Cheatengine pointer - Nomadmemory

BitOfHope · 12/02/2013, 20:53

Hey, so I'm having a little trouble using Nomadmemory properly.

Well... before I can even get to Nomadmemory, I can't even find the correct pointers for certain games. I found this tutorial online (

). It's basic enough, I understand it. I tried it with a single player game and it worked just fine, I found the pointer for it.

Now, I'm trying to do this with my current HP on an online game... and every time I get to the part where I click 'Add address manually' and add a pointer... the value that shows up in my cheat table doesn't match up with the value of my HP. I'm doing exactly what I did for a single player game... The same method isn't working for this online game though.

Example:
Found the address of my current HP in the game. Value: 48.
Found the pointer of that address. Value: 6619226.

I'm stumped. I tried to find the pointer of my in game money the same way. Same problem.

Is there some other way to find the proper pointer?

alpines · 12/02/2013, 22:13

How many addresses did you try to point to?
If you get the message "the address contains the value ...." then you get more than just one address I guess.
Even if they're 400 or more, you have to try every single of them.
Watch out, some values are written in the hex-format so you need to convert them!

mlukac89 · 12/02/2013, 22:17

best way to find your hp is to remove 1 piece that increase your hp, armor, weapon or something
then fill hp full and scan it
then put back armor or other thing and full hp again -> scan it
you will get few results
then try remove armor and look what adress will change value to your hp
if its not green put it down and right click pointer scan
when scan is done reenter game but leave CE opened
hook on game again and repeat hp scan again when you find it again go to rescan pointer and repeat that till you have few pointers

first try to scan with 4byte if you cant find try with float

BitOfHope · 12/02/2013, 22:43

This is exactly what I did:

-Opened the game.
-Opened cheatengine.
-Attached the game process.
-Searched for my current HP with Exact value - 4 bytes. A dozen values popped up.
-Changed scan type to changed value, changed my HP, scanned again. Repeated until I had just 1 Address/Value that matched my HP.
-Changed my HP in game to see if the value changed to match it. It did.
-Put that address into my cheat table.
-Right clicked it, clicked on 'Find out what writes to this address'
-Clicked yes, I want to attach the debugger
-In game I changed my HP again so the debugger picked it up
-Stopped the debugger.
-Double clicked what it picked up on.
-This is what it says:
>>004D3D96 - mov [eax+edx] ,ecx

copy memory
The value of the pointer needed to find this address is probably 00819C18

-I took the address '00819C18' and went back to the main cheatengine window.
-Checked [X] Hex and searched for 00819C18.
-1 result came up.
-I clicked on [Add Address Manually]
-Checked [X] Pointer and put in the address that came up in the result.
-There is no offset, so I left that at 0
-Clicked okay
-The pointer address SHOULD now match up with the normal value I got of my HP... but it doesn't.
-Normal value of my HP is 48 while the pointer is 6619226.

So... the pointer value should be matching up with the normal HP value, right? I did this same method on an offline single player game and it worked. But it won't work for this online game =/

mlukac89 · 12/03/2013, 00:54

if you double click on adress filed of that pointer it should be "something.exe+12323"
if is that try to change TYPE?

otherwise use pointer scan you will find it more faster

BitOfHope · 12/03/2013, 03:13

Quote:

Originally Posted by mlukac89

if you double click on adress filed of that pointer it should be "something.exe+12323"
if is that try to change TYPE?

otherwise use pointer scan you will find it more faster

Thanks, this got me the pointers.

Now I need to figure out how to read and use this through autoit, haha.

mlukac89 · 12/03/2013, 03:46

download KDMemory.au3

then in new file add this on top

Code:

#include <KDMemory.au3>

read memory with pointers

this will show you Tooltip in left upper corner of screen for 10 seconds

Code:

Global $hpPointer = 0x0112C1C4 ; hp change this to yours
; if you have more offsets just add 0x03 or whatever it is
; and count how much you have then put in $hpOffsets[number]
Global $hpOffstes[5] = [0x0, 0x324, 0x8, 0x0, 0x270] ; change this to yours 

Global $processName = "game.exe"

$processId = ProcessExists($processName)


If $processId == 0 Then
    MsgBox(48, "Error", "Game is not running!")
Else
    $handles = _KDMemory_OpenProcess($processId)
    $baseAddress = _KDMemory_GetModuleBaseAddress($handles, $moduleName) + $baseOffset
    $memoryData = _KDMemory_ReadProcessMemory($handles, $baseAddress, "DWORD", $offsets)
    
