 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Mi.Co.Ev
How do I cheat?
![]() Reputation: 0
Joined: 19 Mar 2016
Posts: 2
|
 Posted: Sat Mar 19, 2016 12:22 pm Post subject: Constantly Changing Addresses |
 |
|
Hello CE members,
I am trying to currently make a cheat engine for the game "I am weapon - Revival ".
Through the basic CE memory hack even though i am able to freeze ammo in a stage or so..when i die & restart or move to the next level the address changes and the ammo is unfrozen. So i tried narrowing it down by doing "find out what writes to this address" and tried to narrow down the pointers to 4 addresses following which then as per the tutorial add address manually. Even then when the 4 addresses i get are frozen and their values are changed and i restart the checkpoint....bam...the value doesn't remain frozen in-game. 
Now, i don't see this happening in any other game..is it something with the game or should i follow some other method.
Pls. advice.
|
|
| Back to top |
|
 |
hhhuut
Grandmaster Cheater
 Reputation: 6
Joined: 08 Feb 2015
Posts: 607
|
| Posted: Sat Mar 19, 2016 12:33 pm Post subject: |
|
|
Maybe your pointer isn't good enough to still point to the right value after a restart/new level.
You can either use CE's pointer scanner to find a valid pointer or you can write a small auto-assembler script that saves the current address.
|
|
| Back to top |
|
|
SunBeam
I post too much
 Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
| Posted: Sat Mar 19, 2016 1:12 pm Post subject: |
|
|
Why don't you take it up one notch?
Debug the ASM instruction that accesses/writes to your ammo address. Then investigate where the address is obtained, backtracking - meaning: get to that ASM instruction that showed up in Debug window, when "Find out what accesses this". Then scroll upwards to find the prologue of the function this ASM instruction is part of (usually, the prologue should be the first instruction below a RET instruction). Set breakpoint there. When CE breaks, investigate how game gets to your address, tracing code line by line with F7 downwards and checking the registers, till you get to your instruction. If still not happy with the result, see who calls this function you're in and backtrace up one level.
It does matter how much ASM you know, unfortunately. And there's no shortcuts to this..
BR,
Sun
P.S.1: Pointer scanner doesn't always retrieve fixed pointers. They may change after a map restart, game restart, PC reboot, etc. Or change if you do something in-game, like switch weapons or hide weapons, etc. Just some examples.
P.S.2: For 10 EUR on Steam, I decided I'd give it a go. We'll catch up sometime next week 
|
|
| Back to top |
|
|
Mi.Co.Ev
How do I cheat?
![]() Reputation: 0
Joined: 19 Mar 2016
Posts: 2
|
| Posted: Sun Mar 20, 2016 12:47 am Post subject: |
|
|
| hhhuut wrote: | Maybe your pointer isn't good enough to still point to the right value after a restart/new level.
You can either use CE's pointer scanner to find a valid pointer or you can write a small auto-assembler script that saves the current address. |
I have been trying to do the ol classy pointer scan...I end up with a ten thousand values. When i restart the game very time and do search for the change in memory, i end up with around 18631 results which after a certain amount of time reduces by only 100 for every pointer scan re-searching that i do...it is kind of tedious. Anyways i will give it a shot. Ty.
| Quote: | Why don't you take it up one notch?
Debug the ASM instruction that accesses/writes to your ammo address. Then investigate where the address is obtained, backtracking - meaning: get to that ASM instruction that showed up in Debug window, when "Find out what accesses this". Then scroll upwards to find the prologue of the function this ASM instruction is part of (usually, the prologue should be the first instruction below a RET instruction). Set breakpoint there. When CE breaks, investigate how game gets to your address, tracing code line by line with F7 downwards and checking the registers, till you get to your instruction. If still not happy with the result, see who calls this function you're in and backtrace up one level.
It does matter how much ASM you know, unfortunately. And there's no shortcuts to this..
BR,
Sun |
Hey Sun,
can you possibly give me a link for the tutorials of what you mentioned? Debug ASM (I have no idea what it is  ) Yesterday again, i happened to try what writes to this address & what accesses this address again...still no luck. Thanks for the advice though. I will keep digging.
P.S. 1 It is a very good game...good time pass 
P.S. 2 The addresses are so much that even when you go and buy weapon from a vendor, the damn address changes. when you upgrade it, the damn address changes. I mean this is only one SMG i am talking about. There are 5 weapons in each class.
UPDATE!!
OKAY!
After half a day of tedious pointer scanning. I ended up with a total of 65 addresses for ammo in clip or no reload and around 638 addresses for ammo total or ammo.
I just took out 1 value out of em each addresses and made a cheat table. It works when i restart the game or reload checkpoints. Good news is it works for all the firearms. I like someone to check if this is working or not for them or for you guys, if not please guide me to develop a table that will work for everyone.
