NW ! """""""""""""""""+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""NW HelpMaker L@ `0Ud@,d@,d@ !Object Description MetaData1 Object Store 0Ud@Ud@Ud@YlUHelpMaker File Format v7.1U (C) (R) Delphi Shop Seven http://www.vizacc.com/  0Ud@Ud@Ud@, l0,d@md@md@k  "N1HelpMakerHelpMaker,sIcon=0 exp=1 sel=0N1ProjectsProjects,sIcon=3 exp=1 sel=0N1Cheat EngineHelpDecompileIsCompile=1 Project Target=0 DisplayHelpWhenCompiled=1 DeleteTemp=0 Win16=0 MissingFont=1 TestCompile=0 HtmlExt=.htm Project Name=CheatEngine Title=Cheat Engine help Copyright=Copyright 2015 by Dark Byte DialogFont=MS Sans Serif,8,0 FontSet=ANSI_CHARSET CbLang=0x0409, English (USA) Target5=1 AutoStt=1000 AutoInc=1 AutoCur=1103 Next=Next Prev=Previous Top=Top NavHtml=1 Project Target1=0 Project Target2=1 Project Target3=1 Project Target4=0 Project Target5=0 Project Target6=0 Project Target7=0 WinHelp65536=1 TopicAsPict=1 Target4=1 Exec=1 AutoNum=1 MSDN=0 BinaryToc=0 Color=0 ICON=0 css=0 cssor=0 csschm=hm.css cssweb=hm.css csswebtoc=hmtoc.css undertopic=0 HtmlStatic=0 HtmlBorder=0 HtmlNum=0 HtmlWidth=35 HtmlIndent=20 NavShow=0 Unicode=0 sIcon=7 exp=1 sel=0 DefaultTopic=About CopyTo=..\bin <#TITLE>

<#TOC>
X <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> ) <#TITLE> <#AKEYWORD> <#T_TEXT>  <#TITLE>

<#TOC>
[ <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> ) <#TITLE> <#AKEYWORD> <#T_TEXT> link rel="stylesheet" type="text/css" href="<#CSS>"> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT>  <#TITLE> <#AKEYWORD> <#T_TEXT> <#TITLE> <#AKEYWORD> <#T_TEXT> <#TITLE> <#AKEYWORD> <#T_TEXT> "  <#TITLE> <#AKEYWORD> <#T_TEXT> N1Help ContentsHelp Contents,sIcon=4 exp=1 sel=0N1 About About AboutDateCreated=16/01/2009 DateModified=16/01/2009 DateReview=16/01/2009 CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=19 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=28/12/2009 17:01 sBookPage=14/09/2016 01:17 HW=Main sBookPage2=1 HelpMacro=1{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\par\cf0 This help file is intended to familiarize you with the basic features and usage of Cheat Engine. Some examples for various things are given, but a lot of the actual 'gamehacking' is out of the scope of this document. Please see elsewhere for practical game tutorials.\par\par The contents of this document have been created mainly around v\lang1033\hich\f2\dbch\f2\loch\f2 6.6\lang2057\hich\f2\dbch\f2\loch\f2 (the latest as of this date), although most of it should still apply even if your version differs.\par\par Hopefully you will get used to Cheat Engine in no time and have fun using it!\par\par\qc\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\fs18\par\lang2057\hich\f0\dbch\f0\loch\f0\fs24 {\pict{\*\picprop{\sp{\sn wzDescription}{\sv CE Logo}}}\jpegblip0\picw51\pich72\picwgoal765\pichgoal1080\picscalex100\picscaley100\sspicalign0 ffd8ffe000104a46494600010200006400640000ffec00114475636b79000100040000003c0000ffee000e41646f62650064c000000001ffdb0084000604040405040605050609060506090b080606080b0c0a0a0b0a0a0c100c0c0c0c0c0c10 0c0e0f100f0e0c1313141413131c1b1b1b1c1f1f1f1f1f1f1f1f1f1f010707070d0c0d181010181a1511151a1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1f1fffc00011080048003303011100021101031101ffc4009a000002020301010000000000000000000005070608010304000201000203010100000000000000000000000004020305060110 00010303020304050807090000000000020103041112050006211307312232084133143416516162541535551742a22363a3a446718191a1b15324653711000202010401020407000000000000000001020311211204053141615122321381a14252622314ffda000c03010002110311003f00b2ba00d52a5458715e972de08f163813b2243a480db6d8229199992a08888a55557b340088c6f9af8afe498727ed595036bbf215 94cd2be8eba0d12aa34f1c406ab45e17a03854e36dea888b3fb6f1929fbf0ddb73a91493d64eadee07a6e5f1790776dc37529070651a249e5a834295f687e3899a38e229714e15a7a357d7c6725910e4767184d456a83fb3fccc6e48838cc7ef7db4f200d19ca6e38857a276a0be50db697e8f32c3f95407b0354ba64bd0721cbaa5e24870eceea6ec3de4ae86dbccb339f62ee6c55436640885b71f21f16dde5a2b8297db6d78 56baac65324fa00e0cfe662e0f0592cd4b1338b8b8af4d900d222b84dc76c9d3404251152511e1554d0054dc8752fad9bcf15239b98898fc4e69a28f2712c456794315d6b94e58e382fbf57114956ae5515782a762335f19c964ccbfb385727166194c760b1b1e2bef139c96d05b45a2b8483f37044d68a4a31c339d9ca76cdc97a91ec8f52a130440d72c69e84ab85fe2941d532e4c50dd5d5ce5ab3391dcbb9b05219f887153 f1412aef66fb4a1b9185ce5d2fb2e1155b6f4ad3b2a9a82e5a18975124b435b39b40cb47dcfb6248e2f73424739135b069f6cb98d1344860e098d540d52aa2bfe9485b18cd65792de2db6d2f6cfe92c3fe6e6ecfaa42ff00cffe2ef03bf797fb5eb7ddfe8f8be9e93da6d6f5f964d1d77ea7e4b173036261f171a74acb63dc91947322aea46f607d5c8cac87b3b8d3bcc3212a95c96a529552a8fb5d6e4f08aefbe35477484fed ec6ae036d20be5cd38ac9bcf71e154452511afa3d1ad58476435394e458afbb4f50c7497a2b3fa8ccb1bb7734c5636c3920bd9f1ccad5e9e0c91839cc74491586f9a16513bca8854b3ba6b9b6dae4ce9b8bc38d6bdcb35b736bededb58c0c5e031ec6360851792c020dc48021cc70bc4e38a2028466aa4b4e2abaa47029a0080e67a11d28cc66a566a7604572535ce6c97d9932e3a1b8a9de3b1875b0422ed2541ef2d556aaaab af5368f1c53f219fcb8d99f87afdcdf0dfaf91f75fd5fd67f13c7f4b46436a12be6326608f7fe01314f1bbb998048b9c6591236db82668f30920eeb1a3452320040b884ee251440baee3b7bb411ec63175bdc043c6b39180f4178885a900ad990510910bb695454d6b4a3958392aac709292f43ab6de1fa91b670c388da1bcdd838d032719852a24694204e2a29a01ba06402ab52b45295555a5555551970be0cdcafbb5fa9121 0ea37988c624417b1583cfc7639632dc615d8f25f0044e615c6eb6d038695e22d28a2fe85386a997164876aed6a9fb130d9dd75c6e5f2d0f05b87093b6be6e65c2d24c413846ea9dad32d4a4b2e3707c373628a5dc4552b6ea2506bc8fc2e8cbc319fa8961ed00551eb846cbed5eace5b3f36219e0b7004158d3c45de403ad31c8564dcb3968f7fc733b1157b945fec678f628b33bb1e33b61a7a1aa7e50e061654f65514a3b4a e8d52e4541e3d954ed4f9f5a539e239397a69dd66d368ed8f31f2e2b3222601d6597c05c0027f1f1dc4424b92f075de681517889222a762a57483e5b37a1d3c5793b8fa11d7dc94569d939ac7304e8099c49136591b44a97281f299369486b45b4953e4554d41f264331eb2b44b369f95d6b13b920e672bb9dec88635f666458b1e2044ac88ef03adab8e1b92949bee2a10a20aad7c49e9a65639791bab8f18781e9a8179ed002 43cd66de9d2f68e37720c912c5edb948f64710e5fcb92929c6a3b6e2222daae324541421f099714f094a2f0c85b16e2d2f228f0d9ec167197f1c1426d5bb4d82a0dcd9253820afa3fcb5ab1b23358391b78f6532dfee4c760758333d3a08db7f7434ee5366a3a2d63f360a47231f1d51511a79b412275a02b6de284235b6ea080a1750e2fd8e8b87ce8dabf9162f039ec3e7f0f1733869413719343991a4b75b486b454545a109 092289092228aa2a2a22a6971f3bf4011ddcfd45d8db5a54489b8335171d2a69b6dc78ee9fed28ea908386037136cdc048ae9d0129c493401ddf14ed8fc5e17b97dabef2d7ddff005cf17a8fdef87e7d0077ca8b166457a24b6424459004d488ee8a1b6e3668a2606048a24242b4545edd00564eaff49a66cfdd72f7d60f1ac3db6648b4dbd8dc6c630731e8dc75e73dca647928c518bcdc551ef1d153f496ea6cdaf227cee3bb 618442703bf71b979878e569508ae4045a1898a2556bc3e4feed6842f8cde0e7eeebeca56e4c21071303139b0caedf9efe032c34a9c0751b4705091cb1c68ae036d480549b51b569c53519f1a0c9d1d9dd15aaca3e778cadd3b810be2ddeb324628c01a7200f2e230e2366ae8decb36326485c6e56d4b827c89aa9f112f2c6e3db4e7a463a8036fecf9fbb322e607a75890749840fb4b352150418070901089d7388fa56d04532 412b4568baa6c9456911de3d764fe69bfc0b31f928bf8d7f457c13eedfcefadfe17ebe96347033f4009e95e68363b264ad623352e377d5994cc78f63ad8f147045c90dba2263de14301254f46a7f6e450f935a786c1dbf3a95e5df7c63988996cebed3f1495f8392890e7b7298aaa239ca71629a58e20da6242a2bc17c422a845493d0f6c7092c3684f9e27a2c0fc86f2195dd59b9b0ed4979582d418315c531bc11b62797b40a 88774aeed24554e0a9ab3e77a947f4c125f132e1f4866a47cae637465e7e2d891cd5d9ff0065ab19071bbd41b69c9a0ea45e234332131521adb61d1109ce72586794d1556db581d7b37ae1d03c16059838b52db6c0a97331a50242ba84d2234ae3ce46090dba640d8aab9cd2254a5cb5d54e2c695b17ea34fe29db1f8bc2f72fb57de1af70fae78bd47ef7c3f3ea2"  5813d00551c7f97deac33b809b0838d6390c348b9b39a5ecc f937c9fd9b400d94805b40856e6513c5dea5b5615f8109f0772c37a0547cbb75450050a46114859e4a5254a414a8585ddf635ee950569f2a76f1d4ff00d3ec50fab5fbbd41b93f2e9d568b8eca486d2065244b7f9fec9167380e9a1aa0f2eb223b0d2a00aaaf170787671a26a0aff25d3e0e5a79fa560f99fd1beb0c5764b7f61b79471b31565f8b363a46784d51c3afb538c3b41b8c284d2517b2a8b5d58b92b1e05a5d63dda3 d0245e5dbab0b1c9a49984155695b024952d6dab6d87614424a7eceaa9f3ea1fe9d3c172eb5269e7c0ccfc94ff00b9fe8af827ddbf9df5bfc2fd7d2c6960ffd9} \lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\par\par\par\par\par\par\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\par\par Credits to Psy for revising the initial version of the helpfile ending up into this\par\lang2057\hich\f2\dbch\f2\loch\f2\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b About\plain\f2\fs24\par} N1$About Cheat Engine AboutCheatEngine AboutCheatEngineHelpMacro=2 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=14/09/2016 01:17 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=17 Y1=6 X2=1 Y2=0dicq About Cheat Engine Standard scan settings {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Cheat Engine \lang2057\hich\f2\dbch\f2\loch\f2 is a powerful and feature-rich program designed primarily for \lang1033\hich\f2\dbch\f2\loch\f2 modifying the rules \lang2057\hich\f2\dbch\f2\loch\f2 in games. It has a simple, intuitive interface making it easy for beginners, but it also has a lot 'under the hood' making it ideal for advanced users as well. \lang1033\hich\f1\dbch\f1\loch\f1 This program came into existence because at the time there w\lang2057\hich\f2\dbch\f2\loch\f2 eren't many\lang1033\hich\f1\dbch\f1\loch\f1 free\lang2057\hich\f2\dbch\f2\loch\f2 and \lang1033\hich\f1\dbch\f1\loch\f1 easy\lang2057\hich\f2\dbch\f2\loch\f2 -\lang1033\hich\f1\dbch\f1\loch\f1 to\lang2057\hich\f2\dbch\f2\loch\f2 -u\lang1033\hich\f1\dbch\f1\loch\f1 se modding programs\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1 \lang2057\hich\f2\dbch\f2\loch\f2 T\lang1033\hich\f1\dbch\f1\loch\f1 he ones that w\lang2057\hich\f2\dbch\f2\loch\f2 er\lang1033\hich\f1\dbch\f1\loch\f1 e free weren't very easy to use for a beginner\lang2057\hich\f2\dbch\f2\loch\f2 , or they lacked essential features.