    ; this show you hp in tooltip --------------------
    ToolTip("My HP is : " & $memoryData[1], 0, 0)
     Sleep("10000")
    ; ----------------------------------------------
    _KDMemory_CloseHandles($handles)
    EndIf
EndIf

BitOfHope · 12/03/2013, 03:48

Quote:

Originally Posted by mlukac89

download KDMemory.au3

then in new file add this on top

Code:

#include <KDMemory.au3>

read memory with pointers

this will show you Tooltip in left upper corner of screen for 10 seconds

Code:

Global $hpPointer = 0x0112C1C4 ; hp change this to yours
; if you have more offsets just add 0x03 or whatever it is
; and count how much you have then put in $hpOffsets[number]
Global $hpOffstes[5] = [0x0, 0x324, 0x8, 0x0, 0x270] ; change this to yours 

Global $processName = "game.exe"

$processId = ProcessExists($processName)


If $processId == 0 Then
    MsgBox(48, "Error", "Game is not running!")
Else
    $handles = _KDMemory_OpenProcess($processId)
    $baseAddress = _KDMemory_GetModuleBaseAddress($handles, $moduleName) + $baseOffset
    $memoryData = _KDMemory_ReadProcessMemory($handles, $baseAddress, "DWORD", $offsets)
    
    ; this show you hp in tooltip --------------------
    ToolTip("My HP is : " & $memoryData[1], 0, 0)
     Sleep("10000")
    ; ----------------------------------------------
    _KDMemory_CloseHandles($handles)
    EndIf
EndIf

This just gives me an error when I try to run it.

mlukac89 · 12/03/2013, 11:45

paste your code here whole script

KDeluxe · 12/03/2013, 16:56

You can download a good example from me, but there are still a lot of people who are using my UDF wrong. My example doesn't contain a single useless line, there is nothing you can ignore and delete (except one of the first two lines).

Spoiler

Code:

;~ #AutoIt3Wrapper_UseX64=n ; 32 Bit application
#AutoIt3Wrapper_UseX64=y ; 64 Bit application

#RequireAdmin
#include "KDMemory.au3"

If @AutoItX64 == 0 Then
    MsgBox(48, "Error", "Unsupported system")
    Exit
EndIf

; Cheat Engine (x64) Tutorial Step 6: Pointers: (PW=098712)
Dim $handles = 0, $address = 0, $tmpError = 0, $tmpData[2]
Const $processName = "Tutorial-x86_64.exe", $moduleName = $processName
Const $baseOffset = 0x002C7710
Const $offsetsValue[1] = [0]

GUICreate("Example", 200, 40)
$lbl_Info = GUICtrlCreateLabel("Waiting for '" & $processName & "'...", 5, 5, 190, 30)
GUISetState()

While True
;~  Sleep()
    $msg = GUIGetMsg()
    Switch $msg
        Case -3 ; $GUI_EVENT_CLOSE
            Exit
    EndSwitch

    $processId = ProcessExists($processName)
    If $processId == 0 Then
        If IsArray($handles) Then
            _KDMemory_CloseHandles($handles)
            $handles = 0
            $address = 0

            GUICtrlSetData($lbl_Info, "Waiting for '" & $processName & "'...")
        EndIf
        ContinueLoop
    EndIf

    If $handles == 0 Then
        $handles = _KDMemory_OpenProcess($processId)
        If @error Then
            If MsgBox(52, "Error", "Can't open '" & $processName & "'!" & @CRLF & "@error: " & @error & @CRLF & @CRLF & "Continue?") == 6 Then
                $handles = 0
                ContinueLoop
            Else
                Exit
            EndIf
        EndIf
    EndIf

    If $address == 0 Then
        $address = _KDMemory_GetModuleBaseAddress($handles, $processName) + $baseOffset
        If @error Then
            If MsgBox(52, "Error", "Can't get ModuleBaseAddress '(" & $moduleName & ")'!" & @CRLF & "@error: " & @error & ", @extended: " & @extended & @CRLF & @CRLF & "Continue?") == 6 Then
                $address = 0
                ContinueLoop
            Else
                Exit
            EndIf
        EndIf
    EndIf

    $memoryData = _KDMemory_ReadProcessMemory($handles, $address, "DWORD", $offsetsValue)
    If @error Then
        If $tmpError <> @error Then
            $tmpError = @error
            GUICtrlSetData($lbl_Info, "Can't read memory!" & @CRLF & "@error: " & @error & ", @extended: " & @extended)
        EndIf
    Else
        If $tmpData[0] <> $memoryData[0] Or $tmpData[1] <> $memoryData[1] Then
            $tmpData = $memoryData
            GUICtrlSetData($lbl_Info, "Address: " & $memoryData[0] & @CRLF & "Value: " & $memoryData[1])
        EndIf
    EndIf
WEnd

Quote:

Originally Posted by BitOfHope

-Checked [X] Pointer and put in the address that came up in the result.
-There is no offset, so I left that at 0

That's wrong. An offset is an offset and can also be 0. I'm using a "0" offset in my example. Just add the address and don't use a "Pointer" if there is no offset.
You have to add an offset, but it is not "0", it's the value of "edx". You can see the value of "edx" in the "Extra info" window.

BitOfHope · 12/03/2013, 19:04

Quote:

Originally Posted by KDeluxe

You can download a good example from me, but there are still a lot of people who are using my UDF wrong. My example doesn't contain a single useless line, there is nothing you can ignore and delete (except one of the first two lines).

Spoiler

Code:

;~ #AutoIt3Wrapper_UseX64=n ; 32 Bit application
#AutoIt3Wrapper_UseX64=y ; 64 Bit application

#RequireAdmin
#include "KDMemory.au3"

If @AutoItX64 == 0 Then
    MsgBox(48, "Error", "Unsupported system")
    Exit
EndIf

; Cheat Engine (x64) Tutorial Step 6: Pointers: (PW=098712)
Dim $handles = 0, $address = 0, $tmpError = 0, $tmpData[2]
Const $processName = "Tutorial-x86_64.exe", $moduleName = $processName
Const $baseOffset = 0x002C7710
Const $offsetsValue[1] = [0]

GUICreate("Example", 200, 40)
$lbl_Info = GUICtrlCreateLabel("Waiting for '" & $processName & "'...", 5, 5, 190, 30)
GUISetState()

While True
;~  Sleep()
    $msg = GUIGetMsg()
    Switch $msg
        Case -3 ; $GUI_EVENT_CLOSE
            Exit
    EndSwitch

    $processId = ProcessExists($processName)
    If $processId == 0 Then
        If IsArray($handles) Then
            _KDMemory_CloseHandles($handles)
            $handles = 0
            $address = 0

            GUICtrlSetData($lbl_Info, "Waiting for '" & $processName & "'...")
        EndIf
        ContinueLoop
    EndIf

    If $handles == 0 Then
        $handles = _KDMemory_OpenProcess($processId)
        If @error Then
            If MsgBox(52, "Error", "Can't open '" & $processName & "'!" & @CRLF & "@error: " & @error & @CRLF & @CRLF & "Continue?") == 6 Then
                $handles = 0
                ContinueLoop
            Else
                Exit
            EndIf
        EndIf
    EndIf

    If $address == 0 Then
        $address = _KDMemory_GetModuleBaseAddress($handles, $processName) + $baseOffset
        If @error Then
            If MsgBox(52, "Error", "Can't get ModuleBaseAddress '(" & $moduleName & ")'!" & @CRLF & "@error: " & @error & ", @extended: " & @extended & @CRLF & @CRLF & "Continue?") == 6 Then
                $address = 0
                ContinueLoop
            Else
                Exit
            EndIf
        EndIf
    EndIf

    $memoryData = _KDMemory_ReadProcessMemory($handles, $address, "DWORD", $offsetsValue)
    If @error Then
        If $tmpError <> @error Then
            $tmpError = @error
            GUICtrlSetData($lbl_Info, "Can't read memory!" & @CRLF & "@error: " & @error & ", @extended: " & @extended)
        EndIf
    Else
        If $tmpData[0] <> $memoryData[0] Or $tmpData[1] <> $memoryData[1] Then
            $tmpData = $memoryData
            GUICtrlSetData($lbl_Info, "Address: " & $memoryData[0] & @CRLF & "Value: " & $memoryData[1])
        EndIf
    EndIf
WEnd

That's wrong. An offset is an offset and can also be 0. I'm using a "0" offset in my example. Just add the address and don't use a "Pointer" if there is no offset.
You have to add an offset, but it is not "0", it's the value of "edx". You can see the value of "edx" in the "Extra info" window.

Oh, the offset part makes more sense, thanks.

I was actually looking through your 2 examples last night before I fell asleep, but it was a little confusing for me. I'm going to take another look at it later today after work, but would it be possible for you to add more ;notes explaining what some of the lines do? I felt a little lost.