tizzio wrote: ↑Fri Jan 25, 2019 2:50 pm
i am not an hacker and i would like to do the same thing you did , and exactly for your same reason , can you explain me how to do that ? and before anyone may run with the fantasy , i don't want to do anything nasty like steal anyone's credits , is just to enjoy those modifications and have them all in cheat engine
It's honestly not rocket science (though the process is probably different for trainers by different coders): You can either
- start the trainer, activate a whole bunch of the available options and then check in the memory region view of the disassembler (Memory View => CTRL-R) for a bunch of subsequent or nearly-subsequent size-1000 regions with execute, read & write access or
- use one of the options to find the value which is accessed by the part of the code where the trainer executes its own code
The latter option is probably the most reliable - in this case, I used the "Items won't decrease" option, found the value for the amount Apple Gels, ran a scan for the code(s) which access this value and then activated/deactivated the trainer option a bunch of times while looking at said code in the disassembler until I found an opcode that changes into a JMP command when activating the option and back into the original command when deactivating the option.
From that point, the rest is easy - you just follow the JMP to the newly allocated code area - in the case of the fearlessrevolution trainer, that area stores JMPs to all the code for the activated options. Since in my example, that was the "Items won't decrease" option, you now activate the option you actually want to reverse-engineer, follow the newly created JMP that's just appeared right after the previous JMP and follow that to its destination, where the actual code is located.
Then you just copy that code, slightly modify it so it'll work in the auto-assembler (i.e. change JMPs contained in the code to relative instead of absolute JMPs since CE will allocate memory in a different region than the trainer) and voila, you're good to go. In the code I've posted, for example, I only made changes to JE, JA (from JMPs to concrete addresses to same-length relative JMPs, i.e. JE +0B and JA +05) and JMP (from the final JMP to the concrete original injection address to the AOB symbol return address).
Sorry that I can't explain it in more simple terms, but all this disassembler stuff is honestly not nearly as difficult as it would first appear :).
Darkedone02 wrote: ↑Sun Jan 20, 2019 11:34 pm
There is a dice master game over at a port town, is there a way we can cheat the system with always even or always low results to instantly win this game?
The Unrandomizer actually works perfectly for that annoying little minigame - just activate it and you'll always roll three 1s.
EDIT: Just saw the new post above - great job Geordan, that is much cleaner :). See, this is why it's good to have actual assembly skills instead of just blindly copying code from a pre-existing trainer :D