\par\lang1033\hich\f1\dbch\f1\loch\f1\line Also, I was used to cheat\lang2057\hich\f2\dbch\f2\loch\f2 ing\lang1033\hich\f1\dbch\f1\loch\f1 on games using \lang2057\hich\f2\dbch\f2\loch\f2 the tool 'G\lang1033\hich\f1\dbch\f1\loch\f1 amehack\lang2057\hich\f2\dbch\f2\loch\f2 '\lang1033\hich\f1\dbch\f1\loch\f1 (and gamewizard in dos), but when I moved on to Win2000 I couldn't get it to work, so decided to make something that did work. \lang2057\hich\f2\dbch\f2\loch\f2 This also have me a chance to learn programming while creating a real project.\par\lang1033\hich\f1\dbch\f1\loch\f1\line Over time Cheat Engine has had a lot of improvements, \lang2057\hich\f2\dbch\f2\loch\f2 additions of new\lang1033\hich\f1\dbch\f1\loch\f1 features, and \lang2057\hich\f2\dbch\f2\loch\f2 higher\lang1033\hich\f1\dbch\f1\loch\f1 stability than the very first versions, and that\lang2057\hich\f2\dbch\f2\loch\f2 's\lang1033\hich\f1\dbch\f1\loch\f1 all thanks to the ideas and suggestions of people that sent me feedback\lang2057\hich\f2\dbch\f2\loch\f2 . If\lang1033\hich\f1\dbch\f1\loch\f1 you want to help make Cheat Engine better, send your ideas and suggestions to\lang2057\hich\f2\dbch\f2\loch\f2 :\lang1033\hich\f2\dbch\f2\loch\f2\par\qc\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18\b dark_byte@hotmail\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1 com\lang2057\hich\f2\dbch\f2\loch\f2\b0\par\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18\line Or you c\lang2057\hich\f2\dbch\f2\loch\f2 an \lang1033\hich\f1\dbch\f1\loch\f1 download the source code, make changes yourself and send them to me (CE is written mainly in pascal, so it helps if you know that language before you try it)\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line Also, another way to motivate me to work on Cheat Engine, is to donate. You can donate whatever amount you \lang2057\hich\f2\dbch\f2\loch\f2 wish through PayPal using the same email as above. If you make regular use of, or get a lot out of cheat engine, please consider donating to at least cover hosting costs for the website.\lang1033\hich\f1\dbch\f1\loch\f1\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b About Cheat Engine\cf0\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1 FAQ's faq's faq'sHelpMacro=1038 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 Dat"  eReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=11 Y1=0 X2=0 Y2=0 sChange=Complete sBook=29/12/2009 16:16 sBookPage=14/09/2016 01:18 sIcon=10 exp=1 sel=0~{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs20\par\fs18\i Note that this is only a small FAQ covering the more common questions. Please search the forum and see the website for solutions to any problems you have that aren't listed here. Oh, and make sure you check the rest of this help document too!\i0\par\fs20\par\par\b Q:\b0 When will there be a MAC version?\par\b A\b0 :As soon as flying pigs have landed on the frozen plains of hell\par\par\b Q:\b0 Will Cheat Engine work on online games?\par\b A\b0 :Most of the time, no\par\par\b Q:\b0 Will Dark Byte help me with online games?\par\b A:\b0 No\par\par\b Q:\b0 If I do send dark byte an e-mail asking how to Cheat in an online game, what will he do?\par\b A:\b0 He won't reply, or he replies in such way that it really pisses you off\par\par\b Q:\b0 I tried editing my money in a online game and it showed on my screen that it worked. But when I bought sometimes with it my money was set back to what it used to be, minus what I just bought\par\b A:\b0 That is because the server knows how much money you have. You just changed the display value\par\par\b Q:\b0 Can I use Cheat Engine to hack, crack or unprotect other programs?\par\b A:\b0 No, you may only use Cheat Engine for legal activities. If the license agreement of a game says to not disassemble it, then do not use CE's disassembler features (if you're scared)!\par\par\b Q:\b0 Do I have to pay for Cheat Engine?\par\b A:\b0 No, Cheat Engine is completely free.\par\par\b Q:\b0 Can I have the sourcecode?\par\b A:\b0 Sure, go to the download page and download it there\par\par\b Q:\b0 I paid over $100 for Cheat Engine, and now I find out I can't use it on my online game. I demand a refund!!!\par\b A:\b0 ...stupid idiot...\par\par\b Q:\b0 Why isn't Cheat Engine digitally signed? I'm too scared to download it now\par\b A:\b0 Because I hate this mentality where everything has to be feared on the internet. If you don't want to download it, then don't, and go to a shrink to deal with your anxiety problems\par\par\b Q:\b0 Can I send dark byte emails that aren't in English ?\par\b A:\b0 Sure, but don't expect him to read beyond the first word before deleting it.\par\par\b Q:\b0 Can I send dark byte emails that are translated to English by an automated translator ?\par\b A:\b0 Can do of course you, expect don't reply any bedspread dark from byte.\par\par\b Q:\b0 When the download finished my anti virus showed up it that is contained a virus! Am I going to die now?\par\b A:\b0 Just add Cheat Engine to the ignore list, it's a false positive, or anti-virus vendors are just retards. Again, if you're too scared to run it, then don't.\par\par\b Q:\b0 When will the next version of Cheat Engine come out?\par\b A:\b0 Someday\par\par\b Q:\b0 Will the next version of Cheat Engine be undetected for current anti-Cheat systems?\par\b A:\b0 Most likely not\par\par\b Q:\b0 I can't run a memory-scan or pointer-scan because CE can't allocate memory (or similar message). How can I fix this?\par\b A:\lang1033\hich\f2\dbch\f2\loch\f2\b0 Try deleting the contents of your TEMP folder\lang2057\hich\f2\dbch\f2\loch\f2\par\par\b Q:\b0 I've found a bug. Can I report this, and if so, how?\par\b A:\b0 Feel free to submit bugs and suggestions to me via email or PM. Check out the bugtracker (from the main page) to see if it's already been noted though.\par\par\b Q:\b0 I'm having 'xxx' issue with 'xxx' game and also 'xxx'. Can you tell me what to do?\par\b A:\b0 No. Such questions are out of the scope of this guide, and have most likely been covered before anyway. The best thing to do is visit the forum and run a search there, or post.\par\par\b Q:\b0 Can you make a 'xxx' hack for 'xxx' game for me?\par\b A:\b0 No. And if it's for an online game, even more definitely no!\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b FAQ's\fs20\b0\par} N1Main InterfaceMainInterfaceMainInterfaceDateCreated=16/01/2009 DateModified=16/01/2009 DateReview=16/01/2009 CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=28/12/2009 17:01 sBookPage=30/12/2009 19:46 HW=Main sBookPage2=1{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs18\par The main interface is the first screen; the first layout that you get when opening CE. This chapter will cover the various features and menus accessible from this view. If you are new to CE, then this chapter is of particular importance, as it will help to get you quickly up-to-speed with using it.\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw1"  2240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b Main Interface\plain\f2\fs24\par} N1Standard menumenumenu$HelpMacro=1035 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=16/01/2009 DateModified=16/01/2009 DateReview=16/01/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=60 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=16/01/2009 17:11 sBookPage=14/09/2016 01:21 sIcon=10 exp=0 sel=0N{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b\ul File:\par\lang1033\hich\f2\dbch\f2\loch\f2\ul0\par \trowd\trgaph60\trleft0 \clvertalt\cellx4320 \clvertalt\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Add scan tab\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Add a new scan tab where you can start a new search which is independent from other searches in the other tabs\b\cell \intbl\row \trowd\trgaph60\trleft0\trrh230 \clvertalt\cellx4320 \clvertalt\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Clear list\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Clears the addresslist\b\cell \intbl\row \trowd\trgaph60\trleft0 \clvertalt\cellx4320 \clvertalt\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Save\lang1033\hich\f2\dbch\f2\loch\f2\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18 Saves the current cheat table (.CT) to a location of your choice.\lang1033\hich\f2\dbch\f2\loch\f2\b\cell \intbl\row \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Load\lang1033\hich\f2\dbch\f2\loch\f2\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18 Loads a previously saved cheat table (.CT) into cheat engine.