 |
Cheat Engine The Official Site of Cheat Engine
|
View previous topic :: View next topic |
Author |
Message |
Irwin Banned!
Reputation: 1
Joined: 04 Feb 2007 Posts: 0
|
Posted: Fri Mar 02, 2007 10:50 am Post subject: In-Depth Tutorial On Finding Godmode |
|
|
Hey everyone!
Today I'm going to teach you how to find "god-mode" (invulnerability to all attacks). Now, "god-mode" can be found in many ways using Cheat-Engine & there's really an infinite amount of methods you can use to get to achieve the same result but I'm going to show you what I believe to be the three main methods;
Knock-back/blink Exploitation (Most likely to work)
HP Exploitation
Collision Nullification (Requires usage of method #1)
1. Knockback/blink exploitation
In most games when you get hit there's a certain amount of time in which you're unable to get hit. When you're in a tight situation & if you were to stay in one the same location as many many monsters, you'd be barraged with constant hits. By implimenting a timer that makes you temporarily invulnerable it can also create a huge security flaw, this is because the timer can be frozen which can make users permenantly invunlrerable. (note: you'll have to take one hit for it to activate) The easiest method of finding an exploit for this in a game with a blink/knockback timer is to find the boolean or the variable that defines your state. This can be done with Cheat Engine but it requires speed/pausing the process. You can do the following:
1. Stay in a stationary & safe position (away from anything that can force you to blink) & then search for an "Unknown Initial Value" with Cheat Engine.
2. Now go & get do something to get put into a blinking state then quickly search for a changed value.
3. Repeat 2-3 until you have a few addresses then check to see if they're triggered by going into that blinking state.
Now we should have some very useful addresses when it comes to the blinking state. There are usually two ways of setting the blink state as I said before. There may be a boolean (possibly a 0 when in an idle state & a 1 when blinking) or there may be a speed for the interval between blinking (usually increases when getting hit) you should freeze them when you're in the blinking state. You may have just discovered "blink god-mode" in your game!
If you've discovered the hack then congratulations However for those of you who have discovered that you disconnect when trying this there's probably a check to see if you always have the boolean/blink speed at the same value but don't fret! Although you may not be able to change the variable without disconnecting you can have the variable change and still stay in the blinking state. To do this we must do some memory editing (beware, some games check to see if the memory has been modified). Right click on the variable that you usually freeze & click "Find out what accesses this address". Now go & get hit then wait a few seconds... You should see a few things appear, we're hoping for an instruction with a MOV or a CMP. For any MOVs. We should look for an instruction which stores the value of the blink-state variable in a register. (so something alone the lines of MOV EAX, [400300]) Then after that there should be a TEST or a CMP which checks the register which the value of your blink-state is stored in. After that we'll be looking for a condition jump like JNE, JE, JA, etc. Here's an example of what we'll be looking for:
Code: | MOV EAX, [400300] // Moves the value of the blink-state into the EAX register
CMP EAX, 0 // Checks to see if the blink-state is true (in boolean values, 1 usually = true). It may skip the MOV & just CMP [400300], 0
JNE 400400 // Jumps if blink-state is true |
As you can see, this will check if the value of your blink-state is 0 (example of a boolean check) and if it isn't 0 (disabled) it will jump to the "blink activator". Now, how do we fix this?! Well, in this case we turn the JNE into a JMP or we can make the EAX (in the CMP or the MOV) a 0 by setting a debug register. This may vary in other cases but you get my drift, it involves changing the jump or the CMP. (CMP is much better because changing jumps can be dangerous)
2. HP Exploitation
Well this is a bit easier but less likely to work because it's much more orthodox & generic to check the client's HP value to that of the server. There are many ways of doing this;
Stop HP From Changing
Stop Death Sequence From Occuring
Decrease Damage Taken
i) Stop HP From Changing
This is pretty straight forward, simply look for your HP value then freeze it (note: there may be a few, some for GUI elements [HP bar, etc] & the real one)
ii) Stop Death Sequence From Occuring
Well, you can look for a CMP or a MOV;
Code: | MOV EAX, [600300] // Moves HP value into EAX,
CMP EAX, 0 // Compares HP to 0, can skip MOV by doing CMP [600300], 0
JE 600700 // Death Sequence |
As shown, the HP is compared to 0 and it will jump to the death sequence if the HP is equal to 0. Another way of doing this is to check for a boolean for death and then freezing it.
iii) Decrease Damage Taken
Two methods:
The first method involves the following following: Get hit then search for the damage that you had just taken, then get hit again and do it again. You should end up with a value, freeze it at 0. (This may result in a "miss-mode" effect)
The second method involves looking for what reads to the HP address and then looking for some kind of decrease which will eventually bring apon the DEC operand, look for something like this;
Code: | MOV EAX, [500300] // Moves value of HP into EAX register
SUB EAX, ECX // Subtracts ECX from EAX |
You can easily combat this by changing ECX into a 0 or using a deub-register to change the value of ECX into 0. Hopefully now you'll have a working damage reduction hack
3. Collision Nullification
This is probably the best variant of god-mode because it stops you from getting hit at all simply due to the fact you don't collide with the monsters in the first place. The concept revolves around the idea that there's a boolean to see if you're currently in contact with a monster & if so it initiates the damage calculation. We combat this by trying to find the boolean then freezing it or manipulating it. We can find the boolean by doing the following;
1. Stay in a stationary & safe position (away from anything that can hit you) & then search for an "Unknown Initial Value" with Cheat Engine.
2. Now go & stand on/over a monster then quickly search for a changed value.
3. Repeat 2-3 until you have a few addresses then check to see if they're triggered by touching monsters.
After this we'll have a value that we may be able to freeze to achieve a state in which we don't get hit We can also do this by changing a CMP/TEST or a conditional jump, we should look for something like the following:
Code: |
MOV EAX, [430100] // Address storing boolean for contact with monster
CMP EAX, 1 // Checks if you are touching a monster, can be CMP [430100], 1
JE 400100 // The code to initiate damage calcuation |
We can stop this from jumping by NOPing it (making the jump a no-operation instruction). This will potentially result in a god-mode
Shoutouts:
SunBeam - Coolest guy on CEF
Labyrnth - Haven't met you but a moderator at gamehacking.com must be cool!
appalsap - Coolest female on CEF
Renko - So I won't get nagged for not including him.
Joseph - So I won't get nagged for not including him.
Distribution Rights:
This may only be distributed with credits to me
x0r - 2007
Last edited by Irwin on Wed Dec 23, 2009 11:25 am; edited 4 times in total |
|
Back to top |
|
 |
Maverick Master Cheater
Reputation: 0
Joined: 24 Dec 2006 Posts: 451
|
Posted: Fri Mar 02, 2007 11:15 am Post subject: |
|
|
Nicee ;D This helps alot
|
|
Back to top |
|
 |
furiosity Master Cheater
Reputation: 0
Joined: 03 Oct 2006 Posts: 448 Location: The Netherlands
|
Posted: Fri Mar 02, 2007 11:36 am Post subject: |
|
|
Imma test it out on some games.
|
|
Back to top |
|
 |
Renkokuken GO Moderator
Reputation: 4
Joined: 22 Oct 2006 Posts: 3249
|
Posted: Fri Mar 02, 2007 12:59 pm Post subject: |
|
|
Great job, but I don't nag. I bitch.
|
|
Back to top |
|
 |
GameSpy Grandmaster Cheater
Reputation: 0
Joined: 18 Aug 2006 Posts: 744 Location: Europe
|
Posted: Fri Mar 02, 2007 1:39 pm Post subject: |
|
|
*CLAP CLAP* This is way better than Exidis bragging about his vac. Great TUT.
_________________
If it can be done, it will be done. |
|
Back to top |
|
 |
FrozenLightningHacker Expert Cheater
Reputation: 0
Joined: 05 Nov 2006 Posts: 219 Location: Wherever you want me to be
|
Posted: Fri Mar 02, 2007 2:32 pm Post subject: |
|
|
GameSpy wrote: | *CLAP CLAP* This is way better than Exidis bragging about his vac. Great TUT. |
Ditto
|
|
Back to top |
|
 |
DeadOrAlive I post too much
Reputation: 0
Joined: 12 Apr 2006 Posts: 4852 Location: Inactive
|
Posted: Fri Mar 02, 2007 7:17 pm Post subject: |
|
|
Oh wow. Finding godmode and other stuff. This is really useful [/sarcasm]
|
|
Back to top |
|
 |
Irwin Banned!
Reputation: 1
Joined: 04 Feb 2007 Posts: 0
|
Posted: Fri Mar 02, 2007 8:19 pm Post subject: |
|
|
DeadOrAlive wrote: | Oh wow. Finding godmode and other stuff. This is really useful [/sarcasm] |
Oh wow, you're an idiot. This is useful for games that may not have godmode discovered yet & it's also useful for other people who wish to learn. GTFO you ignorant punk.
Last edited by Irwin on Wed Dec 23, 2009 11:25 am; edited 1 time in total |
|
Back to top |
|
 |
furiosity Master Cheater
Reputation: 0
Joined: 03 Oct 2006 Posts: 448 Location: The Netherlands
|
Posted: Sat Mar 03, 2007 7:53 am Post subject: |
|
|
x0r could you help me finding godmode for a game called Conquer online, I have tried many things non have worked so far. So if you have some spare time, and willing to help me, then contact me.
|
|
Back to top |
|
 |
Irwin Banned!
Reputation: 1
Joined: 04 Feb 2007 Posts: 0
|
Posted: Sat Mar 03, 2007 8:05 am Post subject: |
|
|
furiosity wrote: | x0r could you help me finding godmode for a game called Conquer online, I have tried many things non have worked so far. So if you have some spare time, and willing to help me, then contact me. |
I'll download it & then do some experimentation, after I do my tests I'll give you hints
Last edited by Irwin on Wed Dec 23, 2009 11:25 am; edited 1 time in total |
|
Back to top |
|
 |
furiosity Master Cheater
Reputation: 0
Joined: 03 Oct 2006 Posts: 448 Location: The Netherlands
|
Posted: Sat Mar 03, 2007 11:02 am Post subject: |
|
|
Thx i really appriciate that you say hints, i hope you can point me in the good direction. Thanks
|
|
Back to top |
|
 |
Labyrnth Moderator
Reputation: 9
Joined: 28 Nov 2006 Posts: 6285
|
Posted: Sun Mar 04, 2007 8:08 pm Post subject: |
|
|
.:Bumped:.
Seeing allot of question about this.
_________________
|
|
Back to top |
|
 |
TheSorc3r3r I post too much
Reputation: 0
Joined: 06 Sep 2006 Posts: 2404
|
Posted: Wed Mar 07, 2007 11:34 pm Post subject: |
|
|
Completely useless tutorial ; you took an extremely simple concept (which could be explained in a few paragraphs), and turned it into a multi-page essay that ultimately adds up to nothing.
You dressed it up with color to cover the fact that it has no meat, put shout-outs for no obvious purpose other than arrogance (along with the distribution right BS), and posted it in tutorial requests.
Not only are you arrogant, you're also rep-whoring.
It's beginning to show, more and more, that the only special talent/threat you have is DDOSing (which can be found by googling).
You will most likely respond to this with completely irrelavent insults that you can't back up (like you do with every person that dares to question your superiority).
Changing your name won't change the asshole you are, Irwin.
_________________
Don't laugh, I'm still learning photoshop! |
|
Back to top |
|
 |
Ungreat Expert Cheater
Reputation: 0
Joined: 27 Feb 2007 Posts: 215
|
Posted: Wed Mar 07, 2007 11:40 pm Post subject: |
|
|
This whole thing is plain logic This post is only relevant to those who didn't know that 'godmode' is when you can't die due to a form of invincibility.
I even pointed out to you on MSN when your ASM looked incorrect, and you proved to me that you didn't know your ASM correctly (or at least not even understand pointers correctly) when you replied (on MSN that is.)
Code: | MOV EAX, [600300] // Moves HP value into EAX,
CMP [EAX], 0 // Compares HP to 0, can skip MOV by doing CMP [600300], 0
JE 600700 // Death Sequence | Lol look, it is still there!
Edit: Err... I'll break down how he fucked up for you. This is about the very first thing you learn in ASM after you learn what a register is. x0r is fucking up on value tags: why are we learning from him? Lol
his comment: Code: | // Compares HP to 0, can skip MOV by doing CMP [600300], 0 |
Ok: Lets look at the ways we can do this...
Like he said, you can do:
Code: | cmp [600300],0
JE 600700 | at least he got the comment right
his code, however...
Code: | MOV EAX, [600300] //gets the value heald at 600300 (like 233 for low health)
CMP [EAX], 0 // compares the value of the address 233 to 0
JE 600700 //jump if equal. By the way: you would crash before getting here. could not be "read" exception. 233 is inexistant memory | Some of you might be thinking 'oh well people could make simple mistakes like that' ... first of all: not someone as pro as x0r says he is... also: not even a complete noob to ASM would make that mistake if they understood what the value tags ( [ ] ) do.
And the worst part about it: I already told him/warned him in MSN that he had messed up! After I warned him is when he added a comment that further told you that he fucked up (the cmp [600300],0 comment.)
the real way to do this that he meant was either
Code: | mov eax,600300
cmp [eax],0
je 600700 | OR Code: | mov eax,[600300]
cmp eax,0
JE 600700 |
You fucked up at the basics x0r No wonder this tutorial is on finding the most basic hack
edit for a laugh:
Code: | MOV EAX, [430100] // Address storing boolean for contact with monster
CMP [EAX], 1 // Checks if you are touching a monster, can be CMP [430100], 1
JE 400100 // The code to initiate damage calcuation | hey look, he didit again! xD (That rules out the 'oops, I put some bracket on by accident' assumption that I mentioned earlier forthose that don't know much ASM)
_________________
Code: | mov r10, qword ptr [rsp+0A28h+arg_5F8]
shl rdx, 20h
mov r11, 7010008004002001h
or rax, rdx
mov rcx, r10
xor rcx, rax
lea rax, [rsp+0A28h+var_2C8] | Oh man, I'm getting too excited |
|
Back to top |
|
 |
TheCrow Cheater
Reputation: 0
Joined: 26 Nov 2006 Posts: 25
|
Posted: Thu Mar 08, 2007 12:23 pm Post subject: |
|
|
thx! its very helpfull
_________________
|
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|