Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


One Punch Man : A Hero Nobody Knows ( SAITAMA ARRIVAL TIME )

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Fri Dec 25, 2020 2:37 pm    Post subject: One Punch Man : A Hero Nobody Knows ( SAITAMA ARRIVAL TIME ) Reply with quote

Hello Everybody, Merry Christmas to y'all .
Here is my issue :

For those who knows the game, there is a timer berfore saitama can enter the battle ( 300 seconds before his arrival ) .

When I searched for this value ( 4 bytes ) , I found 2 values ( which change when the battle or the game restart ), so it is not a static value at the beginning. I tried to change the values, but it doesn't affect the timer in the game .

In order to find the value(s), i used the " pointer scan for this adress " , the rescan memory and the pointer scan option ( setting the maximum offset level value to 4 instead of 7 by default ) and for both values, i found about 100 adresses in total . I added all these adresses in the table list .

When i close the game and restart it, i use the table ( the 100 adresses ), they show the same value displayed from the timer in the game ) . So, this means that I found the right adresses, correct me if I am wrong about this .

The big issue is, when I try to change the values, the timer in the game does not change, even when i freeze it .

I don't know at all where am I wrong .

Any Tips would be qui wonderful from you, thanks in advance .
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 20

Joined: 01 Feb 2016
Posts: 1586

PostPosted: Sat Dec 26, 2020 12:26 am    Post subject: Reply with quote

possibilities:
1. you did not find the real value
2. an instruction constantly writing to stamina address, which you can fix by code injection. (also try NOPing the instruction that writes to this value)

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote:
i am a sweetheart.
Back to top
View user's profile Send private message Visit poster's website
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Sat Dec 26, 2020 7:14 am    Post subject: Reply with quote

Indeed . I really think that i have to start from this step, as the picture describe it . My issue is surely, as you wrote it, the code injection step .
If i understand well, i have to change one of these codes using the code injection, right ?
The only thing is, what code do i have to put instead in order to force the timer directly to 0, or even decreasing the timer for instance 100 seconds each seconds, which means 3 seconds to wait in total from the beginning of the fight, knowing that the numbers of seconds is 300 by default ?



Sans titre.jpg
 Description:
 Filesize:  146.27 KB
 Viewed:  5183 Time(s)

Sans titre.jpg


Back to top
View user's profile Send private message
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Sun Dec 27, 2020 10:49 am    Post subject: Reply with quote

Saitama-sama wrote:
Indeed . I really think that i have to start from this step, as the picture describe it . My issue is surely, as you wrote it, the code injection step .
If i understand well, i have to change one of these codes using the code injection, right ?
The only thing is, what code do i have to put instead in order to force the timer directly to 0, or even decreasing the timer for instance 100 seconds each seconds, which means 3 seconds to wait in total from the beginning of the fight, knowing that the numbers of seconds is 300 by default ?


Code:
cmp dword ptr [rbx+00000080],-01


If we talk about a timer, this
Code:
-01
means that each seconds, we have -01 . But even if i put something like
Code:
cmp dword ptr [rbx+00000080],-12C
or
Code:
sub dword ptr [rbx+00000080],-12C
or
Code:
add dword ptr [rbx+00000080],-12C
, it doesn't afffect the timer right, that's to say the timer become a little bit buggy ( seeing two timer one over the another ), but the timer goes down normally as it use to . On my mind, i have to use the auto assembler and change it, but which one and replace it by which code ?
Unless i misunderstood something, thing which is really likely .



Sans titre (1).jpg
 Description:
 Filesize:  107.45 KB
 Viewed:  5102 Time(s)

Sans titre (1).jpg


Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 20

Joined: 01 Feb 2016
Posts: 1586

PostPosted: Sun Dec 27, 2020 11:38 am    Post subject: Reply with quote

can be either one, but since the first one (end with D90) is accessed by a CMP instruction then that address might be the one.

select "mov [rbx+80],r9d" and replace it with NOPs, see what happens.
if the timer stops and saitama didnt arrive even after 10 minutes then that is it.
and all you need to do and create a script that either zeros R9 register or put 300 depending on what you want.

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote:
i am a sweetheart.
Back to top
View user's profile Send private message Visit poster's website
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Mon Dec 28, 2020 10:55 am    Post subject: Reply with quote

Before anything, i really appreciate your help .

So, let's resume :

- In order to find the timer's adresse(s), i search for the value displayed by the timer .

- I find two 4 bytes adresses ( And no Float values as we can see quite often for timer's values ) .

- I Find out what access this adresses for the two values . Even when i restart the game, i find the same values from the option " find out what access " for the both adresses . ( The screen i already uploaded earlier ) .

- I tried to NOP's each adress ( from the screen i posted before ) and the timer does not stop, unfortunately .