\lang1033\hich\f2\dbch\f2\loch\f2\b\cell \intbl\row \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Save current scanresults\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Save the current scan results in the selected tab. You can compare a value to the saved scan results when you are making an unknown value scan (similarly as comparing to fist scan results)\par\b\cell \intbl\row \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Quit\b0\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Close Cheat Engine\cell \intbl\row \pard\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b\par\par\lang2057\hich\f2\dbch\f2\loch\f2\ul Edit:\par\lang1033\hich\f2\dbch\f2\loch\f2\par \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx4320 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Settings\lang1033\hich\f2\dbch\f2\loch\f2\ul\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18 Opens the cheat engine configuration window.\lang1033\hich\f2\dbch\f2\loch\f2\b\ul\cell \intbl\row \pard\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b\ul\par\lang1033\hich\f2\dbch\f2\loch\f2 Table\lang2057\hich\f2\dbch\f2\loch\f2 :\par\lang1033\hich\f2\dbch\f2\loch\f2\par \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx4320 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Show Cheat Table lua script\ul\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Brings up the lua script associated with the current table\b\ul\cell \intbl\row \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Create Form\b0\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Creates a new form (a window) that you can design. You can also load an existing form if you like\cell \plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\intbl\row \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b \b0\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 A list of forms that you can show or edit\cell \plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\intbl\row \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Add File(s)\b0\cell \pard\intbl\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 This lets you add binary files to your cheat table. You can access these files using lua fileTable objects\cell \plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\intbl\row \pard\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b\ul\par\ul0\tab\tab\tab\b0\par\b\tab\tab\tab\b0\par\par\b\ul Process:\par\lang1033\hich\f2\dbch\f2\loch\f2\par \trowd\trgaph60\trleft0\trrh414 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx4320 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Open Process window\lang1033\hich\f2\dbch\f2\loch\f2\ul\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18 Opens the process list window. Just the\lang1033\hich\f2\dbch\f2\loch\f2 \lang2057\hich\f2\dbch\f2\loch\f2 same as using the Process Picker icon.\lang1033\hich\f2\dbch\f2\loch\f2\b\ul\cell \intbl\row \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx4320 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\b Create Process\b0\tab\lang1033\hich\f2\dbch\f2\loch\f2\b\ul\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18 Opens a windows explorer view, where you\lang1033\hich\f2\dbch\f2\loch\f2 \lang2057\hich\f2\dbch\f2\loch\f2 can specify a process to load (.EXE file).\lang1033\hich\f2\dbch\f2\loch\f2\b\ul\cell \intbl\row \pard\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18 From this menu you can also simply pick an enumerated process to load.\par\cf0\fs20\par\lang1033\hich\f2\dbch\f2\loch\f2\fs18\b\ul Tools\fs20\b0 :\par\"  fs18\ul0 You can access to the tools that you have specified in the settings. This option is not visible if there are no specified tools. \fs20\par\par\lang2057\hich\f2\dbch\f2\loch\f2\par\fs18\b\ul Help:\par\lang1033\hich\f2\dbch\f2\loch\f2\par \trowd\trgaph60\trleft0\trrh219 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx4320 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\fs18\b Cheat Engine Help\lang1033\hich\f2\dbch\f2\loch\f2\ul\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\fs18 Launches this help file.\lang1033\hich\f2\dbch\f2\loch\f2\b\ul\cell \intbl\row \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx4320 \clvertalt\clbrdrt\brdrcf2\clbrdrb\brdrcf2\clbrdrl\brdrcf2\clbrdrr\brdrcf2\cellx8640 \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\fs18\b About\lang1033\hich\f2\dbch\f2\loch\f2\ul\cell \pard\intbl\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\fs18 Shows CE's about box, containing credits and links.\lang1033\hich\f2\dbch\f2\loch\f2\b\ul\cell \intbl\row \pard\s0\ql\plain\f1\fs24\lang2057\hich\f2\dbch\f2\loch\f2\fs18\b\ul\par\ul0\tab\tab\tab\b0\par\tab\b\par\tab\tab\tab\tab\tab\b0\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Standard menu\cf0\fs20\b0\par} N1Select processSelectProcessSelectProcessHelpMacro=4 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=1 sel=0 sBook=13/09/2008 03:13 sBookPage=31/12/2010 20:46 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=14 Y1=0 X2=0 Y2=0"Select Process | {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf0\fs18 The select window process\lang2057\hich\f2\dbch\f2\loch\f2 (or sometimes known as 'Process Picker')\lang1033\hich\f1\dbch\f1\loch\f1 can be accessed by clicking on the computer icon on the top left side of the main window.\line\line This window holds a list of all the processes currently running.\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 Double click on a entry and cheat engine will open this process for scanning\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 (\lang2057\hich\f2\dbch\f2\loch\f2 a\lang1033\hich\f1\dbch\f1\loch\f1 process is a program or game running in windows)\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line If you click on the window button at the bottom you'll get to see all the windows, and the processes that own them, so if you don't know the process name you can use the window to find the process.\line\line The process window also has the ability to attach the debugger the a running process, or to create a new process. The option to create a process will create the process, attach the debugger to it and break the process at the Entry Point for manual debugging.\par The create process option is compatible with the windows debugger only. \par\line If you have enabled the option to use the processwatcher in settings->extra you will have an option in the process window saying "Process watcher". Clicking that will open the process watcher window. It'll show you which processes have been created since the start of C\lang2057\hich\f2\dbch\f2\loch\f2 E.\lang1033\hich\f1\dbch\f1\loch\f1\line\par Open file will open a file for hex-editing\cf2\fs24\par\plain\f1\fs24\par} V{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Select\lang2057\hich\f2\dbch\f2\loch\f2 p\lang1033\hich\f1\dbch\f1\loch\f1 rocess\cf0\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1(Memory scan settings(Standardscansettings(StandardscansettingsHelpMacro=3 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=31/12/2010 20:52 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=32 Y1=0 X2=0 Y2=20Standard scan settings Next scan value types Undo scan array to scan scan types First scan read only Select Process u{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red"  0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18\b First scan\b0\line The "First Scan" is the first thing you do when you are scanning the memory. "First Scan" initializes the data structures inside cheat engine and reads the complete memory of the selected game. If you already know the value it will scan the memory while it's reading, and take less memory.\line\line\b Next scan\b0\line The next scan processes the results of the previous scan. If you did a first scan before with a "Advanced" scantype, it wont have any results, but cheat engine does contain the memory of the game as it was when you did the scan the previous time. That way you can do a scan for a changed,unchanged value etc...\line If you did get results from a previous scan the next scan will look at those results, and compare them to the scantype you selected, and remove those addresses that don't pass the test, making the list smaller and smaller till there are only a few or even 1 address left.\line\line\b Undo scan\b0\line If you made a error while scanning, like searching for a increased value, while you had to search for a decreased value, you can click "Undo Scan" and Cheat Engine will restore the results back to the previous scan, allowing you to try again, instead of completely starting over.\line\line\b New scan\b0\line The new scan wipes out all your results, and frees the memory, allowing you to start a new scan.\line\line\b Scan types\b0\line In the scantype combobox you can select what type of scanning will be done.\line\line\b Value types\b0\line In the value types combobox you can select what type of address you are looking for.\line Norma\lang2057\hich\f2\dbch\f2\loch\f2 l\lang1033\hich\f1\dbch\f1\loch\f1 ly\lang2057\hich\f2\dbch\f2\loch\f2 (meaning in most cases)\lang1033\hich\f1\dbch\f1\loch\f1 a\lang2057\hich\f2\dbch\f2\loch\f2 given\lang1033\hich\f1\dbch\f1\loch\f1 value is 4-bytes in windows\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1 \lang2057\hich\f2\dbch\f2\loch\f2 S\lang1033\hich\f1\dbch\f1\loch\f1 ometimes it is different, or you are looking for something else,\lang2057\hich\f2\dbch\f2\loch\f2 so\lang1033\hich\f1\dbch\f1\loch\f1 in that case choose another value type.\lang2057\hich\f2\dbch\f2\loch\f2 Usually when you draw a blank with a 4-byte scan choose another (such as 2-byte or even 1-byte for example).\lang1033\hich\f1\dbch\f1\loch\f1\line\line\lang2057\hich\f2\dbch\f2\loch\f2\b Range to\lang1033\hich\f1\dbch\f1\loch\f1 scan\b0\line Programs reside in memory, and store their addresses in various locations\lang2057\hich\f2\dbch\f2\loch\f2 within this space\lang1033\hich\f1\dbch\f1\loch\f1 . With th\lang2057\hich\f2\dbch\f2\loch\f2 e two value boxes \lang1033\hich\f1\dbch\f1\loch\f1 you can increase/decrease the number of locations that Cheat Engine will look at for the address you need. This can dramatically increase your scanning speed, and improve the results, when used wisely.\line\lang2057\hich\f2\dbch\f2\loch\f2\i\par\lang1033\hich\f1\dbch\f1\loch\f1\i0 If you've changed the scanning range and wish to reset it to it's default value, right-click on the range value and choose the "Reset range" option. \line\line\lang2057\hich\f2\dbch\f2\loch\f2\b Read-Only\lang1033\hich\f1\dbch\f1\loch\f1\b0\line The readonly checkbox tells Cheat Engine, if you want to scan read-only memory or not. Norma\lang2057\hich\f2\dbch\f2\loch\f2 l\lang1033\hich\f1\dbch\f1\loch\f1 ly games do not store important game information in read-only memory, but sometimes you may feel a need to scan that memory anyhow. (e.g. If you want to change some text in the game etc...)\line\line\lang2057\hich\f2\dbch\f2\loch\f2\b F\lang1033\hich\f1\dbch\f1\loch\f1 ast\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 scan\b0\line The \lang2057\hich\f2\dbch\f2\loch\f2 F\lang1033\hich\f1\dbch\f1\loch\f1 ast\lang2057\hich\f2\dbch\f2\loch\f2 S\lang1033\hich\f1\dbch\f1\loch\f1 can\lang2057\hich\f2\dbch\f2\loch\f2 (aligned scan)\lang1033\hich\f1\dbch\f1\loch\f1 checkbox tells CE to skip addresses that ar\lang2057\hich\f2\dbch\f2\loch\f2 e\lang1033\hich\f1\dbch\f1\loch\f1 n't located on a\lang2057\hich\f2\dbch\f2\loch\f2 32-bit \lang1033\hich\f1\dbch\f1\loch\f1 aligned\lang2057\hich\f2\dbch\f2\loch\f2 boundary\lang1033\hich\f1\dbch\f1\loch\f1 .\lang2057\hich\f2\dbch\f2\loch\f2 (Ad\lang1033\hich\f1\dbch\f1\loch\f1 dress\lang2057\hich\f2\dbch\f2\loch\f2 es\lang1033\hich\f1\dbch\f1\loch\f1 divi\lang2057\hich\f2\dbch\f2\loch\f2 sible\lang1033\hich\f1\dbch\f1\loch\f1 by\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 4\lang2057\hich\f2\dbch\f2\loch\f2 basically). In other words, addresses ending with 0, 4, 8 and C\lang1033\hich\f1\dbch\f1\loch\f1 )\lang2057\hich\f2\dbch\f2\loch\f2\par Most times you can get away with using this option ticked, as most variables in games get assigned to\par these aligned locations. This will dramatically cut down on your scanning time!\par\par Do not underestimate the use of this option. In many/most cases you can set this to on by default (see CE options) to speed up your work! For most users, under most situations, I recommend you set this to on.\lang1033\hich\f1\dbch\f1\loch\f1\par\par The default alignment is 4 bytes but you are able to change it to a custom value (e.g: 8, which will cause ce to search for addresses dividable by 8 only)\lang2057\hich\f2\dbch\f2\loch\f2\par\par\lang1033\hich\f1\dbch\f1\loch\f1 If you use the "Last digits" option, CE will scan only for addresses where the last digit(s) match the given digit.\par Note: To use a high digit value you must have a buffersize in settings to a value that is higher than the digits you're looking for\lang2057\hich\f2\dbch\f2\loch\f2\par\line\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par\lang2057\hich\f2\dbch\f2\loch\f2\fs18\b Enable Speedhack\par\b0 Enables the \cf3 Sp\cf2 eedhack function. See here for more detailed information: \cf4\ul{\field{\*\fldinst HYPERLINK Speedhack}{\fldrslt Speedhack Info}}\cf0\ul0\par\par\b Unrandomizer\par\b0 This feature scans for and changes certain routines that are commonly used to generate random values, making them always return the same. You should be cautious though with this option, as there is a chance that CE will overwrite the wrong routines and potentially cause a crash. If the program uses an unknown random generator (IE. CE doesn't know about it) then this option will fail. For most users, during general use, don't touch this option.\plain\f1\fs24\par} :{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Memory\lang1033\hich\f1\dbch\f1\loch\f1 scan settings\cf0\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Scan typesScantypesScantypes" HelpMacro=9 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=14/09/2016 01:25 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=59 Y1=101 X2=0 Y2=4Smaller than Exact Decreased by Decreased Increased Increased by Unchanged Changed Bigger than scan types Address list r{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red255\green0\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf0\fs18\b Unknown initial value: (\lang2057\hich\f2\dbch\f2\loch\f2 Available on f\lang1033\hich\f1\dbch\f1\loch\f1 irs\lang2057\hich\f2\dbch\f2\loch\f2 t\lang1033\hich\f1\dbch\f1\loch\f1 scan only)\b0\line This scantype makes a copy of the game in memory, so it can be used later on.\lang2057\hich\f2\dbch\f2\loch\f2 If you don't know the value of a variable in-game, then this scantype is usually the first step. It can take a while depending on the memory and cpu-intensity of the game and the spec of your PC.\par\lang1033\hich\f1\dbch\f1\loch\f1\line\b Exact:\b0\line The "exact" scan will scan the memory for the value\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 (or string) you've entered\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line\b Bigger than\b0\line The "Bigger than" scantype scans for all the values that are higher than the value you've entered\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\b\line Smaller than\b0\line The "Smaller than" scantype scans for all the values that are smaller than the value you've entered\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\par\b Value between...\b0\par Scan for values that are within the specified interval.\par\par\cf3\i The following scantypes are available only when doing a \lang2057\hich\f2\dbch\f2\loch\f2 '\lang1033\hich\f1\dbch\f1\loch\f1 next scan\lang2057\hich\f2\dbch\f2\loch\f2 ':\cf0\par\lang1033\hich\f1\dbch\f1\loch\f1\b\par\i0 Value between... at least xx%\b0\par Scan for values that are within the specified percentage interval compared to the last, first or saved scan result. \line\line\b Increased\b0\line If the value of a address has increased it will be added to the list.\line\line\b Increased by...\b0\line If the value of a address has increased with the specified amount it will be added to the list.\par\b\par Increased by... at least xx%\b0\par If the value of an address has increased within the specified percentage interval, it will be added to the list.\par\line\b Decreased\b0\line If the value of a address has decreased it will be added to the list.\line\line\b Decreased by...\b0\line If the value of a address has decreased with the specified amount it will be added to the list.\line\par\b Decreased by... at least xx%\b0\par If the value of an address has decreased within the specified percentage interval, it will be added to the list.\par\line\b Changed\b0\line This scantype will check if the value of an address has changed or not. If it has changed it'll be added to the list\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line\b Unchanged\b0\line This scantype will check if the value of an address has changed or not . If it has not it'll be added to the list\line\line\b Compare to first/saved scan\b0\line This scantype isn't actually a scantype but when selected it will change the values you are comparing with with the values of a previously saved scan. This can be the first scan, but also a saved scan\par\par\b Compare to previous scan\b0\line When you're currently comparing to old values you can use this to compare against the results of the last scan (back to normal behavior)\par\par --\par\b Not\par\b0 This will do one of the above scans, but only returns addresses that do NOT adhere to the requirement\par\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\b Scan types\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Value typesValuetypesValuetypesHelpMacro=7 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=14/09/2016 01:25 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=46 Y1=0 X2=1 Y2=0value types 4{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf4\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf0\fs18\b Binary\b0\line The binary scan is a slow but powerful scan.\line It will scan between bytes for a value\line Also, if you want to search for a array of bits that possible too, it even allows wildcard(?,*) instead of the normal 1's an"d 0's. This allows you to do a search like 1101?001, which will give the results of all addresses+bit that have either 11010001 or 11011001. (More wildcards in a string are allowed)\line\line The range of a bitscan can be as long as you like. (as long as it fits in the memory)\line\line If you're wondering if this is useful: \line Lets say a program stores the following values as follow:\line 100=1001100100110110\line 200=1011001000101001\line 300=1100101100110110\line\line also note that in normal binary notation the following values are:\line 100=1100100\line 200=11001000\line 300=100101100\line\line now, if you look at the above example you'll notice that the binary value of 100 does apear in the binary that represents 100, but has a 1 as last bit, and the first few bits are random (read from right to left) , same for 200 and 300, with the binary scan you can scan for the binary representation of the values 100-200 or 300.\line\line\b Byte\b0 (8-bits)\line A byte is a value that can hold a number between 0 and 255 or -128 to 127. (The last one if it is a \cf3\ul{\field{\*\fldinst HYPERLINK Signedvalue}{\fldrslt signed value }}\cf0\ul0 )\line 1-byte values aren't used much except for 8-bit emulators, etc... Even though a 1-byte scan seems useless, it will normally find the value when you don't know for sure if the value is either 1-byte, 2-bytes, 4-bytes, or 8-bytes, that is because all those types are build from this base type.\line\line Of course, the number of initial addresses you'll find doing a 1 byte scan is very big, and it will take a while to find the address you're looking for, but at least the change of finding it is higher.\line\line\b 2 bytes\b0 (16-bits\lang2057\hich\f2\dbch\f2\loch\f2 / WORD\lang1033\hich\f1\dbch\f1\loch\f1 )\line a "2 Byte" value can hold a number between 0 and 65536 or -32768 to 32767 (The last one if it is a \cf3\ul{\field{\*\fldinst HYPERLINK Signedvalue}{\fldrslt signed value}}\cf0\ul0 )\line "2 byte" values are used in old dos games, and other 16-bit application\lang2057\hich\f2\dbch\f2\loch\f2 s\lang1033\hich\f1\dbch\f1\loch\f1 .\line\line\line\b 4 bytes\b0 (32-bits\lang2057\hich\f2\dbch\f2\loch\f2 / DWORD\lang1033\hich\f1\dbch\f1\loch\f1 )\line a "4 byte" value can hold a number between 0..4294967295 or -2147483648 and 2147483647 (The last one if it is a \cf3\ul{\field{\*\fldinst HYPERLINK Signedvalue}{\fldrslt signed value }}\cf0\ul0 )\line "4 byte" values are the standard way of storing information in a windows system. So doing a 4-byte scan will normally give the best results.\line\line\b 8 bytes\b0 (64-bits\lang2057\hich\f2\dbch\f2\loch\f2 / QWORD\lang1033\hich\f1\dbch\f1\loch\f1 )\line a "8 byte" value can hold a number between 9223372036854775808 and 9223372036854775807 (no need for unsigned values anymore)\line "8 bytes" aren't used often because they take up a lot of space, and require extra processing. (except for 64-bit processors)\line Some programs do use them though, and scanning for a "8-byte" value doesn't return many addresses, so finding the right one is easy then.\line\line If the address you're looking for is smaller than 8 bytes, the chance that the scan has skipped that address is big.\line\line\b Float/Single\b0 (32-bits) (IEEE standard)\line a "Single" value can hold a number between 1.5 x 10^-45 and 3.4 x 10^38\tab\tab .\line\line This is one of the 2 standard floating-point value allocations. (IEEE) The other one is DOUBLE\line A Single consists of 4 bytes, which is build up in a special way, which is VERY different from normal variables! (so normal byte scanning wont work)\line\line Cheat Engine rounds values up/down till the number of digits you specify in the scan value box.\line e.g.:if you scan for 12 it will find all values between 11.5 and 12.4 and 12.0 results in values between 11.95 and 12.04\line\line\lang2057\hich\f2\dbch\f2\loch\f2\b D\lang1033\hich\f1\dbch\f1\loch\f1 ouble\b0 (64-bits) (IEEE standard)\line\lang2057\hich\f2\dbch\f2\loch\f2 Basically the same as S\lang1033\hich\f1\dbch\f1\loch\f1 ingle,\lang2057\hich\f2\dbch\f2\loch\f2 except the data-length is longer (more precise)\lang1033\hich\f1\dbch\f1\loch\f1 \lang2057\hich\f2\dbch\f2\loch\f2 but\lang1033\hich\f1\dbch\f1\loch\f1 the range is between 5.0 x 10^-324 and 1.7 x 10^308\tab\line\line\line\b Text\b0\line The "Text" scan\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 value can be used to scan the memory of a game for text. E.g: if you know that 12 bytes after your name as a variable you need you can use that to recalculate the addresses each time a game restarts.\par Text scans are in UTF-8 or UTF-16\line\line\lang2057\hich\f2\dbch\f2\loch\f2\b A\lang1033\hich\f1\dbch\f1\loch\f1 rray of byte\b0\line Same as text, but uses a array of byte instead of characters, and supports wildcards.\line input:\line xx xx xx xx ...\line xx ?? xx xx\line xx ** xx xx\line\line\lang2057\hich\f2\dbch\f2\loch\f2 An\lang1033\hich\f1\dbch\f1\loch\f1 array of byte\lang2057\hich\f2\dbch\f2\loch\f2 (AoB)\lang1033\hich\f1\dbch\f1\loch\f1 scan can be useful when you know that prior to the address you need is always a specific occurrence of bytes. (like: 66 66 66 10 10, and 4 bytes after that is your health which is stored as 1 byte. Scanning for 1 byte will take a lot longer than scanning for this string of bytes. Scanning for this string will probably only result 1 address, where as scanning for 1 byte will return thousands of addresses the first time)\line\line\b All\b0\line A combination of byte, 2 bytes, 4 bytes, 8 bytes, single and double\lang2057\hich\f2\dbch\f2\loch\f2 data-types (basically the numeric ones).\lang1033\hich\f1\dbch\f1\loch\f1\line\line\b Custom\b0\line Lets you assign an lua or auto assembler script where you can fill in how certain bytes should be interpreted as a decimal value and the other way arround\par\par To create a custom scan script, right-click on the value type box and select the option from the menu.\par\par To delete or edit a custom scanscript, select it and press right-click. Then choose Edit or Delete from the menu. \par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\b Value types\cf2\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1(Custom type examplesDateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 CT1=0 CT2=0 CT3=0 CT4=0 CT5=0 CT6=0 CT7=0 CT8=0 CT9=0 CX1=0 CX2=0 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=11/05/2011 19:39 sBookPage=11/05/2011 19:39{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\" blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} N16Money type (divided by 100)2money-type-divided-by-1002money-type-divided-by-100$HelpMacro=1095 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=17 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=01/01/2011 18:50 sBookPage=01/01/2011 18:55 sIcon=10 exp=1 sel=0 {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 The following custom type script will handle values that need to be divided by 100 to get to the correct value\par This type is used by some games like civilization 5 where the money and research technology is stored using this floating point type.\par\par example:\par 100.35 gold would be stored in memory as 10013\par 103.89 gold would be stored in memory as 10389\par\par with this script you'd be able to scan for 100 and 103 respectively, and if you wanted to change the value to 700 you'd just change the value to 700 instead of 70000\par\par\hich\f2\dbch\f2\loch\f2\par alloc(TypeName,256)\par alloc(ByteSize,4)\par alloc(ConvertRoutine,1024)\par alloc(ConvertBackRoutine,1024)\par\par TypeName:\par db 'Civ 5 Float',0\par\par ByteSize:\par dd 4\par\par //The convert routine should hold a routine that converts the data to an nteger (in eax)\par //function declared as: stdcall int ConvertRoutine(unsigned char *input);\par\par //Note: Keep in mind that this routine can be called by multiple threads at the same time.\par\par ConvertRoutine:\par [32-bit]\par push ebp\par mov ebp,esp\par push ecx\par mov ecx,[ebp+8]\par [/32-bit]\par\par //at this point ecx contains the address where the bytes are stored\par //save the used registers\par push edx //fun fact about ce's assembler, because push ebx does not exist in 64-bit it becomes the 64-bit push rdx automatically\par push ebx\par\par //put the bytes into the eax register\par mov eax,[ecx] //second fun fact, addressing with 32-bit registers doesn't work in 64-bit, it becomes a 64-bit automatically (most of the time)\par\par xor edx,edx\par mov ebx,#100\par div ebx //divide eax by 100 and put the result in eax (and leftover in edx)\par\par pop ebx\par pop edx\par //and now exit the routine\par [64-bit]\par ret\par [/64-bit]\par [32-bit]\par pop ecx\par pop ebp\par ret 4\par [/32-bit]\par\par //The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)\par //function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);\par ConvertBackRoutine:\par [32-bit]\par push ebp\par mov ebp,esp\par push edx //save the registers\par push ecx\par mov edx,[ebp+0c]\par mov ecx,[ebp+08]\par [/32-bit]\par\par //at this point edx contains the address to write the value to\par //and ecx contains the value\par push eax\par push edx\par push ecx\par\par mov eax,ecx //eax gets the given value\par xor edx,edx //clear edx\par mov ecx,#100\par mul ecx //multiply eax and put the results into edx:eax (edx is ignored for this routine)\par\par pop ecx\par pop edx\par mov [edx],eax\par pop eax\par\par [64-bit]\par //everything is back to what it was, so exit\par ret\par [/64-bit]\par\par [32-bit]\par //cleanup first\par pop ecx\par pop edx\par pop ebp\par ret 8\par [/32-bit] \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Money type (divided by 100)\par} N1"Old Flash (div 8)*divide-by-8-old-flash*divide-by-8-old-flash"HelpMacro=1096 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=5 sChange=Under Construction sBook=01/01/2011 18:54 sBookPage=01/01/2011 19:32 sIcon=10 exp=0 sel=0@ {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\c" s1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 This is just the money type adjusted to 8 (in case you didn't get it in the previous example)\par\par\hich\f2\dbch\f2\loch\f2\par alloc(TypeName,256)\par alloc(ByteSize,4)\par alloc(ConvertRoutine,1024)\par alloc(ConvertBackRoutine,1024)\par\par TypeName:\par db 'Civ 5 Float',0\par\par ByteSize:\par dd 4\par\par //The convert routine should hold a routine that converts the data to an nteger (in eax)\par //function declared as: stdcall int ConvertRoutine(unsigned char *input);\par\par //Note: Keep in mind that this routine can be called by multiple threads at the same time.\par\par ConvertRoutine:\par [32-bit]\par push ebp\par mov ebp,esp\par push ecx\par mov ecx,[ebp+8]\par [/32-bit]\par\par //at this point ecx contains the address where the bytes are stored\par //save the used registers\par push edx //fun fact about ce's assembler, because push ebx does not exist in 64-bit it becomes the 64-bit push rdx automatically\par push ebx\par\par //put the bytes into the eax register\par mov eax,[ecx] //second fun fact, addressing with 32-bit registers doesn't work in 64-bit, it becomes a 64-bit automatically (most of the time)\par\par xor edx,edx\par mov ebx,#8\par div ebx //divide eax by 8and put the result in eax (and leftover in edx)\par\par pop ebx\par pop edx\par //and now exit the routine\par [64-bit]\par ret\par [/64-bit]\par [32-bit]\par pop ecx\par pop ebp\par ret 4\par [/32-bit]\par\par //The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)\par //function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);\par ConvertBackRoutine:\par [32-bit]\par push ebp\par mov ebp,esp\par push edx //save the registers\par push ecx\par mov edx,[ebp+0c]\par mov ecx,[ebp+08]\par [/32-bit]\par\par //at this point edx contains the address to write the value to\par //and ecx contains the value\par push eax\par push edx\par push ecx\par\par mov eax,ecx //eax gets the given value\par xor edx,edx //clear edx\par mov ecx,#8\par mul ecx //multiply eax and put the results into edx:eax (edx is ignored for this routine)\par\par pop ecx\par pop edx\par mov [edx],eax\par pop eax\par\par [64-bit]\par //everything is back to what it was, so exit\par ret\par [/64-bit]\par\par [32-bit]\par //cleanup first\par pop ecx\par pop edx\par pop ebp\par ret 8\par [/32-bit] \par\hich\f1\dbch\f1\loch\f1\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Divide by 8 (old flash)\par} N1"Big Endian 2 byte"big-endian-2-byte"big-endian-2-byte$HelpMacro=1101 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=24/12/2015 DateModified=24/12/2015 DateReview=24/12/2015 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=71 X2=0 Y2=0 sChange=Under Construction sBook=24/12/2015 19:03 sBookPage=24/12/2015 19:04 sIcon=10 exp=0 sel=0@Big Endian Endian Custom Type {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 This script will add the 2 byte Big Endian type support to cheat engine\par\par alloc(TypeName,256)\par alloc(ByteSize,4)\par alloc(ConvertRoutine,1024)\par alloc(ConvertBackRoutine,1024)\par\par TypeName:\par db '2 Byte Big Endian',0\par\par ByteSize:\par dd 2\par\par //The convert routine should hold a routine that converts the data to an integer (in eax)\par //function declared as: stdcall int ConvertRoutine(unsigned char *input);\par //Note: Keep in mind that this routine can be called by multiple threads at the same time.\par ConvertRoutine:\par //jmp dllname.functionname\par [64-bit]\par //or manual:\par //parameters: (64-bit)\par //rcx=address of input\par xor eax,eax\par mov ax,[rcx] //eax now contains the bytes 'input' pointed to\par xchg ah,al //convert to big endian\par\par ret\par [/64-bit]\par\par [32-bit]\par //jmp dllname.functionname\par //or manual:\par //parameters: (32-bit)\par push ebp\par mov ebp,esp\par //[ebp+8]=input\par //example:\par mov eax,[ebp+8] //place the address that contains the bytes into eax\par mov ax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value\par and eax,ffff //cleanup\par xchg ah,al //convert to big endian\par\par pop ebp\par ret 4\par [/32-bit]\par\par //The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)\par //function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);\par ConvertBackRoutine:\par //jmp dllname.functionname\par //or manual:\par [64-bit]\par //parameters: (64-bit)\par //ecx=input\par //rdx=address of output\par //example:\par xchg ch,cl //convert the little endian input into a big endian input\par mov [rdx],cx //place the integer the 4 bytes pointed to by rdx\par\par ret\par [/64-bit]\par\par [32-bit]\par //parameters: (32-bit)\par push ebp\par mov ebp,esp\par //[ebp+8]=input\par //[ebp+c]=address of output\par //example:\par push eax\par push ebx\par mov eax,[ebp+8] //load the value into eax\par mov ebx,[ebp+c] //load the address into ebx\par\par //convert the value to big endian\par xchg ah,al\par\par mov [ebx],ax //write the value into the address\par pop ebx\par pop eax\par\par pop ebp\par ret 8\par [/32-bit] \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowau" tofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Big Endian 2 byte\par} N1"Big Endian 4 byte"big-endian-4-byte"big-endian-4-byte$HelpMacro=1102 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=24/12/2015 DateModified=24/12/2015 DateReview=24/12/2015 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=14 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=24/12/2015 19:04 sBookPage=24/12/2015 19:05 sIcon=10 exp=0 sel=0@Big Endian Endian Custom Type {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 alloc(TypeName,256)\par alloc(ByteSize,4)\par alloc(ConvertRoutine,1024)\par alloc(ConvertBackRoutine,1024)\par\par TypeName:\par db '4 Byte Big Endian',0\par\par ByteSize:\par dd 4\par\par //The convert routine should hold a routine that converts the data to an integer (in eax)\par //function declared as: stdcall int ConvertRoutine(unsigned char *input);\par //Note: Keep in mind that this routine can be called by multiple threads at the same time.\par ConvertRoutine:\par //jmp dllname.functionname\par [64-bit]\par //or manual:\par //parameters: (64-bit)\par //rcx=address of input\par xor eax,eax\par mov eax,[rcx] //eax now contains the bytes 'input' pointed to\par bswap eax //convert to big endian\par\par ret\par [/64-bit]\par\par [32-bit]\par //jmp dllname.functionname\par //or manual:\par //parameters: (32-bit)\par push ebp\par mov ebp,esp\par //[ebp+8]=input\par //example:\par mov eax,[ebp+8] //place the address that contains the bytes into eax\par mov eax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value\par\par bswap eax\par\par pop ebp\par ret 4\par [/32-bit]\par\par //The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)\par //function declared as: stdcall void ConvertBackRoutine(int i, unsigned char *output);\par ConvertBackRoutine:\par //jmp dllname.functionname\par //or manual:\par [64-bit]\par //parameters: (64-bit)\par //ecx=input\par //rdx=address of output\par //example:\par bswap ecx //convert the little endian input into a big endian input\par mov [rdx],ecx //place the integer the 4 bytes pointed to by rdx\par\par ret\par [/64-bit]\par\par [32-bit]\par //parameters: (32-bit)\par push ebp\par mov ebp,esp\par //[ebp+8]=input\par //[ebp+c]=address of output\par //example:\par push eax\par push ebx\par mov eax,[ebp+8] //load the value into eax\par mov ebx,[ebp+c] //load the address into ebx\par\par //convert the value to big endian\par bswap eax\par\par mov [ebx],eax //write the value into the address\par pop ebx\par pop eax\par\par pop ebp\par ret 8\par [/32-bit] \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Big Endian 4 byte\par} N1&(Un)Signed value(s)SignedvalueSignedvalueHelpMacro=8 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=29/12/2009 21:06 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=10 Y1=0 X2=0 Y2=19Smaller than {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs18\line\lang2057\hich\f2\dbch\f2\loch\f2 In short, a\lang1033\hich\f1\dbch\f1\loch\f1 value can hold a negative value if it is a signed value.\line This is done by inverting all the bits. \lang2057\hich\f2\dbch\f2\loch\f2 A\lang1033\hich\f1\dbch\f1\loch\f1 ll 0's become 1's and 1's become 0's\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1 \lang2057\hich\f2\dbch\f2\loch\f2 Then the \lang1033\hich\f1\dbch\f1\loch\f1 resulting value \lang2057\hich\f2\dbch\f2\loch\f2 is incremented by\lang1033\hich\f1\dbch\f1\loch\f1 1\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line example:\line\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 12\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 =\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 00001100\line invert\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 =\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 11110011\line\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 -12\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 =\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 11110100\lang2" 057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 (notice that if this was an unsigned value this would be 244\lang2057\hich\f2\dbch\f2\loch\f2 ; because 256-12=244\lang1033\hich\f1\dbch\f1\loch\f1 )\line\cf3\fs24\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b (Un)Signed value(s)\plain\f1\fs24\par} N1$Found address listFoundlistFoundlistHelpMacro=6 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=1 sel=0 sBook=13/09/2008 03:13 sBookPage=02/01/2011 20:18 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=5 Y1=46 X2=0 Y2=13Presults Found list max value types {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset2 Symbol;}{\f3 \fswiss \fcharset0 Arial;}{\f4 \fswiss \fcharset2 Wingdings;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} {\*\listtable {\list\listtemplateid1 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293832489_1;}\listid1293832489 } } {\*\listoverridetable {\listoverride\listid1293832489\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } \ls1} } \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The found list is the list on the left side of the window, under the Select Process button.\line\line\lang2057\hich\f3\dbch\f3\loch\f3 All of the results of your memory scanning are dumped here. You can adjust the max number of addresses shown here in CE's options. If your results number is below or equal to the amount set in the options then they will be displayed here, otherwise you will simply see a numeric value to the right of this list.\lang1033\hich\f1\dbch\f1\loch\f1\line\line If you double click an address, drag it to the list at the bottom, or select some addresses and click the red arrow, the addresses will be added to the memory watch list at the bottom\line\par Right-clicking on an address in the results will offer the following options:\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \pard\s0\ls1\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18 Browse this memory region: Open the memory viewer and jump to the address in the hex view.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} Disassemble this memory region: Open the memory viewer and jump to the address in the disassembler view.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} Remove selected address: Remove the address from the results.\par {\listtext\pard\plain\f2\fs24 \'b7\tab} Select all items: Select all addresses in the list. \lang2057\hich\f3\dbch\f3\loch\f3\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} V{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Found\lang2057\hich\f2\dbch\f2\loch\f2 address\lang1033\hich\f1\dbch\f1\loch\f1 list\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1$Address/Cheat listAddresslistAddresslistHelpMacro=10 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 Dat" eCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=26/05/2013 15:18 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=86 Y1=60 X2=0 Y2=182Address list comments 2{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset2 Symbol;}{\f3 \fswiss \fcharset0 Arial;}{\f4 \fswiss Courier New;}{\f5 \fswiss \fcharset0 Courier New;}{\f6 \fswiss \fcharset2 Wingdings;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} {\*\listtable {\list\listtemplateid1 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293833543_1;}\listid1293833543 } } {\*\listoverridetable {\listoverride\listid1293833543\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } \ls1} } \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The address list is the place where all the addresses will go that you think are usable.\line\line The list can be navigated by using the keyboard and mouse.\lang2057\hich\f3\dbch\f3\loch\f3 \lang1033\hich\f1\dbch\f1\loch\f1 There are 2 ways to change a value in the list, by either double-clicking the value, or by selecting it and pressing enter.\lang2057\hich\f3\dbch\f3\loch\f3 \lang1033\hich\f1\dbch\f1\loch\f1 For all the other items in the list just double click on it and it will open up a new window allowing you to change it.\line\line The check boxes allow you to freeze and unfreeze the address. If you freeze a address the address will not change until you unfreeze it. The value does change but Cheat Engine will restore the value to it's frozen state every few milliseconds\lang2057\hich\f3\dbch\f3\loch\f3 \lang1033\hich\f1\dbch\f1\loch\f1 (The number of milliseconds can be changed in the settings window)\lang2057\hich\f3\dbch\f3\loch\f3 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line There are 3 types of freezing: Normal (=),Allow \lang2057\hich\f3\dbch\f3\loch\f3 Increase Only \lang1033\hich\f1\dbch\f1\loch\f1 (+), and Allow \lang2057\hich\f3\dbch\f3\loch\f3 Decrease Only\lang1033\hich\f1\dbch\f1\loch\f1 (-). You can change the type of freezing by clicking on the symbol right of the check box. The allow positive and negative can be set also by keyboard's numeric + and - keys.\line\line Also, when you right-click on one or more addresses a pop-up window will show with additional options.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \pard\s0\tx360\ls1\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18\b Delete this record\b0 : Remove the selected values, pointers or scripts from the table.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Change record\b0 : Change the description, address, type and value for the selected records.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Browse this memory region\b0 : Open the memory viewer and jump to the address in the hex view.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Show as hexadecimal/show as decimal\b0 : Display the selected records in hexadecimal or in decimal again.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Change color\b0 : Change the color of the selected records.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Set/Change hotkeys\b0 : Set or change a hotkey to freeze or change a value in any way or to toggle a script on/off. Hotkeys are saved with your table.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Toggle selected entries\b0 : Freeze/unfreeze selected addresses and toggle scripts on/off.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Change script\b0 : Edit the selected script.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Pointer scan for this address:\b0 Open the pointer scanner to search for pointers.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Find out what accesses this address\b0 : Use the debugger to show codes that are accessing to the address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Find out what writes to this address\b0 : Use the debugger to show codes that are writing to the address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Recalculate new addresses\b0 : Recalculated the addresses according to the given parameters.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Force recheck symbols\b0 : Recheck symbols in the table.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Cut, Copy, Paste\b0 : Using the clipboard.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Create Header\b0 : Create Headers to organize your records in groups.\par\pard\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18\line\line\line The following keys can be used when the address list has focus:\par \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx4320 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx8640 \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 ENTER\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Change Value\hich\f1\d"bch\f1\loch\f1\cell \intbl\row \trowd\trgaph60\trleft0\trrh227 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx4320 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx8640 \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Ctrl+Enter\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Change Des\lang2057\hich\f5\dbch\f5\loch\f5 c\lang1033\hich\f4\dbch\f4\loch\f4 ription\hich\f1\dbch\f1\loch\f1\cell \intbl\row \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx4320 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx8640 \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Ctrl+Alt+Enter\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Change Address\hich\f1\dbch\f1\loch\f1\cell \intbl\row \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Alt+Enter\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Change Type\hich\f1\dbch\f1\loch\f1\cell \intbl\row \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Shift+Ctrl+Alt+Enter\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Change address Complex\hich\f1\dbch\f1\loch\f1\cell \intbl\row \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Space\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Freeze\hich\f1\dbch\f1\loch\f1\cell \intbl\row \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Grey Keypad Plus\hich\f1\dbch\f1\loch\f1\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Freeze but allow increase\hich\f1\dbch\f1\loch\f1\cell \intbl\row \trowd\trgaph60\trleft0\trrh212 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx4320 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx8640 \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Grey Keypad Minus\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Freeze but allow decrease\cell \intbl\row \trowd\trgaph60\trleft0 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx4320 \clvertalt\clbrdrt\brdrs\brdrw8\brdrcf3\clbrdrb\brdrs\brdrw8\brdrcf3\clbrdrl\brdrs\brdrw8\brdrcf3\clbrdrr\brdrs\brdrw8\brdrcf3\cellx8640 \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Delete\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Delete Address\cell \intbl\row \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Ctrl+Alt+A\cell \pard\intbl\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f4\dbch\f4\loch\f4\cf3\fs18 Open the auto assembler\cell \intbl\row \pard\s0\tx360\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\lang2057\hich\f3\dbch\f3\loch\f3\cf2\fs18 You can make additions to the list either by adding them from the \cf4\ul{\field{\*\fldinst HYPERLINK Foundlist}{\fldrslt found list}}\cf2\ul0 or by clicking the\par 'Add address manually' button. Here you type the exact address, a description for it and it's datatype.