Some things about Cheat Engine I wish I would have known earlier

[Ray]

Hi all,this is my first post.

Press "Ctrl+Alt+A" to show Auto Assemble Display.
And then press "Ctrl+Alt+T" to output [ENABLE] and [DISABLE].

To enter nops, simply enter a number in the nop number, e.g.. "nop 4" "nop 7".

Since all important instructions are in "Game.exe", set "Memory Scan Options" to "Game.exe" and "writable" to ■ before searching.

Bytes and Opcodes can be copied by pressing "Ctrl+C" after specifying a selection with "Shift+Click" in the memory viewer screen.

If you want to find a specific assembly code, select "Search"_"Find assembly code" in the Memory Viewer.

If you want to make a specific input to a float register, operate as follows,In the example, it is movss, but addss, subss, or mulss will also work.

Code: Select all

  push 00000000
  movss xmm0,[rsp]
  add rsp,08

However, in this state, it's troublesome to enter a float, so easier to do the following.

Code: Select all

  push (float)2.0
  movss xmm0,[rsp]
  add rsp,08

I forgot to tell about the trap I used to fall into as a beginner. (So I've added)

cmp(compare) is basically 4 bytes, so be careful when specifying other bytes.

"cmp byte ptr" for 1byte
"cmp word ptr" for 2bytes
"cmp dword ptr" for 4bytes (In this case, no necessary to specify though)

For float　cmp register,(float)Value

It's worth remembering that "byte ptr" and "word ptr" may be used for input even if you aren't using cmp.

[Alex Darkside]

(Google translation)

I will add about the search range.

If you right-click under the search range field (see screenshot), the preset menu will open.

If you right-click on the word "Start" or "Stop" (see screenshot), the search range will be reset.

The Cheat Engine program is somewhat similar to a good game quest, you can always find something hidden and interesting in it.
Thanks Eric.

[J1327]

CELua had all this time auto guesser (or CELua function picker).
While in LUA ENGINE write at least one letter and press [Ctrl] + [Space] to activate drop list and see all available commands of CELua.


There are functions that is not documented in CELua helper (such as MONO_*) or CE Wiki(such as cheatcomponent_getActive())

---

(...)

Then editing pointer address at offset field you can add "$" to prevent offset from shifting. As well you can make & use lua variables as offset's. Let's say you have executed a script with a code : "myoffset=0x10". So in that case you could just enter in address offset "myoffset" or "$myoffset".

as well by making custom lua variables as offset's -- it is easier to make edits, if you have multiple locations in your script, to write the same offset. ...

Code: Select all

myoffset = 0x10;
local base = getAddress(readPointer(readPointer(pbase+0x110)+0x04)+myoffset)

---

[Eric]

you can reference address list addresses directly using ce's internal symbol handler using (description) notations
e.g: if you have an address with description something important then you can use as address (something important) and CE will interpret it as the addresslist address.
Also works in lua and getAddress, etc...

[Marc]

As PeaceBeUponYou points out: You can select multiple values in your cheat table, change value and enter "value+10" as new value. As a result, Cheat Engine will increase every value by 10.

[Rienfleche]

Since no expert has responded, let me, as someone who only understands the general usage, provide an answer.

how to filter enemy value and character value, i can find the address script but it affect enemy too.

example like this code i make for agarest war GOG version. (It's Gain SP after being Hit) but affect enemies as well.
i want to know how to make the cmp for ally only

This is a technique called Shared OpCode. Just find a tutorial and study how to implement it.

And This Max Money address [Agarest.exe+EAEA78] get reset if i restart the computer

Code: Select all

[ENABLE]

aobscanmodule(MaxMoney,Agarest.exe,08 A3 78 EA 33 01) // should be unique
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  mov eax,#999999999

code:
  mov [Agarest.exe+EAEA78],eax
  jmp return

MaxMoney+01:
  jmp newmem
return:
registersymbol(MaxMoney)

[DISABLE]

MaxMoney+01:
  db A3 78 EA 33 01

unregistersymbol(MaxMoney)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: Agarest.exe+80E8B

Agarest.exe+80E79: 8B E5                          - mov esp,ebp
Agarest.exe+80E7B: 5D                             - pop ebp
Agarest.exe+80E7C: C3                             - ret 
Agarest.exe+80E7D: CC                             - int 3 
Agarest.exe+80E7E: CC                             - int 3 
Agarest.exe+80E7F: CC                             - int 3 
Agarest.exe+80E80: 55                             - push ebp
Agarest.exe+80E81: 8B EC                          - mov ebp,esp
Agarest.exe+80E83: A1 78 EA 33 01                 - mov eax,[Agarest.exe+EAEA78]
Agarest.exe+80E88: 03 45 08                       - add eax,[ebp+08]
// ---------- INJECTING HERE ----------
Agarest.exe+80E8B: A3 78 EA 33 01                 - mov [Agarest.exe+EAEA78],eax
// ---------- DONE INJECTING  ----------
Agarest.exe+80E90: 3D FF C9 9A 3B                 - cmp eax,3B9AC9FF
Agarest.exe+80E95: 7E 0C                          - jle Agarest.exe+80EA3
Agarest.exe+80E97: C7 05 78 EA 33 01 FF C9 9A 3B  - mov [Agarest.exe+EAEA78],3B9AC9FF
Agarest.exe+80EA1: 5D                             - pop ebp
Agarest.exe+80EA2: C3                             - ret 
Agarest.exe+80EA3: 3D 01 1F 0A FA                 - cmp eax,FA0A1F01
Agarest.exe+80EA8: 7D 0A                          - jnl Agarest.exe+80EB4
Agarest.exe+80EAA: C7 05 78 EA 33 01 01 1F 0A FA  - mov [Agarest.exe+EAEA78],FA0A1F01
Agarest.exe+80EB4: 5D                             - pop ebp
Agarest.exe+80EB5: C3                             - ret 
}

There are several ways to solve this. Here is one of the method:

replace

Code: Select all

mov [Agarest.exe+EAEA78],eax 

to:

Code: Select all

db A3 78 EA 33 01

This may solve the issue (unless machine code changed everytime)

thanks it's work, finally learned sharedcode

but this mov [Agarest.exe+EAEA78],eax , i tried change it to db A3 78 EA 33 01 but don't work

[bbfox]

but this mov [Agarest.exe+EAEA78],eax , i tried change it to db A3 78 EA 33 01 but don't work

Arrrrrr, I know why it's not working but hard to explain in English.

Another way is use reassemble:

reassemble(MaxMoney)

But this may not work as excepted in CE 7.5, because CE 7.5 public release has a bug for reassemble() with xAX register. You may not get money value as excepted (999,999,999)

[MarianaRoses]

...

You can use readmem(MaxMoney+1,5) to replace this "mov [Agarest.exe+EAEA78],eax" as this will copy the aob right after the injection to the script.

So, from your script aob: MaxMoney = "08 A3 78 EA 33 01", by using readmem(MaxMoney+1,5), it will take the portion right after 08, hence "A3 78 EA 33 01". You also need to use the same thing in the disable section, if per say, the aob is ever changing. Something like this:

Code: Select all

[ENABLE]
aobscanmodule(MaxMoney,Agarest.exe,08 A3 78 EA 33 01) // should be unique
alloc(newmem,$1000)
alloc(MaxMoneyCopy,5)
registersymbol(MaxMoney MaxMoneyCopy)
label(code)
label(return)

MaxMoneyCopy:
  readmem(MaxMoney+1,5)

newmem:
  mov eax,#999999999

code:
  readmem(MaxMoney+1,5)
  jmp return

MaxMoney+01:
  jmp newmem
return:

[DISABLE]
MaxMoney+01:
  readmem(MaxMoneyCopy,5)
unregistersymbol(*)
dealloc(*)

Edit 1: You might need to wildcard your aobscan too, just search into those.

[Marc]

thx for flooding this tips & tricks thread