[Ravenswatch] Locate Timer

[Buloarff]

First, hello everyone, glad to be among you.

I need assistance to locate this damn timer in the game Ravenswatch on Steam, in order to simply block it.

On internet, there is indeed a table called "Ravenswatch (v3.2.0)", but since it’s on Linux there is nothing compatible, so I have to search for everything that interests me myself.

I am on Linux Mint 22.3, and I use the "Pince" program.
So I know that most of you use Cheat Engine. But it’s not a problem, what I need is "the method", which should be the same on both programs.

Here are my observations:

• The timer starts at 18 minutes, decreases in seconds per second, and can be stopped at any time. It seems to be stored in seconds, then in hundredths.

• When you do a search in "Float(any)", for example with a value between 1070 and 1080 (for 17 minutes x 60 = 1020 + 50 and 60 seconds), after 3x search repetition, you very quickly come across 16 results in Float32 that perfectly match (for exemple: 1037.800048828125) , and which decreases synchronized with the timer. If we freeze its 16 values, nothing happens.

Probably not relevant:

• If we search on one of its 16 values, we find a 17th that matches exactly. If we freeze this 17th value, the game crashes. If we restart the in-game timer, this value changes completely compared to the others (for example: 8.96831017167883e-44).

Can someone tell me how to get there please ?

[SeryogaSK]

I DM you.

If google tell right it use own engine in c++ cheat engine have a method to see some c++ namesymbols have pince it to?

If you freeze any value you find and nothing happens than maybe only visual or wrong. Try search for all with inc/dec value maybe its not float.... Sometimes what you see is not the real maybe 4bytes or something else.

Also if you try look up to find what access or writes to the float addresses what is near in the memory view to them maybe anything that looks intressting. Any "sub ***" Or "cmp ***"

Remember one game find float value all looks +- fine but it was a 4byte value in real

Update Edit:
After some research:
Game begin Timer is "0" (18)... after you go outside and begin than search for Inc Value and you should be able to find the timer address

try search for something of this:
{
// ORIGINAL CODE - INJECTION POINT: Ravenswatch.exe+1ED32D

Ravenswatch.exe+1ED2FA: 48 8B B1 90 00 00 00 - mov rsi,[rcx+00000090]
Ravenswatch.exe+1ED301: 4C 8B A1 60 01 00 00 - mov r12,[rcx+00000160]
Ravenswatch.exe+1ED308: 49 8B 04 24 - mov rax,[r12]
Ravenswatch.exe+1ED30C: 49 8B CC - mov rcx,r12
Ravenswatch.exe+1ED30F: FF 90 D8 00 00 00 - call qword ptr [rax+000000D8]
Ravenswatch.exe+1ED315: 45 33 ED - xor r13d,r13d
Ravenswatch.exe+1ED318: 45 38 AE 29 01 00 00 - cmp [r14+00000129],r13b
Ravenswatch.exe+1ED31F: 0F 84 6F 04 00 00 - je Ravenswatch.exe+1ED794
Ravenswatch.exe+1ED325: 84 C0 - test al,al
Ravenswatch.exe+1ED327: 0F 84 67 04 00 00 - je Ravenswatch.exe+1ED794
// ---------- INJECTING HERE ----------
Ravenswatch.exe+1ED32D: F3 41 0F 10 B6 2C 01 00 00 - movss xmm6,[r14+0000012C]
// ---------- DONE INJECTING ----------
Ravenswatch.exe+1ED336: F3 41 0F 10 0F - movss xmm1,[r15]
Ravenswatch.exe+1ED33B: F3 41 0F 59 8E 30 01 00 00 - mulss xmm1,[r14+00000130]
Ravenswatch.exe+1ED344: 0F 28 C6 - movaps xmm0,xmm6
Ravenswatch.exe+1ED347: F3 0F 58 C1 - addss xmm0,xmm1
Ravenswatch.exe+1ED34B: F3 41 0F 11 86 2C 01 00 00 - movss [r14+0000012C],xmm0
Ravenswatch.exe+1ED354: 45 38 AE 48 01 00 00 - cmp [r14+00000148],r13b
Ravenswatch.exe+1ED35B: 0F 85 33 04 00 00 - jne Ravenswatch.exe+1ED794
Ravenswatch.exe+1ED361: 45 38 AE 4C 01 00 00 - cmp [r14+0000014C],r13b
Ravenswatch.exe+1ED368: 0F 85 D1 00 00 00 - jne Ravenswatch.exe+1ED43F
Ravenswatch.exe+1ED36E: 45 38 AE 4D 01 00 00 - cmp [r14+0000014D],r13b
}

[Buloarff]

Thank you for the quick response !

If google tell right it use own engine in c++ cheat engine have a method to see some c++ namesymbols have pince it to?

I tested both programs (as a beginner), and Pince is very close to Cheat Engine. He is not yet at his level, but we can already do a lot. However, I don’t know what you’re talking about for the namesymbols, so I don’t know how to answer.

If you freeze any value you find and nothing happens than maybe only visual or wrong. Try search for all with inc/dec value maybe its not float.... Sometimes what you see is not the real maybe 4bytes or something else.

Also if you try look up to find what access or writes to the float addresses what is near in the memory view to them maybe anything that looks intressting. Any "sub ***" Or "cmp ***"

Tests:
In Int(any):
Decreased: First search on "Unknown Value," then "Decreased" and "Unchanged." The filter goes up to 264 results, then it almost stops moving forward.
Increased: First search on "Unknown Value," then "Increased" and "Unchanged." The filter goes up to 12,491 results, then it almost stops moving forward.

For "Access", I found his cmp and sub there:

Code: Select all

        0x0000000140281968:	cmp    rdx,0x4      rdx=0x21d49050
        0x0000000140274d90:	sub    rsp,0x40     rsp=0x11f518    = 1176856

For "Writes", I found his cmp there:

Code: Select all

        0x00006ffffbb90127 <fmodstudio!FMOD_Studio_VCA_SetVolume+338327>:	cmp    rax,r14      rax=0x82f2ec8   r14=0x0 = 0
        0x0000000140281968:	cmp    rdx,0x4                                                      rdx=0x21d49050

Memory view:
There are 3 windows that open, here's how it looks:

{
// ORIGINAL CODE - INJECTION POINT: Ravenswatch.exe+1ED32D ...

I’m going to try to find something that looks like what you’re showing me here.

[Buloarff]

By following the directions, I found this address 0x463cfcc which really freezes the timer when I check it !

By doing Access, I find something very similar to what you mentioned:

Code: Select all

0x00000001401edb0d:  movss xmm6,DWORD PTR [r14+0x12c]
   0x00000001401edb16:  movss xmm1,DWORD PTR [r15]
   0x00000001401edb1b:  mulss xmm1,DWORD PTR [r14+0x130]
   0x00000001401edb24:  movaps xmm0,xmm6
   0x00000001401edb27:  addss xmm0,xmm1
   0x00000001401edb2b:  movss DWORD PTR [r14+0x12c],xmm0
   0x00000001401edb34:  cmp BYTE PTR [r14+0x148],r13b

Now I’m trying to find the static address.

[SeryogaSK]

If all is right than the "12c" offset is timer how i have it and you can do a script for freeze timer.

I don't know how youre tool is working and if you can easy make a script for freezer the timer.

But now you can find timer and work with it.

[Buloarff]

It’s okay, I have it! I’m finally going to be able to enjoy this game

If it helps some, here is the static address in Int32:

Code: Select all

Ravenswatch.exe+0x1470AA0 (0x110DFA50)
Offset 1: 0x1c0
Offset 2: 0x6a8
Offset 3: 0x2c8
Offset 4: 0x5f0
Offset 5: 0x12c

Thank you very much SeryogaSK for your help and the time spent.

[Alex Darkside]

By doing Access, I find something very similar

(Google translation)

Pay attention to the instructions
0x00000001401edb27: adds xmm0,xmm1
Replace addss xmm0,xmm1 with nop, after this replacement the timer should stop.

[Buloarff]

Pay attention to the instructions
0x00000001401edb27: adds xmm0,xmm1
Replace addss xmm0,xmm1 with nop, after this replacement the timer should stop.

Thank you for the information, it’s interesting.