Cheat Engine

WTFsandwich

In order to rekindle my interest in ASM, I'm attempting to hack some bytecodes. I have a little bit of knowledge on the subject, just a semester's worth of an assembly programming class.

However, it seems I've ran into a bit of a snag in my current venture, and could use some help.

I'm playing through Sonic 1 for the Genesis again. What I am attempting to hack, is the number of rings I have.

I tried a simple value search, and turned up the address for rings, however, it is a 1 byte data type. This piqued my interest, as I know rings can go much higher than 255.

So far, what I've managed is to find the address of whatever instruction runs when a ring is picked up.

It is:

Corruptor · Posted: Tue May 29, 2012 10:16 am Post subject:

Intuitively, i would advise you to look into the disassembled code, set a breakpoint at the instruction and look what it does when you have 255 rings and pick up another one. Now, i somehow experience emulators to look kinda weird beeing dissassembled. Anyhow, you might give it a try.

As for the code you posted, i see this:

WTFsandwich · Posted: Wed May 30, 2012 2:24 am Post subject:

Ah, endianness *shivers* Not my favorite concept in the world.

To clarify, little endian is typically the format used when doing binary arithmetic, correct? IE, the rightmost bit is the 2^0 place, second to rightmost is 2^1 place, etc. Big endian is esentially the reverse of that, where the leftmost bit is 2^0, second to leftmost is 2^1 etc. Is that correct?

Also, I'm unfamiliar with the dl and dh portions of the instructions, though based on your explanation I'm going to assume it has to do with bit order. Is hibyte another term for most significant bit?

Once I understand endianness better, what would be a good way to check said counter and see which order it follows? Can I reverse the endianness of the 2 byte search to find it?

Dark Byte · Posted: Wed May 30, 2012 2:54 am Post subject:

Nope, I think that even in big endian if you want to show it as binary it still goes from right to left

For a 2 byte value:
In little endian, bits 0 to 7 are stored on the first byte and bits 8 to 15 on the second byte

in big endian bits 0 to 7 are stored on the second byte and bits 8 to 15 on the first byte
---

dx is a 16 bit register. It can be split up into 2 8 bit registers: dl and dh
dl is bits 0 to 7 and dh is bits 8 to 15

---
But to the point: This is an emulator you're debugging, not the game. The instruction you're getting is that of the emulator emulating a write to a specific address, this instruction is used for everything, from updating the timer to writing the pixels of sonic to the display adapter

Perhaps one of the registers, or a pointer path found in one of the registers, points to the rom's bytecode in the native assemblercode of the emulator cpu but you won't be able to change it easily with ce (it doesn't know that assemblercode)

Also, if you just wish to set values in big endian check this topic: http://forum.cheatengine.org/viewtopic.php?t=544988
It contains a script that adds big endian support to ce