Cheat Engine

Doctor Death · Posted: Sun Jan 25, 2015 5:13 pm Post subject: Questions Relating to Assembly

What does it mean when you do "eax+21" or "ebx-004"?

What is a pointer?

What is an offset?

This one, is a bit complicated: So I'm trying to get unlimited bombs on this game, so I find the address for the value of bombs I have, but when I have to restart the client (usually because of a crash) the address is always different. But one thing I notice, is that it always ends with "44".
How come it changes every time I restart, and how come the end of the address is always the same?

Dark Byte · Posted: Sun Jan 25, 2015 5:34 pm Post subject:

Doctor Death · Posted: Sun Jan 25, 2015 5:39 pm Post subject:

Dark Byte · Posted: Sun Jan 25, 2015 6:45 pm Post subject:

code injection is based on editing the code
Code is usually a static address that can be found by using the base address of the module it's loaded at and a specific distance.
An alternate method would be to look for a signature of that code (since code doesn't change at runtime) and find it that way.

Once found they do a code injection to store registers the code accesses and then work with that. (e.g they get the address of player, then add 0x44 to it go get the number of bombs)

--
Now, an alternate method besides code injection which is quite complex for a beginner, are pointers.
Pointers begin at a known location in memory that never changes, and they point to a path of other locations that eventually result in the address you're interested in
Pointers can be done quite easily. Using some manual debugging, or even easier, the pointerscan

The pointerscan is easy to use, just let it scan for your address, restart the game, find the address again, do a rescan for for the new address and you'll have a bunch of pointer paths that stayed the same during a restart of the game.
Note though that while pointerscan is easy to use, it can take a long time and WILL eat up every bit of RAM your system has, and then some.
Also, depending on the game, the default settings may not be good enough. Sometimes you need to increase the max offset and level if you find out it didn't find anything, but increasing them will increase the time to scan exponentially as well

Doctor Death · Posted: Sun Jan 25, 2015 8:19 pm Post subject:

Dark Byte · Posted: Sun Jan 25, 2015 8:34 pm Post subject:

memoryview->tools->pointerscan. Or just rightclick the address in the bottom addresslist and choose pointerscan

Doctor Death · Posted: Sun Jan 25, 2015 9:36 pm Post subject:

Dark Byte · Posted: Sun Jan 25, 2015 9:39 pm Post subject:

Using the debugger to find the offsets and then randomly picking an address hoping it's being used and continue from there. (it's complex)

try the cheat engine tutorial step 6 and 8

Doctor Death · Posted: Sun Jan 25, 2015 9:47 pm Post subject:

Doctor Death · Posted: Sun Feb 01, 2015 3:50 pm Post subject:

Dark Byte..

Let's say I found a static address that contains a pointer, that ALWAYS points to an address holding a game's time.

How would I make an AA script that will nop that time address, no matter how many times I restart the game?

Dark Byte · Posted: Sun Feb 01, 2015 4:02 pm Post subject:

Doctor Death · Posted: Sun Feb 01, 2015 4:20 pm Post subject:

Dark Byte · Posted: Sun Feb 01, 2015 4:25 pm Post subject:

then use a memory record entry as shown in that screenshot

those are offsets, they describe the path to the address. But if as you say you found a static address that points to the specific address with no difference, then the offset is 0 and only 1 offset

Doctor Death · Posted: Sun Feb 01, 2015 4:30 pm Post subject:

Dark Byte · Posted: Sun Feb 01, 2015 5:06 pm Post subject:

once you have a memory record to a static pointer, you never have to modify it again (until the game gets an update)