5 replies to this topic

[JAA149]

Hi All,

I try to develop a trainer for a game and everything works well except when I close & restart the game, it does not work. This is how I do it.

1 - Game starts with health 110 so I scan for 110 and get the Address 11242DA8. I make sure this is the correct Address by adding it to the bottom table List and checking the "Active". Now when I play the game my health does not change. So it must be the right Address.

2 - Right Click on the Address and click "Find out What Writes to this Address". Go back to the Game and lose some Health to get the opcode. I get "0044D0F8 - 89 7E 68 - mov [esi+68], edi". Now I right click on it and get "More Info". This gives me the "Extra Info" window with the following details

a. 0044D0F8 - mov [esi+68], edi
b. ESI = 11242D40
c. The value of the pointer needed to find this address is probally 11242D40

3 - I go back to the main Cheat Engine Window, Check the "Hex" box to do a Hexadecimal value scan for "11242D40". I get 36 Results.

4 - I double click the top most entry in the scan results to add to the bottom Table List. There are no Green/Static Results. The top most entry is "04B86A00" with Value of "287583552"

5 - I click "Add Address Manually", check "Pointer", Add the Address "04B86A00" in the "Address of pointer", Add "68" in the "Offset{Hex}". The Add Address Windows tells me that "This pointer points to the address 11242D40" and "The offset you chose brings it to 11242DA8"

6 - When I click ok, A new entry is added to the bottom Table list in the Main Cheat Engine Window as "P->11242DA8 4 Bytes 98"

7 - Now I make a Trainer for this. Go to file, Generate Trainer from Table", Add Hotkey, Alt+F1 for increase value with 10, Click Generate trainer, Give it name of Trainer and save it to desktop, Choose "Kernal Tools" in the "Features Used", Choose "None" in the "Compression" and click Generate. The Trainer has been generated successfully.

8 - Now I do not run the trainer, go back to the game and click Alt+F1. My health increases by 10. I am guessing this is from the Cheat Engine and not from the Trainer since the Trainer is not running. So I close all Cheat Engine windows and cheat engine itself. Than I run the Trainer. Now when I do Alt+F1 in the Game, I get a increase of value 10. So Far So good.

9 - Now I close the Game, close the Trainer, Start the Trainer and start the Game, and again press Alt+F1 in the Game. It does not work like it worked previously. There is no increase in my health of value 10.

Note that I Choose "Debugger method" as "Use Kernelmode debugger" in the Settings/Options as "Use windows debugger" and "Use VEH" Debugger" does not work on Windoes 7 and I get "Cannot Attach Debugger" Error.

Any Ideas.

Thanks.

[Shannou06]

You just obviously got the wrong adress. Isn't there any 'deeper' pointer?
Or try to look at the assembly code (in olly preferably) and understand the function.

[JAA149]

You just obviously got the wrong adress. Isn't there any 'deeper' pointer?
Or try to look at the assembly code (in olly preferably) and understand the function.

Could I make it work the first time even If i got the wrong address. As stated by me, It does work the first time. Problem happens only when I generate the trainer, close the game, start a new/fresh instance of the game. Here it does not work. If address was wrond, would it not be that it would not also work the first time?

[Shannou06]

By 'wrong adress' I actually meant 'wrong pointer'. Isn't there another adress which writes to your actual pointer?

[KEMiCZA]

Why don't you just code inject at 0044D0F8?

mov edi, 110
mov [esi+68], edi

Problem with pointers is that you don't know when the game will change the value of the pointer. It might be between loading levels or randomly at any given time. This will force you to always check if the value of the pointer is not null. In this case it would be easier to just use code injection, unless the game has protection against this? I don't see any reason to use pointers.

EDiT:

You could also go deeper and check where esi comes from. If you trace it back you might get something like

mov esi, [ecx+4]

Then you can go deeper and check the value of ecx (which should be an address). Try going as deep as possible until you get a static pointer. Maybe this is what you're looking for?

[JAA149]

Right. Thank you all.