Friday, 21 September 2012

God Mode, Infinite ammo, Infinite anything... with Cheat Engine

Getting infinite gold/money/cash/power/credit/sun etc in a game with Cheat Engine.
Making a hack to prevent it decreasing using Auto Assembler

If the game uses integer or unsigned integer as the type it will have a DEC or an ADD to change when you spend the resource.
Some games use one function for change resource and it accepts a - or + value. So the compiler uses ADD it might look odd.

It might look like one of the following lines where EDX is a pointer to the object
ADD [EDX+SomeOffset],Value
ADD [EDX+SomeOffset],EAX // EAX contains the amount etc.

It may also just look like this
MOV EBX,[SomeAddress] // Get Value
DEC EBX,EAX // Decrease by amount spent/used
MOV [SomeAddress],EAX // Store result back.

If the value is a float type it would be the same just with float opcodes.

So we find the resource.
To start with my resource is 150 so I do a 4 byte search for 150
I spent 100 so I search for decreased value by 100 or I could search for exact value 50
You can repeat the steps till you find it. you should know how to find stuff if not do the cheat engine tutorial it comes with CE and is in the program's directory.

So you add the value to the list. In some games theres multiple values where the resource may have a ticking up or down effect.
Just find the value that is the real one eg when you set it to 1000 you have 1000 and can spend it.

Once thats found you can freeze it of course and have infinite of that resource technically. But what if the address is not static.
Stuff finding it each time. Sure we could find a pointer to it and use that but why not just hack the code that modifys it directly.
Thats way more fun.

You may need to goto settings of CE and use the VEH debugger
Just right click the address and find what writes too it
Spend the resource in game
For my game I had to get some resource before I could spend 100 again. I incremented it by 25 each time
The list of found opcodes looks like this
00430A11 - 01 88 60550000  - add [eax+00005560],ecx
0041BA76 - 89 B7 60550000  - mov [edi+00005560],esi

The top one was for adding the 25 each time.
And the bottom one was for spending it.
So we want to goto the second one in the dissassembler
scrolling up slightly we usually see the sub or add opcode.
simply changing this to a nop will do the trick.

Click the line
Press Ctrl+A or Click Tools | Auto Assemble

Press Ctrl+Alt+T then Ctrl+I
Click OK
Now we just have to remove all the detouring stuff since we just want to overwrite the value.
Delete everything under [ENABLE] up too [DISABLE]

Your Disable area puts the code back how it was you want to clear the junk out of it so its only the exe + offset to address and the line of code you want.
sub esi,ebx

Copy paste the contents under [DISABLE] under [ENABLE]
Look in CE for how many bytes the code takes up in this case its 2
Write two nops in place of the code in [ENABLE]

For PlantsVsZombies it ended up looking like this

sub esi,ebx

Go File | Assign to current cheat table.
Close down the Auto Assemble window with the X in top right.
Name the script in your table to w/e you want eg Infinite Name of resource here

It may take several attempts to negate spending code in multiple places depending how they coded it.
Also some games use the game code for every object of that type. If your data is not unique to just you then there is a good chance that
The code also applys to everything else.

For example if in an RTS game your team has credit and enemy has credit. And you put infinite credit hack on just by nopping it.
Then the computer AI may start hardcore buying everything it can. As it will never run out of money. You would want the hack to only apply too you.

Another example health in a game for your character and health for another will be the same code for decreasing both.
If you nop it then your enemy will have god mode too. So you would want to get the pointer to your character and check in the registers or stack
to only apply the nop for your object. Simmiarly on an RTS game each object will have a Team ID in it somewhere.
You can detour the code and check that if its 0 *usually 0 == you* then its on your team and apply god mode.
You might want to do 2x damage to enemys so you could check if its not 0 then multiply the damage by 2.
You may want to see if you can find attacker team id too so you can prevent enemys 2xing damage against others. *or instant kill if you just set to 0*
You could also just 2x damage for everyone to make the game more interesting.

If you were doing more special code to check the team/player or pointer. Then you would not delete the stuff mentioned above and instead use the templates fully. Putting in w/e code you need too.

I will try to write an example showing how to debug to find out the team or player id and effect code only for that in the future.
I will update it here.

1 comment:

  1. Of course a google search of your messages turns up many other blogs with a near exact match of the content which makes me think of it as being from some sketchy as heck advertising bot software... I want to believe this is not the case but its a hard sell!