(Request) Halls of torment.

[Darty]

Hey I hope everyone is doing well. I was just wondering if someone would be able to teach me how to figure out how to change the values of torment souls please? It seems to me that the normal methods of searching for it don't work, and im not sure of what else to try. Thanks.

[savagethehacker]

Well to start, this is a Godot Engine game. You can start with HP. Start by scanning for the value as 4 byte type. Lose some HP, pause the game, then search the new value. Should only take one or two rescans (next scan) to get the address since the game is small. Once you find your result you can right click the address in the list once you've added it to your address list and select "Find out what writes to this address". This will show you the instruction that actually writes to the HP when you lose some... in this case for my session it is "sub [rsi+00000470],r12d" or "7FF6670BC8E5 - 44 29 A6 70040000 - sub [rsi+00000470],r12d". Once you have this opcode for most games it can be as simple as clicking it, clicking show disassembler, pressing ctrl+a and then ctrl+shift+a to create an AOB Injection code template for your instruction (IF CHEAT ENGINE CAN FIND IT AS A UNIQUE AOB) and simply commenting out/nopping the instruction and saving and enabling.

For this game it's a tad more complex and many games share this behavior too. The opcode is used by multiple addresses instead of ONLY the HP so what we need to do is do a commonality scan to find an identifying/usable offset for our purposes. Back to the step where you have found your opcode/instruction in the debugger; instead of clicking show disassembler you now need to right click the instruction and select "Find out what addresses this code accesses". At this point you need to take damage yourself AND damage a couple enemies to populate this list. Once you have some results you need to find your HP address in it, right click and highlight "Find commonalities between addresses" and mark your hp address as Group 1. Mark everything else as group 2. Once you've done that right click anywhere, find commonalities and select "Scan for commonalities". This game actually makes this part WAYYY easier than some games I've done this with. For this game, the register RAX has a common value for both group 1 and group 2 (meaning the player has one value at that register and the enemies have another value and it seems to never change). For this game Group 1's RAX is 0x2 and Group 2's is 0x1. So to write a code injection script for this you'd go back to the debugger window with the opcode/instruction we are targeting (7FF6670BC8E5 - 44 29 A6 70040000 - sub [rsi+00000470],r12d) and now we can open disassembler armed with this new knowledge and instead of ctrl+shift+a we manually add the templates IN ORDER "Cheat Table Framework Code" and then "Code Injection". This should give you something similar to

Code: Select all

"[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"HallsOfTorment.exe"+13C8E5) 
label(returnhere)
label(originalcode)
label(exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here

originalcode:
sub [rsi+00000470],r12d
exit:
jmp returnhere
"HallsOfTorment.exe"+13C8E5:
jmp newmem
nop 2
returnhere:

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"HallsOfTorment.exe"+13C8E5:
db 44 29 A6 70 04 00 00
//sub [rsi+00000470],r12d"

You only need to make a simple edit to this script since the commonality scan was simple. Under the "//place your code here line" you can simply write in

Code: Select all

cmp rax,2
je exit

so your final result would be

Code: Select all

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"HallsOfTorment.exe"+13C8E5) 
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
cmp rax,2
je exit

originalcode:
sub [rsi+00000470],r12d

exit:
jmp returnhere

"HallsOfTorment.exe"+13C8E5:
jmp newmem
nop 2
returnhere:


 
 
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"HallsOfTorment.exe"+13C8E5:
db 44 29 A6 70 04 00 00
//sub [rsi+00000470],r12d

Add it to the table, and enable it. You have successfully obtained immortality in a game while ensuring you filter out enemies too!
LMAO I JUST realized you asked for Torment Shards, not invincibility. Let's look into it.

Well damn, I ran into the same issue and was only able to find UI elements. Godot is NOT my cup of tea apparently.