[Guide] Killcount for specific maps

Hello, I have learned how to do this months ago and am now deciding to share this for the community. I am still very new to assembly as my specialty is in web development, but hopefully I can learn more into this in the future. So first is first, this is very basic and requires very little knowledge with assembly/cheat engine.

Requirements:
- Cheat Engine
- Test Server
- Brain.exe

First, we obviously need to open cheat engine and attach it to our ps_game.

Like so:

[Only registered and activated users can see links. Click Here To Register...]

After we do that, we need to find the correct address for our ps_game in regards to adding kills to our character.

Here's what I am going to do to find this information.

So In order to do this, We will need 2 characters and we are going to kill each other and track each kill we get. (Alternatively you could just set your changed kills with a gm toon)

So as you can see below, I have 1 kill. I am going to search for one kill.

[Only registered and activated users can see links. Click Here To Register...]

[Only registered and activated users can see links. Click Here To Register...]

Now we're going to keep track of our character kills, so after i killed someone, i now have 3 kills. that's what i'm going to search for. Keep doing this until you find the right addres that tracks your kills.

Shouldn't take long. this is the address that i found: double click on it and add it to the bottom.

[Only registered and activated users can see links. Click Here To Register...]

Now that we have our address, I'm going to press f5 on it to find what accesses it, our we can just right click on it and press that option.

Now that we have that window open, we are going to kill our character again.

You should see something like this:

[Only registered and activated users can see links. Click Here To Register...]

this is whats adding our kills to our character.

Now before we actually start making the script, we need to find out the offset which finds our map. to do this we are going to need to find the base address for our edi value. If you still have the window open where we initially found the correct address you should see at the bottom:

[Only registered and activated users can see links. Click Here To Register...]

this is the address we are going to use to find it.

Select this option in tools:
[Only registered and activated users can see links. Click Here To Register...]

Now if we go back to our add offset it shows:

[Only registered and activated users can see links. Click Here To Register...]

add [edi+148]

so we are going to add +148 to our address pointer that we found.

and that is going to be the address we put into the address option in dissect.

like so:

[Only registered and activated users can see links. Click Here To Register...]

choose this option.

[Only registered and activated users can see links. Click Here To Register...]

you can name it whatever you like.

Now it should show the structure and we need to find the value of our map id.

Now i see that 18 is the correct offset because I know that i am on map 86 and it's showing the correct value.

[Only registered and activated users can see links. Click Here To Register...]

So this is all we need, now we can get to making the script.

so what we need to do now is to make an assembly script.

Select it, go to tools at the top bar and press "auto assemble".

Like so:

[Only registered and activated users can see links. Click Here To Register...]

then we are going to click on the template dropdown at the top again, and choose cheat table framework code. this is how we get the enable/disable part.

then we are going to to choose the code injection under template again.

It should automatically find the address to the address we found, if not you can find it by right clicking on it and clicking "go to address" and that should tell you the address for it.

You can also find it right here:

[Only registered and activated users can see links. Click Here To Register...]

So our template should look something like this:

[Only registered and activated users can see links. Click Here To Register...]

Now i'm going to define 4 new map ids.

[Only registered and activated users can see links. Click Here To Register...]

After that, we will write our new code.

We are going to cmp the map id, so we say like: if map id then we will add kills.
if not, we return kinda thing.

I don't want to go over what each op code means google would be your friend for that. I'm just going to explain how it works.

This is the final code after i finished writing it:

[Only registered and activated users can see links. Click Here To Register...]

So as you can see in the code, we are saying if map 1 is map id 18 as an integer, we will add 2 kills plus the original amount, which in my server is 2, so they will get a total of 4 kills on map id 18. and it will also go to map_2,map_3 and then map_4 and it will do the kills and such and then finish.

I really hope this helps anyone interested in learning how things like this works as you can see it is quite simple. I hope you can understand it.

I tested this and it works perfectly.

Awesome, I think it was missing the download, it would make it much easier, anyway thanks

Removed

Removed

I could be wrong, but 2nd jne originalcode after the first one won't be read since the code will jump to first address given.