- In the other hand, when I take a look in the Disassembler from this line "
Code:
7FF61AD59963 - 83 BB 80000000 FF - cmp dword ptr [rbx+00000080],-01
" .
So I find this line in the Disassembler :

Code:
OPM.exe+4F9963 - 83 BB 80000000 FF     - cmp dword ptr [rbx+00000080],-01 { 255 }
. Same code i find even when i restart the game repeating every steps .

- I tried to NOP it from the " Auto Assemble " option as well, but it does not stop the timer . I noticed that when i change the "
Code:
-01
"with the Auto Assemble and Code injection into 0 ( in DEC ), 3E7 ( in HEX ), 999 ( in DEC ) as you advised it to me, the timer not only don't stop, but we can see two timers in the same place ( a little bugged I would say ) .

- Well, I also noticed something quite interresting . In the Desassembler, from the line "
Code:
OPM.exe+4F9963 - 83 BB 80000000 FF     - cmp dword ptr [rbx+00000080],-01 { 255 }
" ( 255 being in the comment section ), right click on this line and choose the option " Find out what adresses this instruction accesses " , a window appear ( accessed adresses by " 7FF61AD59963 " let the timer going down a little bit and i find one adress : " 240F18130E0 " with the same value than the timer . I tried to change it to 0,as well but nothing happens .
And when i browse this memory region, I noticed in the right bottom from the memory viewer, the line in text ( " J1, un heros approche ! ( i'm french that's, why ) and it means " a hero is coming " ) , thing which appears when the Saitama timer's arrival starts . So, i am not far from the result i am looking for .

I'm still working on it, but that's tougher than i thought ... but again i really thank you for you help . I am even ready to donate if i succeed !



heros.png
 Description:
 Filesize:  190.94 KB
 Viewed:  5064 Time(s)

heros.png


Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 20

Joined: 01 Feb 2016
Posts: 1586

PostPosted: Mon Dec 28, 2020 11:48 am    Post subject: Reply with quote

OldCheatEngineUser wrote:
select "mov [rbx+80],r9d" and replace it with NOPs, see what happens.


NOPing CMP instruction wont help you, and ignore the CMP for now.

Code:
RSI = EAX;
if ( TIMER_1 == -1) {
   TIMER_1 = R13D; /* whats in R13? */
   TIMER_2 = R12D; /* whats in R12? */
}
ECX = TIMER_2;
/* ... */
_3BF980(RCX, RDX, R8, R9);


also see what happen when you NOP the Jcc instruction at offset 4F996D.

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote:
i am a sweetheart.
Back to top
View user's profile Send private message Visit poster's website
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Mon Dec 28, 2020 2:45 pm    Post subject: Reply with quote

OldCheatEngineUser wrote:
OldCheatEngineUser wrote:
select "mov [rbx+80],r9d" and replace it with NOPs, see what happens.


NOPing CMP instruction wont help you, and ignore the CMP for now.

Code:
RSI = EAX;
if ( TIMER_1 == -1) {
   TIMER_1 = R13D; /* whats in R13? */
   TIMER_2 = R12D; /* whats in R12? */
}
ECX = TIMER_2;
/* ... */
_3BF980(RCX, RDX, R8, R9);


also see what happen when you NOP the Jcc instruction at offset 4F996D.


Nothing happens when I NOP the instruction at 4F996D .

I have to put these codes lines in the auto assemble, right?
Should I replace the commands RSI, EAX and so on with their own values in Hex or DEC? Or put them exactly as you wrote to me with the code injection, and in that case, in which offset ?

Code:
alloc(newmem,2048,"OPM.exe"+4F996F)
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
mov [rbx+00000080],r13d

exit:
jmp returnhere

"OPM.exe"+4F996F:
jmp newmem
nop 2
returnhere:
Back to top
View user's profile Send private message
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Mon Jan 04, 2021 10:33 am    Post subject: Reply with quote

When I put the line codes, the error message appears " Error in line 20 . This instruction can't be compiled . I am pretty sure that i have to put the values to replace " /*...*/ as well as RSI, EAX, etc... right ? I do admit that i'm completely lost ... Confused


instruc.jpg
 Description:
 Filesize:  439.67 KB
 Viewed:  4852 Time(s)

instruc.jpg


Back to top
View user's profile Send private message
Saitama-sama
How do I cheat?
Reputation: 0

Joined: 25 Dec 2020
Posts: 7

PostPosted: Wed Jan 20, 2021 2:28 pm    Post subject: Reply with quote

I'm definitely stuck . Still searching for it . I can't believe this hack would be that difficult to find . And of course, feel free to enlight me . A donation is even possible if someone help me to find it . I'll post my researches as usual .
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites