Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Can't create a HP Hack help :(
Goto page 1, 2  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 9:58 am    Post subject: Can't create a HP Hack help :( Reply with quote

I know, it's simple, it's HP in a singleplayer game. Basics of basics lol. But apparently I'm trying to up this and go the scripting route that I've learned from Step 9 from the Cheat Engine tutorials.

OK the problem/story

I found my HP, my allies and even enemies. Essentially all entities use the same write function to decrease their HP. So I've compared all of them in Data Structure form and try to look for Group Differences, sadly there were no group differences out of the base pointer list that I have. So I decided to go back bytes by bytes and eventually I landed on -5 on all addresses and found a group difference between mines and my allies and the enemies group. The only thing that puzzles me is.... How do I write a script that goes back -5 bytes in this situation and then proceeds to follow through with the compare and then the decrease?

My code (which sadly don't work)

Code:
jmp [edi-5]
cmp [edi+A0],62
jne originalcode
nop
jmp exit

originalcode:
fstp dword ptr [edi+000000C0]

exit:
jmp returnhere


Apparently this didn't crash (was kind of happy Embarassed ) but when I hit an enemy or get hit, the game crashes. I have a feeling it's the jmp [edi-5], mind you I understand scripting at a minimum level but can't yet seem to create any of my own. Is the NOP instruction even necessary?

I hope this is enough information
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Mon Dec 14, 2015 10:07 am    Post subject: Reply with quote

You are wanting to compare edi-5, right? If so:

Code:
cmp [edi-5],62  //or whatever
jne originalcode
jmp returnhere


In this example, assuming the value at edi-5 is hex 62 for hero, then the hero will not take damage, but all others will.

Nop is not required in the example that you have provided.
Back to top
View user's profile Send private message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 10:29 am    Post subject: Reply with quote

Hmmm, actually the function that pops up when HP takes a hit from either sides is

Code:
fstp dword ptr [edi+000000C0]


Bringing all the base pointer addresses into Data Structure by erasing C0, I need a consistent stale value, but with the original base pointer I can't find any that makes a differentiation between my allies and me and my enemies, so I tried going back -5 on all addresses and found a difference that is consistent even on reboot.

By going back -5 I notice the consistent value is at A0 from the base pointer, so I went ahead and put

Code:
cmp [edi+A0],62


But then the real problem kicks in, I actually don't know how to work a script that would start from the base pointer at -5.... So with little knowledge I have left, lol, I though if I put

Code:
jmp [edi-5]


It would probably jump back -5 on all base addresses and start from there then goes down to A0 and compares then you know the rest. But apparently it doesn't work out, just figured when new enemies spawn the game crashes as well.

Also how would I implement an AOB scan into this script? I tried putting this under the ENABLE section

Code:
aobscan (HP, all of the aob codes)
registersymbol HP


then DISABLE section

Code:
unregistersymbol HP


I just keep getting an error about the registersymbol not being compatible.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Mon Dec 14, 2015 11:29 am    Post subject: Reply with quote

1. If the original instruction is:
Code:
fstp dword ptr [edi+000000C0]

Then the addresses in the dissect data structures window should be:
address1-C0, address2-C0, et al. (unless you are having CE auto-generate your dissection table, then the base addresses will auto-populate with the correct offset applied)

2. If you are using a new version of CE, then there is a template for auto-creating a script that uses AOB.
Back to top
View user's profile Send private message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 11:33 am    Post subject: Reply with quote

The problem isn't going to the original base of -C0, I've already indicated I've done that, the problem is how do I make a script that implements the start at base pointer with a -5 into a compare at offset A0.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Mon Dec 14, 2015 11:40 am    Post subject: Reply with quote

You haven't indicated anything clearly. Your base address is:

address-0C

If your address for health is:
11110000

and the instruction is:
fstp dword ptr [edi+000000C0]

Then your base address for your health structure is:
1110FF40

In dissection window, you can use:
11110000-0C
or
1110FF40

...they are the same thing.

If what you need to compare is actually at
1110FF40-05

Then all you need to do is write it out like so:
[edi-05]

Because [edi] contains the value at your base address.
Back to top
View user's profile Send private message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 12:03 pm    Post subject: Reply with quote

Oh my gawd... Sigh you still don't get it.
++METHOS wrote:
You haven't indicated anything clearly.

Oh really?
PimpinRice wrote:
Bringing all the base pointer addresses into Data Structure by erasing C0, I need a consistent stale value, but with the original base pointer I can't find any that makes a differentiation between my allies and me and my enemies, so I tried going back -5 on all addresses and found a difference that is consistent even on reboot.

