Cheat Engine

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

I've been trying to make a code for AOE2 HD that either doubles the damage you deal to your opponent or halves the damage dealt to yourself.

Turns out the game uses float stack to store its damage value and I don't know how to manipulate that.

hhhuut · Posted: Mon Feb 15, 2016 11:02 am Post subject:

The instruction "fmul" (or "fmulp") might help you here. With that you can multiply two fpu-stack values

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

hhhuut · Posted: Mon Feb 15, 2016 11:35 am Post subject:

Explanation of my code:
st(0) is always the first value on the stack!
Imagine that before any of our instructions is executed the fpu-stack looks like this:
st(0): value1
st(1): value2
st(2): value3
...

So in line 1 I put the original damage value (eax+04 is just an example here) onto the fpu-stack, so that it looks like that:
st(0): original damage vlue
st(1): value1
st(2): value2
st(3): value3
...

In Line 2 I move the multiplier (in this case 2 to double the value, otherwise you've to put "0.5" here) into the address and put it onto the fpu-stack in line 3 once more. The FPU-Stack now looks like this:
st(0): 2
st(1): original damage value
st(2): value1
st(3): value2
st(4): value3
...

In line 4 now, I'm doing the actual multipilcation. A basic math equation would look like that:
st(1) = st(1) * st(0)
I hope you noticed that the instruction is "fmulp", not just "fmul". The "p" stands for "pop" and removes the topmost value from the fpu-stack. So after the multiplication instruction the fpu-stack looks like that:
st(0): original damage value multiplied with 2
st(1): value1
st(2): value2
st(3): value3
...

The last instruction now stores the multiplied value into the source address once more and removes it from the fpu-stack. After that, our fpu-stack looks like before:
st(0): value1
st(1): value2
st(2): value3
...

Usually you should make sure, that after your own code got executed, the stack (no matter if fpu or normal stack) looks exactly like it has been before your code got executed. Otherwise you may cause the game to crash or bug ...

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

Tried it and it instantly kills the enemy and then the game crashes

Zanzer · Posted: Mon Feb 15, 2016 8:11 pm Post subject:

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

dd puts the value inside the variable, right? So why is it executed after the fld instruction?

Zanzer · Posted: Mon Feb 15, 2016 8:30 pm Post subject:

The DDs initialize the two variables. This executes immediately when you enable the script.

The FLD is used to load either 2.0 or 0.5 on to the stack.
Then FMULP simply multiplies that value with the one already there.

This will double or halve the value that was previously present.

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

Thanks, it works!

Now to differentiate it between player and enemy since they both use the same code.

Now how do I look at the register at fsubr instead of movss since the debugger said its eax is not 3 even though it passed my eax=3 comparison check (since eax=3 for my player units)

Edit: Nevermind. Just had to use the dissect data structure instead of doing it manually like with the resource code.

Edit 2:
Welp, the identification value changed when the game restarted. Dunno what to do now.

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

Help please?

++METHOS · Posted: Tue Feb 16, 2016 7:15 pm Post subject:

Keep looking. More methods can be found here.

Mr. Starman · Newbie cheater Reputation: 0 Joined: 09 Oct 2012 Posts: 16

So, I got this promising pointer imgur. com / Cooxe9v (sorry, can't post link yet) that leads to a promising address but I don't know how I would write that in the assembly code. Any help please?

Edit:
Nevermind, I did it by borrowing eax, pushing and popping its original value. It seems the code is stable this time since it still works after I restarted the game.

Still crashes the game when a scenario ends though. Gotta turn that shit off first. And it somehow made it so that you gotta verify the game on Steam again.