Cheat Engine

robboten · How do I cheat? Reputation: 0 Joined: 08 Feb 2020 Posts: 3

Am trying to learn by watching tutorials and messing about. I can do basic things but still having trouble with code injection. For example I try to make a god mode or smt similar for Witcher 1. But as soon as I get into a fight with the script the game crashes. And I can't understand why. Super frustrating.

Could anyone help me to see what I am doing wrong?

It should be super simple, but it seems not.. I have tried different kinds of stuff between jne and jmp in newcode. Like removing the movss/mov altogether. Getting max health and mov into esi+48 (health) and some more. All with same result. I have confirmed the adresses several times. 'Wied' is part of a string I use to identify if the one hit is me or someone else. Health is a float.

ParkourPenguin · Posted: Mon Feb 10, 2020 1:38 pm Post subject:

jcc instructions like je and jne conditionally jump to somewhere else. They do this by reading from a special register called EFLAGS (RFLAGS on x64). This register stores information about results from other instructions among other things.

Instructions like cmp and test will set certain bits in EFLAGS to show what the "result" of the instruction is. e.g. cmp will set ZF in EFLAGS if the two operands are equivalent. Later on, instructions like je will check EFLAGS for these values to see if it should jump or not. In the case of je, it will jump if ZF=1 and not jump otherwise.

Some instructions don't modify EFLAGS at all, such as movss. Interleaving such instructions between instructions that set and read EFLAGS can make the code run slightly faster for reasons I won't get into. This is what's happening at the injection point:

robboten · How do I cheat? Reputation: 0 Joined: 08 Feb 2020 Posts: 3

Thanks a lot! That is very interesting! I looked at another code to see how they did it and I didn't understand why they used pushfd before the changed code. I looked it up but didn't understand about the eflags. I am guessing that is another way of working around it, is that right?

I started hacking the game because I was bored with the fights. Now hacking it is much more fun than playing it haha.

Thank you again!

ParkourPenguin · Posted: Mon Feb 10, 2020 2:24 pm Post subject:

Yes. pushfd (pushfq on x64) will store EFLAGS on the stack, and the corresponding pop instruction will restore it from the stack.

I didn't mention it because there's almost always a solution I'd consider to be better, but you should use your discretion.

robboten · How do I cheat? Reputation: 0 Joined: 08 Feb 2020 Posts: 3

Ok, thanks for confirming anyway. Have tested your solution now and it works great! Now off for more exploring! Very Happy

Next up is one hit kill and some more. Am also trying to map out the structure for where the base pointer is pointing at. Tricky but fun!