bunny.exe"+323F7: CC                 -  int 3
"Bunny.exe"+323F8: CC                 -  int 3
"Bunny.exe"+323F9: CC                 -  int 3
"Bunny.exe"+323FA: CC                 -  int 3
"Bunny.exe"+323FB: CC                 -  int 3
"Bunny.exe"+323FC: CC                 -  int 3
"Bunny.exe"+323FD: CC                 -  int 3
"Bunny.exe"+323FE: CC                 -  int 3
"Bunny.exe"+323FF: CC                 -  int 3
// ---------- INJECTING HERE ----------
"Bunny.exe"+32400: 8B 11              -  mov edx,[ecx]
"Bunny.exe"+32402: 01 10              -  add [eax],edx
"Bunny.exe"+32404: 8B 51 04           -  mov edx,[ecx+04]
"Bunny.exe"+32407: 01 50 04           -  add [eax+04],edx
"Bunny.exe"+3240A: 8B 51 08           -  mov edx,[ecx+08]
"Bunny.exe"+3240D: 01 50 08           -  add [eax+08],edx
"Bunny.exe"+32410: 8B 51 0C           -  mov edx,[ecx+0C]
"Bunny.exe"+32413: 01 50 0C           -  add [eax+0C],edx
"Bunny.exe"+32416: 8B 51 10           -  mov edx,[ecx+10]
"Bunny.exe"+32419: 01 50 10           -  add [eax+10],edx
"Bunny.exe"+3241C: 8B 51 14           -  mov edx,[ecx+14]
"Bunny.exe"+3241F: 01 50 14           -  add [eax+14],edx
"Bunny.exe"+32422: 8B 51 18           -  mov edx,[ecx+18]
"Bunny.exe"+32425: 01 50 18           - add [eax+18],edx
"Bunny.exe"+32428: 8B 51 1C           - mov edx,[ecx+1C]
"Bunny.exe"+3242B: 01 50 1C           - add [eax+1C],edx
"Bunny.exe"+3242E: 8B 51 20           - mov edx,[ecx+20]
"Bunny.exe"+32431: 01 50 20           - add [eax+20],edx

// ---------- DONE INJECTING  ----------
}


Cheers and thanks for any insights,
Bosparan
Back to top
View user's profile Send private message
Rydian
Grandmaster Cheater Supreme
Reputation: 31

Joined: 17 Sep 2012
Posts: 1358

PostPosted: Thu Apr 30, 2015 2:45 am    Post subject: Reply with quote

http://forum.cheatengine.org/viewtopic.php?t=572465

Follow the instructions there to narrow down the results for the scan (by specifying the offset for one value) and also increase the depth and max offset.

And if that doesn't work the game might not have native pointers, so you can use the AOB to data technique.

_________________
Back to top
View user's profile Send private message
Rissorr
Master Cheater
Reputation: 3

Joined: 17 Sep 2013
Posts: 273
Location: Israel!

PostPosted: Thu Apr 30, 2015 9:30 am    Post subject: Reply with quote

you can try to fetch the value from a code that accesses it.

for example:
Code:
12345678 - mov [ecx+10],eax

is the code that writes to your HP

now make a script:
Code:


alloc(mem,1024)

registersymbol(baseHP) //DECLARE YOUR VARIABLE
alloc(baseHP,4)             //MAKE SOME SPACE FOR IT

label(mainCode)
label(originalCode)
label(return)

mem:

mainCode:
mov [baseHP],ecx //SAVE BASE ADDRESS OF YOUR HP FOR FURTHER USE
jmp originalCode

originalCode:
mov [ecx+10],eax
jmp return

address:
jmp mainCode
return:



and then in the address list:

1. add manual address
2. pointer
3. pointer base -> baseHP
4. offset -> 10
5. Done!!
Back to top
View user's profile Send private message
Bosparan
Cheater
Reputation: 1

Joined: 30 Apr 2015
Posts: 36

PostPosted: Thu Apr 30, 2015 8:07 pm    Post subject: Reply with quote

Hi Guys,

thanks a lot for the help!

Rydian:
The guide was massively helpful with understanding good practices. Unfortunately it didn't work out for my case. Regular AOB Scanning didn't do the trick either (There are massively repetitive structures for all the other minions you can have and the space above is fairly random (the reason why addresses keep shifting, probably). That said, I'll probably get to use the skills I earned down the road, so I'm fairly happy with the time spent Smile

DogeMan:
Awesome, thanks for showing me how to write down some information (should have figured that out on my own - after all, how else do we create the memory space to put in the changes to the code?).
The only real addition I had to make, is that since this code is fairly repetitive I had to add an if/else clause, so it's only written the first time. Nothing a judicious use of google on cheatengine.org couldn't help me with ^^

Sooo ... I got this to work like a charm, thanks again for the help. I'll use my Cheat Table for a bit to add some features and iron out any bugs I might encounter, then I'll upload it for the benefit of the community.

Cheers,
Bosparan
Back to top
View user's profile Send private message
lol_Red
How do I cheat?
Reputation: 0

Joined: 27 Jul 2012
Posts: 4

PostPosted: Sat May 02, 2015 6:16 am    Post subject: Reply with quote

where u able to get this script work if so plz share it thank u in advance
Back to top
View user's profile Send private message
Bosparan
Cheater
Reputation: 1

Joined: 30 Apr 2015
Posts: 36

PostPosted: Sat May 02, 2015 2:38 pm    Post subject: Reply with quote

I've tested it a bit (and added some more cheats to it). You can find it here:
forum.cheatengine.org/viewtopic.php?p=5591889#5591889
Back to top
View user's profile Send private message
daanish.0250
How do I cheat?
Reputation: 0

Joined: 22 Mar 2020
Posts: 1

PostPosted: Sun Mar 22, 2020 9:27 am    Post subject: Bunny Black 2 Cheat Table Reply with quote

Hi,

I tried going on the link you posted for your Bunny Black 2 Cheat Table (forum.cheatengine.org/viewtopic.php?p=5591889#5591889) but it doesn't work. Can you please repost it or send the file to me?

Thanks!
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites