Thread: Step 9 for Cheat Engine 6.2

I know there's a walkthrough of all the steps but for the newer version of CE (6.2) you get a different step 9
(PW=31337157)

Dibujo0.JPG

all you got to do is this:
make a float scan for all players
you will get something like this

Dibujo1.JPG

then right click the first address and select "what writes to this address"
click Attack (in step 9 first player) double click the item you will get in the instruction list.

Dibujo2.JPG

you will see [ebx+4]

go back to CE and select the first address(or any other)
right click it >> browse this memory region (ctrl + B)>>tools>>dissect data structures
create a new structure (ctrl+n) press ok,ok, now add the other addresses (ctrl + A) (copy them from the main CE)

Dibujo3.JPG

now in that picture you can compare that teamates share 1 and the others 2
those are the way the program identifies allies and enemies: (IDs)
the first address:value belong to the ebx+4 so in order to reach to the 1s and 2s you see the offset there is C (12)
which means 4 + C(12) = 10 (16) meaning ebx+10 is where you can know if its an ally or an enemy.
This will help for the code.

now go back to main CE and select the first(or any other) address and click "find out what accesses this address"
hit attack (in step 9) and some items will come up, from those you can notice that there is one that makes
a substraction (health going down) so click that one that says
fsubr dword ptr [ebx+04] (remember [ebx+4] is the health)
>> show dissambler>>tools>> auto asembler (ctrl+A) >> template>>code injection

and copy this code:

Code:

alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)
label(allies)     //New label
 
newmem:
cmp [ebx+10],1   //remember [ebx+10] evaluates to 1 or 2  (allies or enemies)
je allies              //if comparation(ebx+10],1) is equal jump to allies
jmp originalcode
 
allies:                //jump
fadd dword ptr [ebx+04]  //instead of decreasing health everytime the allies are attacked the health is added (fadd)
fstp dword ptr [ebp-30]   //Basically we copy the code below ("originalcode" but for the good of our allies)
jmp returnhere               //so it will be stored (fstp) where it is supposed to be "dword ptr [ebp-30] "
 
originalcode:                 //This is so the enemies lose health as they would normally do.
fsubr dword ptr [ebx+04]
fstp dword ptr [ebp-30]
 
exit:
jmp returnhere
 
"Tutorial-i386.exe"+2509D:
jmp newmem
nop
returnhere:

Dibujo4.JPG

Originally Posted by dejaime

I solved it on day 8/15, not too long ago, and the only difference is that I had gone for the 1-hit kill approach.

Very nice bro, yeah in CE step 9 they talk about this as an example

When you have found out how to distinguish between you and the computer you can inject an assembler script that
checks for the condition and then either do not execute the code or do something else. (One hit kills for example)
Alternatively, you can also use this to build a so called "Array of byte" string which you can use to search which will
result in a list of all your or the enemies players

nice way to figure it out the one-hit kill coding, also thanks for telling me about the groups creation I didn't know it.

By the way at the end of step 9 it says

Tip2: There are multiple solutions

it would be cool if we or other people continue this posting other solutions.

OK ,that's what i looking for..share code trouble me a lot,thank you dude