Cheat Engine

CiaoCiaoxD · Newbie cheater Reputation: 0 Joined: 13 Dec 2013 Posts: 23

Where should I put the question marks about the bytes? I read aobscan istruction, except that I did not understand things because they are of another language ..
That is, I do not know what I mean, I mean that some put in the byte "?" but how do they put them, because they put them right at that byte?
Summary: I have not figured out how to put the "?" question marks, ie the bytes that change in restarting the flash player
eg: (in another signature bytes)
D9 ? ? ? ? C3 ? ? ? ? ? ? ? ? ? ? ? ? 8B 10 (A signature bytes invented xD)
Please let ask for help, if you help me
[/quote]Dark Byte
Dark byte help!

Dark Byte · Posted: Mon Dec 30, 2013 12:19 pm Post subject:

this would give a signature of 89 4a 10 8b 4d f0 89 0d ** ** ** ** 8b e5 5d c3

A general rule of thumb: if the 4 bytes are grouped without a space, there is a good chance you need to put a wildcard there

CiaoCiaoxD · Newbie cheater Reputation: 0 Joined: 13 Dec 2013 Posts: 23

[quote="Dark Byte"]this would give a signature of 89 4a 10 8b 4d f0 89 0d ** ** ** ** 8b e5 5d c3

A general rule of thumb: if the 4 bytes are grouped without a space, there is a good chance you need to put a wildcard there[/quote]

Ah, so I have to help with the 7-bit encoding (ASCII)
Thank you so much Smile

edit:
But then only the spaces are worth a wildcard?
or even points etc..?
Dark Byte?

Dark Byte · Posted: Mon Dec 30, 2013 12:33 pm Post subject:

no , the disassembler.
It writes the bytes as 89 0d 50e0001c

Because there are no spaces between 50 e0 00 and 1c, it indicates that the belong to eachother. And if the value those bytes make up is bigger than 65536, there's a high chance it's an address specifier, which means it can change next time

CiaoCiaoxD · Newbie cheater Reputation: 0 Joined: 13 Dec 2013 Posts: 23

[quote="Dark Byte"]no , the disassembler.
It writes the bytes as 89 0d 50e0001c

Because there are no spaces between 50 e0 00 and 1c, it indicates that the belong to eachother[/quote]

But sometimes I see that the bytes C3 CC CC CC CC CC CC CC CC CC etc.. Up to 00 00 to restart the flash player become C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC 00 00
and bytes are getting longer, so my scan in Array of Bytes will fail because it will not find the signature
however, in summary: bytes attached may be static byte? type 14ECFFA9

Dark Byte · Posted: Mon Dec 30, 2013 12:42 pm Post subject:

everything after c3 is unrelated to the function. (it's the end marker)
Especially cc cc cc is useless which should be discarded (not scanned for)

CiaoCiaoxD · Newbie cheater Reputation: 0 Joined: 13 Dec 2013 Posts: 23

[quote="Dark Byte"]everything after c3 is unrelated to the function. (it's the end marker)
Especially cc cc cc is useless which should be discarded (not scanned for)[/quote]

Dark but only the bytes bytes bytes without spaces may be static?
If yes, i have resolved Smile

P.S. Can you give me ASM finder tutorial? (how to use ultimap)

Rydian · Posted: Mon Dec 30, 2013 11:09 pm Post subject:

Yeah, stuff like the above is generally what you want to wildcard because references to an address like that will change between runs (or between game updates).

CiaoCiaoxD · Newbie cheater Reputation: 0 Joined: 13 Dec 2013 Posts: 23

Okay.
I understand..
Thanks. Smile

P.S. That script you've done is not good :\

Rydian · Posted: Wed Jan 01, 2014 12:27 am Post subject:

It's used as an example in my tutorial, and the screenshot there is before improving the signature, it's to show what you target for wildcarding.