Please find the table attached.
P.S. I use steam version of the game.
| Description: |
|
Download |
| Filename: |
I am weapon - revival Ammo.CT |
| Filesize: |
1.13 KB |
| Downloaded: |
911 Time(s) |
|
|
| Back to top |
|
|
SunBeam
I post too much
Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
| Posted: Sun Mar 20, 2016 11:44 am Post subject: |
|
|
Now I know why you're having issues: the game is built with Unity engine. See: http://www.cheatengine.org/forum/viewtopic.php?p=5546748, mgr.inz.Player's directives
Here's a little run-down for ammo. I am at the beginning of the game, in windowed mode, having picked up the first weapon:
Bullets are highlighted in red (top-right). Now, with Cheat Engine, I've found the address:
Debugging the address and firing shows this writes to it:
Scrolling to the top of the function (you have to figure it out a bit, through the non-aligned code), gets me here. Note the reference (RangedAI:set_ammoCount):
Now, using CE's Mono menu (as indicated), navigate the Assembly-CSharp tree and find RagedAI
If you now right-click the set_ammoCount reference and choose Jit, you get to the address we were already at in Memory View
Investigate that decompiled tree and figure out something useful out of it
BR,
Sun
|
|
| Back to top |
|
|
SunBeam
I post too much
Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
| Posted: Mon Mar 21, 2016 6:06 am Post subject: |
|
|
And from the looks of the function:
| Code: | 346D5020 - 55 - push ebp
346D5021 - 8B EC - mov ebp,esp
346D5023 - 83 EC 08 - sub esp,08
346D5026 - 8B 45 08 - mov eax,[ebp+08]
346D5029 - 0FB6 40 65 - movzx eax,byte ptr [eax+65] <--
346D502D - 85 C0 - test eax,eax
346D502F - 75 25 - jne 346D5056
346D5031 - 8B 45 08 - mov eax,[ebp+08]
346D5034 - 8B 80 A8000000 - mov eax,[eax+000000A8]
346D503A - 83 EC 04 - sub esp,04
346D503D - 50 - push eax
346D503E - 6A 00 - push 00
346D5040 - FF 75 0C - push [ebp+0C]
346D5043 - E8 68F3CDD1 - call 063B43B0
346D5048 - 83 C4 10 - add esp,10
346D504B - 8B C8 - mov ecx,eax
346D504D - 8B 45 08 - mov eax,[ebp+08]
346D5050 - 89 88 A4000000 - mov [eax+000000A4],ecx <-- write ammo in clip
346D5056 - C9 - leave
346D5057 - C3 - ret |
If byte at 346D5029 is 0x1, the depletion of clip never happens.
BR,
Sun
P.S.: I tested this location, code is not accessed by any other entity in the game. It's player-sided. So you may as well hook and write 0x1 to 0x65 offset in EAX structure and be done with it
|
|
| Back to top |
|
|
hhhuut
Grandmaster Cheater
Reputation: 6
Joined: 08 Feb 2015
Posts: 607
|
| Posted: Mon Mar 21, 2016 6:47 am Post subject: |
|
|
| Or dissect the whole structure. Probably you'll find even more "hidden" ingame-cheats
|
|
| Back to top |
|
|
SunBeam
I post too much
Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
| Posted: Mon Mar 21, 2016 6:55 am Post subject: |
|
|
Doesn't look like a tough cookie to me. Just aobscan it that's that
Unlimited Ammo in Clip
| Code: | [ENABLE]
aobscan( _setAmmoCount, 558BEC83EC088B45080FB6406585C0 )
registersymbol( _setAmmoCount )
alloc( setAmmoCount, 256, IAmWeaponRevival.exe )
label( setAmmoCount_orig )
registersymbol( setAmmoCount_orig )
setAmmoCount:
pushad
mov eax,[esp+24] // get weapon pointer from stack (pushad = 0x20 + 0x4)
mov ebx,[eax+A4] // get ammo in clip
cmp ebx,[eax+A8] // check if equal to max ammo in clip
je short @f
mov ebx,[eax+A8]
mov [eax+A4],ebx // if not, update current ammo in clip to max ammo in clip
@@:
mov byte ptr [eax+65],1 // disable clip depletion
popad
ret
setAmmoCount_orig:
readmem( _setAmmoCount, 6 )
jmp _setAmmoCount+6
_setAmmoCount:
jmp setAmmoCount
db 90
/*
346D5020 - 55 - push ebp <-- prologue
346D5021 - 8B EC - mov ebp,esp
346D5023 - 83 EC 08 - sub esp,08
346D5026 - 8B 45 08 - mov eax,[ebp+08]
346D5029 - 0FB6 40 65 - movzx eax,byte ptr [eax+65] <-- checked bool
346D502D - 85 C0 - test eax,eax
346D502F - 75 25 - jne 346D5056
346D5031 - 8B 45 08 - mov eax,[ebp+08]
346D5034 - 8B 80 A8000000 - mov eax,[eax+000000A8]
346D503A - 83 EC 04 - sub esp,04
346D503D - 50 - push eax
346D503E - 6A 00 - push 00
346D5040 - FF 75 0C - push [ebp+0C]
346D5043 - E8 68F3CDD1 - call 063B43B0
346D5048 - 83 C4 10 - add esp,10
346D504B - 8B C8 - mov ecx,eax
346D504D - 8B 45 08 - mov eax,[ebp+08]
346D5050 - 89 88 A4000000 - mov [eax+000000A4],ecx <-- write clip ammo
346D5056 - C9 - leave
346D5057 - C3 - ret
*/
[DISABLE]
_setAmmoCount:
readmem( setAmmoCount_orig, 6 )
unregistersymbol( setAmmoCount_orig )
dealloc( setAmmoCount )
unregistersymbol( _setAmmoCount ) |
|
|
| Back to top |
|
|
hot12345
Newbie cheater
![]() Reputation: 0
Joined: 23 Mar 2016
Posts: 17
|
| Posted: Wed Mar 23, 2016 2:32 pm Post subject: |
|
|
| SunBeam wrote: | Doesn't look like a tough cookie to me. Just aobscan it that's that
Unlimited Ammo in Clip
| Code: | [ENABLE]
aobscan( _setAmmoCount, 558BEC83EC088B45080FB6406585C0 )
registersymbol( _setAmmoCount )
alloc( setAmmoCount, 256, IAmWeaponRevival.exe )
label( setAmmoCount_orig )
registersymbol( setAmmoCount_orig )
setAmmoCount:
pushad
mov eax,[esp+24] // get weapon pointer from stack (pushad = 0x20 + 0x4)
mov ebx,[eax+A4] // get ammo in clip
cmp ebx,[eax+A8] // check if equal to max ammo in clip
je short @f
mov ebx,[eax+A8]
mov [eax+A4],ebx // if not, update current ammo in clip to max ammo in clip
@@:
mov byte ptr [eax+65],1 // disable clip depletion
popad
ret
setAmmoCount_orig:
readmem( _setAmmoCount, 6 )
jmp _setAmmoCount+6
_setAmmoCount:
jmp setAmmoCount
db 90
/*
346D5020 - 55 - push ebp <-- prologue
346D5021 - 8B EC - mov ebp,esp
346D5023 - 83 EC 08 - sub esp,08
346D5026 - 8B 45 08 - mov eax,[ebp+08]
346D5029 - 0FB6 40 65 - movzx eax,byte ptr [eax+65] <-- checked bool
346D502D - 85 C0 - test eax,eax
346D502F - 75 25 - jne 346D5056
346D5031 - 8B 45 08 - mov eax,[ebp+08]
346D5034 - 8B 80 A8000000 - mov eax,[eax+000000A8]
346D503A - 83 EC 04 - sub esp,04
346D503D - 50 - push eax
346D503E - 6A 00 - push 00
346D5040 - FF 75 0C - push [ebp+0C]
346D5043 - E8 68F3CDD1 - call 063B43B0
346D5048 - 83 C4 10 - add esp,10
346D504B - 8B C8 - mov ecx,eax
346D504D - 8B 45 08 - mov eax,[ebp+08]
346D5050 - 89 88 A4000000 - mov [eax+000000A4],ecx <-- write clip ammo
346D5056 - C9 - leave
346D5057 - C3 - ret
*/
[DISABLE]
_setAmmoCount:
readmem( setAmmoCount_orig, 6 )
unregistersymbol( setAmmoCount_orig )
dealloc( setAmmoCount )
unregistersymbol( _setAmmoCount ) |
|
Thanks for this!
PS: Sunbeam, What means this in your code ;; '@@:'
I'm sorry, I am new in this cheat engine world. I'm learning every day.
|
|
| Back to top |
|
|
SunBeam
I post too much
Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
| Posted: Mon Mar 28, 2016 3:42 am Post subject: |
|
|
@f tells auto-assembler to jump to first occurrence of @@ symbols. It's a label - 'f' from 'forward'.
BR,
Sun
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Mon Mar 28, 2016 7:44 am Post subject: |
|
|
Anonymous labels explained:
| Quote: | FASM supports labels that use no identifier or label name.
@@: represents an anonymous label. Any number of anonymous labels can be defined.
@b refers to the closest @@ that can be found when looking backwards in source. @r and @b are equivalent.
@f refers to the closest @@ that can be found when looking forwards in source. |
- https://en.wikibooks.org/wiki/X86_Assembly/FASM_Syntax
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