A simpler solution could be something like this, but havent tested it anywhere:

Quote:

Originally Posted by oldjayy I could be wrong, but 2nd jne originalcode after the first one won't be read since the code will jump to first address given. A simpler solution could be something like this, but havent tested it anywhere:

Well there's more than one way of doing it, right? This way has always worked without any problems, multiple testing and seems that it's going through all of the code. but of course you could do it like that aswell.

You could do something like this, which is just about the same as what you mentioned:
[Only registered and activated users can see links. Click Here To Register...]

Again, as i mentioned I don't study much of this stuff, mostly web development so If at any point I'm wrong just feel free to correct me.
Cheers.

Quote:

Originally Posted by vinnystyler18 to facilitate your understanding, this is the guide code above.

Also, by the way this is quite incorrect,

This is your code:

[Only registered and activated users can see links. Click Here To Register...]

First we are going to map 2 on our first code, right? that's correct.

Once we are on map 2, you are saying you want to go back to map 2? how does that make sense? your code will never reach map 3, it will just go on continous loops to map 2.
same thing on map 3, and on map 4 I believe you don't need to jne originalcode.
This script that you made will most definetly cause a few errors, possibly even crash your server.

Removed

Quote:

Originally Posted by vinnystyler18 I just wanted to make life easier for the guy, he can edit this script, yes I already did the steps of the guide, it works perfectly for me, maybe in the near future, I'll be using it on my server Maybe he had no idea how it would be to put the function inside a CT file, I just published an example, I do not know why you're so bothered about it

The download posted by you was useful, made easy, made some adjustments and works for me.

I avoid asking for help in this community because of people like @[Only registered and activated users can see links. Click Here To Register...] who thinks he is superior and always responds with arrogance, Whatever it is, I thank him

I just have a brain. Of curse enough to read and apply the guide without asking for download. That's all.

If you don't know how to use CE take a look on google.

And i'm not superior.

Thanks.

Quote:

Originally Posted by Blober I just have a brain. Of curse enough to read and apply the guide without asking for download. That's all. If you don't know how to use CE take a look on google. And i'm not superior. Thanks.

He's looking like an idiot with ridiculous arguments, I know how to use CE

Quote:

Originally Posted by ShaiyaIwanttolearn I know how to use CE

I'm really happy for you dude :handsdown:

what improves the code is to add offsets 148 + 18 = 160, for best practices, 148 + 18 in hexadecimal, which is equivalent to 160

Old:
cmp byte ptr [edi+00000148+18],(int)map1

New:
cmp byte ptr [edi+160],(int)map1


doesn't change anything, just to make the code cleaner


sorry for my english!

Hello, I'm trying this script for a single map and i get:

"not all script can be injected
error on line 16 add[edi+00000148],(int)2"

what is wrong?

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
define(map1,60)

newmem:

cmp byte ptr [edi+160], (int)map1
je kc_map1
jne originalcode

kc_map1:
add[edi+00000148],(int)2
jmp exit

originalcode:
add[edi+00000148],ecx

exit:
jpm returnhere

"ps_game.exe"+67DC0:
jmp newmem
nop
returnhere:




[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"ps_game.exe"+67DC0
add[edi+00000148],ecx
//Alt: db 01 8F 48 01 00 00

Quote:

Originally Posted by beetols Hello, I'm trying this script for a single map and i get: "not all script can be injected error on line 16 add[edi+00000148],(int)2" what is wrong? [ENABLE] //code from here to '[DISABLE]' will be used to enable the cheat alloc(newmem,2048) label(returnhere) label(originalcode) label(exit) define(map1,60) newmem: cmp byte ptr [edi+160], (int)map1 je kc_map1 jne originalcode kc_map1: add[edi+00000148],(int)2 jmp exit originalcode: add[edi+00000148],ecx exit: jpm returnhere "ps_game.exe"+67DC0: jmp newmem nop returnhere: [DISABLE] //code from here till the end of the code will be used to disable the cheat dealloc(newmem) "ps_game.exe"+67DC0 add[edi+00000148],ecx //Alt: db 01 8F 48 01 00 00

There's a typo in the line jpm returnhere. It should be jmp returnhere.

The line add[edi+00000148],(int)2 is incorrect. The correct syntax should be add [edi+148], 2 since you're adding an immediate value of 2 to the memory address [edi+148], you don't need to specify (int)