Cheat Engine

quarkle · How do I cheat? Reputation: 0 Joined: 02 Apr 2022 Posts: 5

Hi guys hopefully someone can help.

I am trying to grab a memory address (not its contents) and place it into a symbol so that I can later add that symbol to my address list + the offset to confirm everything is ok and further manipulate things.
When I add:
test+44 or [test] or [test]+44 to the address list it points to a different part in memory.

The code below only executes at the start of the game so each and every time I have to place a breakpoint to find what address is held in [rdx+44] it is that address that I need without having to use a breakpoint.
The game crashes quite often when a place a breakpoint so I would like to avoid doing it if I can find a workaround.

Here's my botched code which nearly works Smile

I am sure it's just a simple mistake or 2 I am making?

After more investigating, it would appear I may need to use lea op?

push rbx
lea rbx,[rdx+44]
mov [test],rbx
pop rbx

Its still not quite there though

TheyCallMeTim13 · Posted: Sat Apr 02, 2022 11:55 am Post subject:

"test" will point to the allocated memory where you store the base. So make the memory record a pointer with address "test" and one offset of "44", or make the address "[test]+44" with no offsets.

quarkle · How do I cheat? Reputation: 0 Joined: 02 Apr 2022 Posts: 5

TheyCallMeTim13 · Posted: Sat Apr 02, 2022 12:04 pm Post subject:

Use the "add address manually" button then check the "pointer" box, and set the address and offset.

quarkle · How do I cheat? Reputation: 0 Joined: 02 Apr 2022 Posts: 5

I've re-written the script, so hopefully now I am getting closer.

TheyCallMeTim13 · Posted: Sat Apr 02, 2022 1:09 pm Post subject:

With LEA you're not just storing the base any more, you're storing the address. Make the offset zero, or just store the base like you had it.

quarkle · How do I cheat? Reputation: 0 Joined: 02 Apr 2022 Posts: 5

TheyCallMeTim13 · Posted: Sat Apr 02, 2022 2:31 pm Post subject:

Try the script like you had it before.

TsTg · Posted: Sat Apr 02, 2022 4:25 pm Post subject:

please have a look at the attached pics

if the addresses keep changing mid game, this indicates the code is executed multiple time and/or its a shared code used for other stuff in the game.

ParkourPenguin · Posted: Sat Apr 02, 2022 4:54 pm Post subject:

In 2.jpg, you have 2 offsets: 0 and 44. Remove offset 0 so that you only have a single offset of 44.

Also, right click the instruction `movss xmm0,[rdx+44]` and select "Find out what addresses this instruction accesses". If anything other than the address you want appears, see step 9 of the CE tutorial.

TsTg · Posted: Sat Apr 02, 2022 5:10 pm Post subject:

quarkle · How do I cheat? Reputation: 0 Joined: 02 Apr 2022 Posts: 5

Really appreciate the help TSTG, the screen captures really have helped me finally understand things that probably seem obvious to regular users of cheat engine.

It didn't occur to me but it was a shared instruction.
As it turns out, it was accessing 2 address's
The second of which was the address that ended up in my table and looked wrong.

By stepping through the breakpoint I could also see that the first address was indeed appearing in the table for a short while but as i began to step through it suddenly changed to the second address. Without a breakpoint it was happening so fast I didn't catch it.

With your help and Tims I am finally back on track and will investigate a way to filter out the second address leaving me with the first.
Even without that at least now I can just right click "ABC-Win64-Shipping.exe"+10B6B7E and find out what this instruction access's without any need to place a breakpoint as it always reveals just 2 address which i can quickly add.

cheers
Very Happy