You keep regurgitating the process that I've pointed out 3 times now as if it's the solution when it's clearly not. If anything, it's it shows your inadequacy on grasping a foot of a situation.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Mon Dec 14, 2015 12:11 pm    Post subject: Reply with quote

I am trying to help you. This will go nowhere unless you provide more details.
Back to top
View user's profile Send private message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 12:20 pm    Post subject: Reply with quote

I'm not convinced how?
Back to top
View user's profile Send private message
Rydian
Grandmaster Cheater Supreme
Reputation: 31

Joined: 17 Sep 2012
Posts: 1358

PostPosted: Mon Dec 14, 2015 12:31 pm    Post subject: Reply with quote

Just because you don't understand his advice doesn't mean it's not valid.

edi+000000C0 is the health for all entities, correct? So EDI is the base address of the entity structure, and +C0 (plus C0) bytes from the start of the base is where the health is. (Extra 0's at the beginning don't matter, 0000000010 is the same as 10 for logical purposes.)

The question is what the -5 is from. That's (minus 5). Well... what minus 5? Is the -5 from EDI, or is the -5 from the health address (which is EDI plus C0)?

If you don't know, then give us an example of the addresses. Show us the health address of one entity at a given time, then show us the address of the "-5" thing of that same entity at the same time so we can see what's up.

_________________
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4711

PostPosted: Mon Dec 14, 2015 12:35 pm    Post subject: Reply with quote

I'm not sure you understand what a base pointer is. Do you mean the base of the structure? If so, then I don't know why in the hell you're trying to jump to memory that's not meant to be executed (regardless if it's executable or not). Just compare it with whatever like Methos said.

You really aren't indicating anything clearly. More information will be helpful (i.e. an image of whatever you mean by that minus 5). Here's some definitions that might be of use to you, in case you're confused:
Instruction - an operation the computer performs (i.e. mov, cmp, jmp).
Pointer - An address that stores the value of another address.
Multilevel Pointer - A pointer that points to another pointer that points to another...
Base Pointer - The address of the first pointer in a multilevel pointer.
Structure - a section of memory that stores values related to each other.
Base of the Structure - the address where the structure begins.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 2:42 pm    Post subject: Reply with quote

OK let me try this, again, in steps formation so you guys can probably envision what happened.

1. I scan for my health address
2. I have my health address
3. I click what writes to my health address
4. fstp dword ptr [edi+000000C0] pops up as the instruction
5. I browse that inside the memory viewer
6. I click "find out what addresses this instruction accesses"
7. I went back inside the game to take some hits back and forth
8. I have all my allies and enemies dynamic HP addresses
9. I select all of the addresses inside that window
10. I press CTRL+D to put them into the Data Tree
11. I Notice Cheat Engine already puts them at base level by getting rid of C0
12. I organized them into 2 groups
13. I try to find a consistent value that differentiates me and allies against enemies
14. I can't find shit
15. I put -1 next the all the base addresses that is on the Data Tree inputs. No results
16. I put -2 next the all the base addresses that is on the Data Tree inputs. No results
17. I put -3 next the all the base addresses that is on the Data Tree inputs. No results
18. I put -4 next the all the base addresses that is on the Data Tree inputs. No results
19. I put -5 next the all the base addresses that is on the Data Tree inputs. Results!
20. I turn off my computer
21. I got off my chair
22. I went and cook some ramen in the kitchen
23. I walk through my hallway to turn on the heater
24. I walk all the way back inside my cave
25. I booted up my computer
26. I sat there and waited
27. I booted up the game after waiting
28. I boot up Cheat Engine
29. I rinse and repeat 1 - 19 again
30. I realize the offset of A0 from the base pointer holds the consistent result that I want from the -5 address instead
31. I have everything down
32. I realize the original base pointer, without the -5, at offset A0 isn't showing the consistent value that I want
32. I think the only way for me to compare at A0 inside the script is to take the base pointer and -5 from it
33. I looked almost everywhere, I cannot find any tutorials on tackling this specific situation on creating a script in Cheat Engine
34. I attempted to do some scripting
35. I put jmp [edi-5] first before the cmp function in hopes of it going back -5 from the original base level and in hopes of it using the base pointer of the -5 address instead of the original that doesn't show the consistent value
36. I've written the script I've posted above
37. ....My game crashes when an entity within the game loses HP or spawns
38. I lost hope
39. I thought for a second, I realize there was the forum for Cheat Engine
40. I browsed to this section
41. I created a topic for my situation
42. I got a quick response, thinking it would be an easy solution from some experienced users
43. I thought wrong
44. I got a guy who's telling me that I'm still stuck at steps 10 - 11 and that, that is the problem that I'm having
44. Perhaps he didn't fully understand it, I repeated my problem.
45. Escalates by blaming me for not understanding my situation, the nerves
46. Can't tell if trolling or not
47. Fin! Smile

Time to address some remarks

Rydian wrote:
Just because you don't understand his advice doesn't mean it's not valid.

