Cheat Engine

[kmahon99]

Hi folks,

As you can probably tell I'm new to game hacking, but I've been programming for a while now (I study Computer Science), so I know what a pointer is, but for the life of me I can't get them working in CE.

So I'm trying to have a bit of fun with Crash Bandicoot (my favorite game!) by hacking some of the basic stats, namely the number of lives I have.

As the lives are a dynamic variable I've decided to make a pointer that I can save and use again when I change levels (this re-initializes the value to somewhere else in RAM). I looked up tutorials on how to do so, and I ended up with a pointer that gives a large integer value which is clearly not what I want, so here's what I did:

-Found the address of the lives/verified it's the one I need to create a pointer for

-Right clicked and checked what was writing to that address

-I got 1 function, which I double-clicked and viewed

This is where it stopped being familiar with the tutorial video, the given function was the following:

mov [eax + edx], ebx;

Now I can understand assembly well enough, and I'm aware that the video will have different code to me, but every tutorial I've viewed has an instruction which contains a raw numeric offset, here it's just 2 registry addresses, so I'm not sure if I should treat this the same, but here's the rest of what I did:

-The dialog says that the pointer I need is probably 061F2020, so I search this in the main CE window.

-I get 8 results, the top one is green so it's a static address, so I go for that one.

I enter a new address manually and check 'pointer'. I put the number of the 1st result's address in for the base address, but then I'm unsure about what needs to be the offset. I know it's whatever is added to the address that is taken from the dialog to be searched (i.e 061F2020), but I notice that that address is actually EDX, and the only thing added to that (according to the memory viewer) is EAX. I assume EAX is the offset so I put that in, but I get that large integer value I mentioned previously.

What's odd about this pointer is that, even though it looks to be pointing to the completely incorrect location, when I change it's value the lives counter appears at the top of the screen and quickly decrements by 1 and then resets itself to the previous value. So the pointer seems to be affecting the lives count, but doesn't actually change it, which is what's really confusing about this.

Hope someone can help, I'm sure it's just a simple mistake.

[Rissorr]

Your offset is probbly EDX , to find what value stored in edx just watch in the "What acsesses this address" window the value of EDX for exemple:

EDX=00000064

or

EDX=0006BB93

copy that value, this is your offset.

P.S
if i was in your situation, i would use the Pointer Scan.

or writing an script with AOBSCAN for the

[kmahon99]

Thanks for the reply,

The only issue is that in the instruction

[Daijobu]

If [eax+edx] holds your value and ebx is being moved into it you want to get the address of [eax+edx], right?

Add edx to eax at that location to get your address. Or load the effective address of [eax+edx] into a var.

[kmahon99]

Hmm, still no luck here.

It makes sense to me that the contents of EBX is being put into the address at EAX + EDX, but when I add both with a calculator and put the number in as the base address for my pointer (with no offset) I get 6200, which is the address of EBX.

Here's the addresses I'm working with:

EAX: 9E808
EBX: 6200
EDX: 61F2020

The static address I found to contain EDX is: 571A5C

Can anyone possibly construct the correct pointer for this data given the code:

[Daijobu]

You don't want the value, you want the address of [eax+edx].

e.g.:

[kmahon99]

Sorry, I might be just confusing myself here, but maybe you can clear this up for me?

If I want to find the address of [eax + edx] (and not the value), do I just add their addresses together to get the location of the value I want? I think that's what I did the last time, but to be honest I think I'm just making this harder than it seems to be...

Thanks again

[Daijobu]

That would do the same. But smarter people on these boards might be able to be of more assistance.

[Gniarf]

[kmahon99]

Alright, so I was just messing around with the numbers and, despite inputting the exact same addresses for the pointer, for some reason this time it pointed to the correct value

What annoys me about this is that I decided to try the same on the fruit score, but after trying the same method I get the same problem I had previously. I had 5 fruit, I scanned for function accesses and got the same instruction, [eax + edx], ebx; and then I searched the recommended pointer address. I found a green/static address in the results list and used it's address to create a pointer with the offset being EAX, as with the previous lives example. But the number the pointer points to is a very large number, 1540 or something like that.

This issue has the same characteristics as the previous one did. I created the pointer anyway and decided to change the value of it to see what happened. This time when I change the pointer's value, the fruit value changes to 0, regardless of what I put in. If I try to change the original fruit value from the dynamic address, the pointer's value changes to something really large, like +1200.

Could there be something else going on here? I find it odd that my method was actually correct all along as the lives pointer works properly now, but I can't see why it suddenly started pointing to the right value and now the fruit value is experiencing the same issues...

[Gniarf]

So you found fruit address, probably using exact value searches and you are trying to get a pointer to it.
Make sure your pointer points to fruit address (same address in the address column) and not something close but 1-3 bytes different.
Make sure the both cheat entries (the one with and the one without pointer) use the same datatype.


If you had 6 fruits when your pointer was displaying 1540 then you made a typo in the pointer's topmost offset, increase it by 1.

[kmahon99]

[Gniarf]

[kmahon99]

Thanks for the explanation, although it's less likely, I'd say it was the batch writing that caused it. As I did copy all the addresses rather than write them by hand.

But I'm finding that all the pointers I've saved to the cheat table aren't retaining the correct value after restarting. The most volatile value seems to be the pointer to the Y position, which actually changes after each level load. Might this be a problem caused by the emulator? I know you said you don't deal with them much but any thoughts are appreciated.

I have noticed that the register addresses change after each launch (i.e. EAX, EBX etc.), might this indicate some sort of internal emulated memory management that won't allow pointers to consistently reference the same data? Or is this an issue that can be caused by something else?

Thanks for the help so far

[Gniarf]