 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
Posted: Fri Dec 25, 2020 2:37 pm Post subject: One Punch Man : A Hero Nobody Knows ( SAITAMA ARRIVAL TIME ) |
|
|
Hello Everybody, Merry Christmas to y'all .
Here is my issue :
For those who knows the game, there is a timer berfore saitama can enter the battle ( 300 seconds before his arrival ) .
When I searched for this value ( 4 bytes ) , I found 2 values ( which change when the battle or the game restart ), so it is not a static value at the beginning. I tried to change the values, but it doesn't affect the timer in the game .
In order to find the value(s), i used the " pointer scan for this adress " , the rescan memory and the pointer scan option ( setting the maximum offset level value to 4 instead of 7 by default ) and for both values, i found about 100 adresses in total . I added all these adresses in the table list .
When i close the game and restart it, i use the table ( the 100 adresses ), they show the same value displayed from the timer in the game ) . So, this means that I found the right adresses, correct me if I am wrong about this .
The big issue is, when I try to change the values, the timer in the game does not change, even when i freeze it .
I don't know at all where am I wrong .
Any Tips would be qui wonderful from you, thanks in advance .
|
|
| Back to top |
|
 |
OldCheatEngineUser Whateven rank
Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Sat Dec 26, 2020 12:26 am Post subject: |
|
|
possibilities:
1. you did not find the real value
2. an instruction constantly writing to stamina address, which you can fix by code injection. (also try NOPing the instruction that writes to this value)
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
| STN wrote: | | i am a sweetheart. |
|
|
| Back to top |
|
 |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
Posted: Sat Dec 26, 2020 7:14 am Post subject: |
|
|
Indeed . I really think that i have to start from this step, as the picture describe it . My issue is surely, as you wrote it, the code injection step .
If i understand well, i have to change one of these codes using the code injection, right ?
The only thing is, what code do i have to put instead in order to force the timer directly to 0, or even decreasing the timer for instance 100 seconds each seconds, which means 3 seconds to wait in total from the beginning of the fight, knowing that the numbers of seconds is 300 by default ?
| Description: |
|
| Filesize: |
146.27 KB |
| Viewed: |
5183 Time(s) |

|
|
|
| Back to top |
|
 |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
Posted: Sun Dec 27, 2020 10:49 am Post subject: |
|
|
| Saitama-sama wrote: | Indeed . I really think that i have to start from this step, as the picture describe it . My issue is surely, as you wrote it, the code injection step .
If i understand well, i have to change one of these codes using the code injection, right ?
The only thing is, what code do i have to put instead in order to force the timer directly to 0, or even decreasing the timer for instance 100 seconds each seconds, which means 3 seconds to wait in total from the beginning of the fight, knowing that the numbers of seconds is 300 by default ? |
| Code: | | cmp dword ptr [rbx+00000080],-01 |
If we talk about a timer, this means that each seconds, we have -01 . But even if i put something like | Code: | | cmp dword ptr [rbx+00000080],-12C | or | Code: | | sub dword ptr [rbx+00000080],-12C | or | Code: | | add dword ptr [rbx+00000080],-12C | , it doesn't afffect the timer right, that's to say the timer become a little bit buggy ( seeing two timer one over the another ), but the timer goes down normally as it use to . On my mind, i have to use the auto assembler and change it, but which one and replace it by which code ?
Unless i misunderstood something, thing which is really likely .
| Description: |
|
| Filesize: |
107.45 KB |
| Viewed: |
5102 Time(s) |

|
|
|
| Back to top |
|
 |
OldCheatEngineUser Whateven rank
Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Sun Dec 27, 2020 11:38 am Post subject: |
|
|
can be either one, but since the first one (end with D90) is accessed by a CMP instruction then that address might be the one.
select "mov [rbx+80],r9d" and replace it with NOPs, see what happens.
if the timer stops and saitama didnt arrive even after 10 minutes then that is it.
and all you need to do and create a script that either zeros R9 register or put 300 depending on what you want.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
| STN wrote: | | i am a sweetheart. |
|
|
| Back to top |
|
 |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
Posted: Mon Dec 28, 2020 10:55 am Post subject: |
|
|
Before anything, i really appreciate your help .
So, let's resume :
- In order to find the timer's adresse(s), i search for the value displayed by the timer .
- I find two 4 bytes adresses ( And no Float values as we can see quite often for timer's values ) .
- I Find out what access this adresses for the two values . Even when i restart the game, i find the same values from the option " find out what access " for the both adresses . ( The screen i already uploaded earlier ) .
- I tried to NOP's each adress ( from the screen i posted before ) and the timer does not stop, unfortunately .
- In the other hand, when I take a look in the Disassembler from this line " | Code: | | 7FF61AD59963 - 83 BB 80000000 FF - cmp dword ptr [rbx+00000080],-01 | " .
So I find this line in the Disassembler :
| Code: | | OPM.exe+4F9963 - 83 BB 80000000 FF - cmp dword ptr [rbx+00000080],-01 { 255 } | . Same code i find even when i restart the game repeating every steps .
- I tried to NOP it from the " Auto Assemble " option as well, but it does not stop the timer . I noticed that when i change the " "with the Auto Assemble and Code injection into 0 ( in DEC ), 3E7 ( in HEX ), 999 ( in DEC ) as you advised it to me, the timer not only don't stop, but we can see two timers in the same place ( a little bugged I would say ) .
- Well, I also noticed something quite interresting . In the Desassembler, from the line " | Code: | | OPM.exe+4F9963 - 83 BB 80000000 FF - cmp dword ptr [rbx+00000080],-01 { 255 } | " ( 255 being in the comment section ), right click on this line and choose the option " Find out what adresses this instruction accesses " , a window appear ( accessed adresses by " 7FF61AD59963 " let the timer going down a little bit and i find one adress : " 240F18130E0 " with the same value than the timer . I tried to change it to 0,as well but nothing happens .
And when i browse this memory region, I noticed in the right bottom from the memory viewer, the line in text ( " J1, un heros approche ! ( i'm french that's, why ) and it means " a hero is coming " ) , thing which appears when the Saitama timer's arrival starts . So, i am not far from the result i am looking for .
I'm still working on it, but that's tougher than i thought ... but again i really thank you for you help . I am even ready to donate if i succeed !
| Description: |
|
| Filesize: |
190.94 KB |
| Viewed: |
5064 Time(s) |

|
|
|
| Back to top |
|
 |
OldCheatEngineUser Whateven rank
Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Mon Dec 28, 2020 11:48 am Post subject: |
|
|
| OldCheatEngineUser wrote: | | select "mov [rbx+80],r9d" and replace it with NOPs, see what happens. |
NOPing CMP instruction wont help you, and ignore the CMP for now.
| Code: | RSI = EAX;
if ( TIMER_1 == -1) {
TIMER_1 = R13D; /* whats in R13? */
TIMER_2 = R12D; /* whats in R12? */
}
ECX = TIMER_2;
/* ... */
_3BF980(RCX, RDX, R8, R9); |
also see what happen when you NOP the Jcc instruction at offset 4F996D.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
| STN wrote: | | i am a sweetheart. |
|
|
| Back to top |
|
 |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
Posted: Mon Dec 28, 2020 2:45 pm Post subject: |
|
|
| OldCheatEngineUser wrote: | | OldCheatEngineUser wrote: | | select "mov [rbx+80],r9d" and replace it with NOPs, see what happens. |
NOPing CMP instruction wont help you, and ignore the CMP for now.
| Code: | RSI = EAX;
if ( TIMER_1 == -1) {
TIMER_1 = R13D; /* whats in R13? */
TIMER_2 = R12D; /* whats in R12? */
}
ECX = TIMER_2;
/* ... */
_3BF980(RCX, RDX, R8, R9); |
also see what happen when you NOP the Jcc instruction at offset 4F996D. |
Nothing happens when I NOP the instruction at 4F996D .
I have to put these codes lines in the auto assemble, right?
Should I replace the commands RSI, EAX and so on with their own values in Hex or DEC? Or put them exactly as you wrote to me with the code injection, and in that case, in which offset ?
| Code: | alloc(newmem,2048,"OPM.exe"+4F996F)
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
mov [rbx+00000080],r13d
exit:
jmp returnhere
"OPM.exe"+4F996F:
jmp newmem
nop 2
returnhere: |
|
|
| Back to top |
|
 |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
|
| Back to top |
|
 |
Saitama-sama How do I cheat?
Reputation: 0
Joined: 25 Dec 2020 Posts: 7
|
Posted: Wed Jan 20, 2021 2:28 pm Post subject: |
|
|
| I'm definitely stuck . Still searching for it . I can't believe this hack would be that difficult to find . And of course, feel free to enlight me . A donation is even possible if someone help me to find it . I'll post my researches as usual .
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|