No, it's not that I don't understand, if anything it's him, and no where have I indicated his "advice" was invalid, it's actually solid, because that's how it should be when asking for on how to find the dynamic base from a dynamic addy (most of the time). But that's just diverging from the main issue by putting that statement out there. As for the rest of the comments, I've actually re-explain it on this post for ya above. And please don't read this thinking this is in any way a condescending tone.

ParkourPenguin wrote:
Here's some definitions that might be of use to you, in case you're confused

I appreciate you taking time to write that, and of course the others who contributed on this thread lol. Anyways if you can readjust to the new formula I've presented on this post about your questions.

Phew, time to go eat my ramen.
Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 152

Joined: 06 Jul 2014
Posts: 4711

PostPosted: Mon Dec 14, 2015 3:12 pm    Post subject: Reply with quote

19: Then just do what Methos said in the first reply to this thread.
++METHOS wrote:
Code:
cmp [edi-5],62  //or whatever
jne originalcode
jmp returnhere

In this example, assuming the value at edi-5 is hex 62 for hero, then the hero will not take damage, but all others will.


30: So, If I'm getting this correctly, you have a pointer to your health (at least a Level 2 pointer), and for some damn reason, if the first offset is A0 (last offset must be C0 because it's the start of the structure), then it's pointing to that different byte. I don't know why this is the case, but whatever.

32: Nevermind everything I just said for 30. So, if I'm reading this right, when you're saying "base pointer", you mean "the base of the structure"? If so, then why would you think the base of the structure minus 4 is the same address as the base of the structure plus A0? I'm no math major, but I'm pretty sure -4 is not equal to 160.

35: The jmp instruction jumps to a spot in memory and executes that code. Of course the game would crash if you try to execute code that's not meant to be executed. I really don't know what you're trying to accomplish by doing that.

43: Well, you're thinking wrong now because you thought wrong before. That is the solution you're looking for. It's not complete, since it doesn't clean up the FPU stack, but it's still the solution.

44: Don't blame other people for your lack of knowledge. I really don't have a clue what you mean by "I actually don't know how to work a script that would start from the base pointer at -5....", or "the problem is how do I make a script that implements the start at base pointer with a -5 into a compare at offset A0". The offset A0 is just coincidental; ignore it, forget everything about it. The cmp instruction only modifies the EFLAGS register. It doesn't modify anything else (i.e. ebx), so nothing is changing.

45: You don't even correctly know what your situation is. You're not even close to understanding it.


Here's some code that'll do what you want:

Code:
cmp [edi-5],62  //or whatever [edi-5] is at your structure
jne originalcode
fstp st(0)
jmp exit

originalcode:
fstp dword ptr [edi+000000C0]

exit:
jmp returnhere


PS: thank you for steps 20-28, that was funny and made reading that worth it.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
PimpinRice
Newbie cheater
Reputation: 0

Joined: 27 Sep 2012
Posts: 19

PostPosted: Mon Dec 14, 2015 3:33 pm    Post subject: Reply with quote

I'm actually very close to knowing what I'm talking about, that's why I was able to repeat the process 4 times without struggling. But on the other hand, you guys..... It's another story. Laughing But yeap still blaming me though, I don't mind.


I'mma try that code, even though I know it won't work because I'm not asking to compare edi-5 at all but rather the compare of A0 from edi-5, explained the 5th time Cool and I'mma come back over here screeching like you've never heard before for wasting my time.
Back to top
View user's profile Send private message
++METHOS
I post too much
Reputation: 92

Joined: 29 Oct 2010
Posts: 4197

PostPosted: Tue Dec 15, 2015 12:16 am    Post subject: Reply with quote

PimpinRice wrote:
I'mma come back over here screeching like you've never heard before for wasting my time.
-Just set a breakpoint on the instruction that handles your life and write a script that will give you unlimited coloring books and ramen noodles.

I mean, if you want to continue trolling... Very Happy
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites