Cheat Engine

[F3l1x]

Hello Everyone,

I'm new here and just started messing with cheat engine a couple days ago, so have mercy on me for this noob question:

So Ive been trying to find an Address for Strength of a Character in a game, but could at first only find the visual representation of it. Then i went to find what writes to this address and found a

mov [esi+00002C08],eax

after that i wrote a script, thats messing with eax and found out that eax holds the actual value at that point, but the problem is its updated every time i enter a battle -> unless i have my script running the whole time str will change everytime.

My question is: How do i go from here to find the address, that holds the actual value of my str?

I would appreciate any help alot^^ thx in advance.

P.S. Ive been trying to go up in the Dissassembler from that point to see if i can find, whats giving eax the value and stumbled across some stuff, which looks like this:

mov eax,51EB851F
imul edx
sar edx,05
mov eax,edx <-----
shr eax,1F
add eax,edx
.
.
.
mov [esi+00002C08],eax

I know, that edx had my value in it at the marked point, because i used break and trace before that point, but why is this 51EB851F loaded into eax? Wouldnt this be the indicator of the end result?? is this already what I'm looking for?[/b]

[ParkourPenguin]

It's possible for values to look like something important when they actually aren't.

Look at how the value is being calculated. You've already started doing this, but one would need more information than that to figure out what's going on. i.e. what's the value of edx prior to the imul, and where is it getting that value from?

Also, is this an online game? If so, the value could be stored on a server, meaning you should give up. If not, saying its name could help others help you.

[F3l1x]

Not an online game.

So I found out, that i actually already found the address of my str, it just updates at the start/end of every battle. Modyfying it in a battle would give me the result i wanted, but not for long ^^

so that means if i mess with that updating (finding out what writes to it and skipping it for example) would do the trick, but it can break the mechanic of giving me str for leveling up for example right?

Any suggestions on how to go further?

what i found about that imul thing is:


When imul is passed a 32 bit argument as in your case with EDX which effectively means EAX * EDX where both EAX and EDX are 32 bit registers.

Since you are multiplying two 32 bit values it is possible that the answer will overflow 32 bits in which case the high 32 bits of the answer will be written to the EDX register and the low 32 bits to the EAX register, this is represented with the `EDX:EAX' notation.

the str value im looking for is 177 in dez B1 in Hex

From the Tracer

mov eax,51EB851F
imul edx <----- 1
sar edx,05 <----- 2
mov eax,edx <----- 3
shr eax,1F
add eax,edx
.
.
.
mov [esi+00002C08],eax

at 1: edx has 00004578
at 2: edx has 0000163A
at 3: edx has 000000B1

[ParkourPenguin]

Values that are semantically an aggregate of other values are usually calculated from their constituent parts before they are used. This calculation can sometimes be expensive, so the result of the calculation tends to be cached for the duration of its use. Modifications to the cached value would be transient, while modifications to the constituent values would affect future calculations of the aggregate value.

In this case, the value in question is the strength stat. If I had to guess, its value is an aggregate of other values: the number of skill points assigned to it, equipment bonuses, buffs / debuffs, etc. The game probably makes this calculation once prior to the beginning of a battle, caches the result, and uses that cached value for the rest of the battle. Modifying the cached value might have an effect for the duration of the current battle, but it wouldn't have any effect for future battles. If you change one of the values strength is calculated from, however, it will affect your strength stat the next time it's calculated.

Another option would be to change the function that calculates your strength stat. If a hypothetical function is "strength = base + skillPoints * 8 + equipmentBonus", you can change the 8 to some higher number. Of course, you'll need to find the code in order to make this change, which is sometimes easier said than done.

If you're only concerned about your strength stat while in battle, you can hook the instruction that accesses the address of your strength if that instruction doesn't access other addresses and is run often enough. From that point, do whatever you want: make it move some constant into the address of your strength stat, multiply the value by something, or just copy the address into some registered symbol and allow the user to decide what to do with the strength stat. The section titled "Injection Copies" of this topic goes over the basics of the last point.


You are correct about what the imul instruction does with a single operand. I don't know why the game is doing those operations- might be a part of calculating the strength stat, or might be obfuscation / bad encryption. If you want to go further down this rabbit hole, look at where edx comes from before it's multiplied by that number; however, IMO you'd have an easier time either modifying the code or changing one of strength's constituent values.

[F3l1x]

[ParkourPenguin]

My apologies; I didn't realize you weren't a native English speaker.

[++METHOS]

[F3l1x]

Okay so today I continued looking for it^^

I tried to apply all the methods of looking further, that you suggested, I just don't get how to do this:

[ParkourPenguin]

[F3l1x]

Alright, I finally found something in that calculation, which doesnt change after ages of backtracing

thank you for the guidance, I definitely learned a lot (also that I won't look for this stuff anymore if there is another way haha)

[SunBeam]

Kinda old and sorry for necro, but I found the same calculation logic in "The Red Solstice" with the same constant/seed -> 0x51EB851F

[ParkourPenguin]

That's a fast way of performing signed integer division by 100.
https://godbolt.org/z/q8nxrrGn4