\par You can also opt to create a pointer-path here on this same dialog.\par\lang1033\hich\f3\dbch\f3\loch\f3\par\par As of Cheat Engine 6 you can re-arrange items in the list by dragging them and even attach entries to other entries as well\par\par You can use the addresslist to change values of memory records.\par There are a few special values you can enter that have a special effect.\par If you enclose a value by parenthesis ( ) and th value is the name of an addresslist entries description, the new value will be that of that specific addresslist entry.\par Example:\par You have two entries. One named "Health" and the other named "Max Health" with the value 100\par If you change the value of Health to "(Max Health)" Health will get the value 100\par\par Tip: If you first freeze a record and then set the value to "(Max Health)" cheat engine will constantly write the current value of "Max Health" to "Health"\par\par Another special notation that the change value field supports is enclosing the new value by square brackets [ ]\par The value between the backets will be calculated by lua as if it would do a "return "\par For example [10+12] would return 22, but you can also do more advanced scripting like [readInteger(12345678)*2]\plain\f1\fs24\par} O{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang2057\hich\f2\dbch\f2\loch\f2\b A\lang1033\hich\f1\dbch\f1\loch\f1 ddress\lang2057\hich\f2\dbch\f2\loch\f2 /Cheat\lang1033\hich\f1\dbch\f1\loch\f1 list\plain\f1\fs24\par} N1Table ExtrasCommentsCommentsHelpMacro=11 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=31/12/2010 23:21 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=13 Y1=96 X2=0 Y2=12Dcomments comments Memory view {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf2\fs18 The "Table Extras" button on the bottom right of the cheat engine window opens the "Table Extras" window.\lang2057\hich\f2\dbch\f2\loc"h\f2 \lang1033\hich\f1\dbch\f1\loch\f1 The comments tab can be used to store extra information in your cheat tables. You can for example use it to leave notes on how you found a address, or other stuff, like your name.\line\lang2057\hich\f2\dbch\f2\loch\f2\cf3\fs24\par\fs18 This is especially handy if you will be distributing your table to someone else as you can detail here exactly how and when to enable certain hacks. Sometimes it may be necessary to time exactly when you activate a cheat, and no-one will know unless you tell them. This is ideal for that purpose.\par\lang1033\hich\f1\dbch\f1\loch\f1\par\par The Lua tab can be used to execute a lua script which has been saved in the table. Lua scripts that are stored in this window can be executed automatically if the user is allowing it to be executed.\par\par If the Comments or Lua Script window has some content, the Table Extras button is shown with bold letters. \cf2\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\b Table Extras\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1SpeedhackSpeedhackSpeedhackHelpMacro=17 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=1 sel=0 sBook=13/09/2008 03:13 sBookPage=31/12/2010 23:22 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=5 Y1=54 X2=0 Y2=9Jsleeptime speed Speedhack ALLOC E{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf0\fs18 The speedhack of cheat engine replaces some commonly used functions in games to keep the speed constant with it's own routine that goes faster or slower.\par\par Speedhack has just one parameter: Speed. It let's you pick the speed with a slider, OR you can type in the speed you want yourself and then you must click apply.\ul\par\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\b Speedhack\cf2\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Unrandomizer$unrandomizeroption$unrandomizeroption$HelpMacro=1042 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=7 Y1=77 X2=0 Y2=6 sChange=Under Construction sBook=29/12/2009 17:09 sBookPage=19/09/2016 18:47 sIcon=10 exp=0 sel=0J{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs18\par The unrandomizer is a feature designed to replace certain routines commonly used in games to produce random values. At a very simple level then, for an example, there may be a game that uses a randomizer routine to decide on a player's turn. Enabling the unrandomizer would then cause CE to try and stop this random occurrence, and try to fix the outcome (for example to force a particular players turn).\par\par The unrandomizer won't work in all cases. It will only handle routines that it knows about. In most cases and for most users, this will not be used, as it's more of an advanced/experimental feature.\par\hich\f1\dbch\f1\loch\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b Unrandomizer\fs20\b0\par} N1 Advanced optionsAdv"ancedoptionsAdvancedoptionsDateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=6 Y1=15 X2=0 Y2=16 sBookPage2=1 sBookPage=31/12/2010 02:22 sIcon=13 exp=1 sel=0 sBook=03/01/2010 10:54{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset2 Symbol;}{\f3 \fswiss \fcharset0 Arial;}{\f4 \fswiss \fcharset2 Wingdings;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} {\*\listtable {\list\listtemplateid1 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1262204224_1;}\listid1262204224 } } {\*\listoverridetable {\listoverride\listid1262204224\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } \ls1} } \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f3\dbch\f3\loch\f3\fs18\par You can find the advanced options box at the bottom-left of Cheat Engine's main screen. The box is small but named 'Advanced options' so it's easy to locate. This area of CE contains several features, some of which are used regularly by a lot of users, some not so often. They are:\par\lang1033\hich\f3\dbch\f3\loch\f3\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \pard\s0\ls1\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang2057\hich\f3\dbch\f3\loch\f3\fs18 Pause the process\par {\listtext\pard\plain\f2\fs18 \'b7\tab} The 'Code list'\par\pard\s0\ql\plain\f1\fs24\lang2057\hich\f3\dbch\f3\loch\f3\fs18\par They are each explored in this help document in this section. So read on..\par\hich\f1\dbch\f1\loch\f1\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b Advanced options\plain\f2\fs24\par} N1 Pause pause pause"HelpMacro=1069 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=9 Y1=0 X2=0 Y2=5 sChange=Under Construction sBook=30/12/2009 20:11 sBookPage=30/12/2009 20:14 sIcon=10 exp=0 sel=0C{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\plain\f2\fs18\par You can pause the process you are cheating on, by clicking on the 'Advanced options' box from the main window and then clicking on the pause icon. This requires the debugger to be attached to the process (you will be prompted for this if you aren't already attached).\par\par You can assign a hotkey to this feature in the settings (see the settings section in this help document for how to do this). This process can help dramatically when memory scanning, as the target game won't be eating into your CPU-cycles while paused. This process happens automatically if you have checked the box to 'Pause game during scan' from the main interface.\par\plain\f1\fs18\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {+   !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~"\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Pause\plain\f2\fs24\par} N1Code listcode-listcode-list&HelpMacro=1070 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=21 Y1=21 X2=0 Y2=9 sChange=Under Construction sBook=30/12/2009 20:19 sBookPage=31/12/2010 23:24 sIcon=10 exp=0 sel=0={\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}{\f3 \fswiss \fcharset2 Symbol;}{\f4 \fswiss \fcharset2 Wingdings;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} {\*\listtable {\list\listtemplateid1 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293834248_1;}\listid1293834248 } } {\*\listoverridetable {\listoverride\listid1293834248\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } \ls1} } \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f2\fs24\par\cf0\fs18 The code list contains snippets of gamecode which you may have elected to replace with NOP's from the memory view window's disassembler\lang1033\hich\f2\dbch\f2\loch\f2 or just added the code because they can be used later on (\lang2057\hich\f2\dbch\f2\loch\f2 basically, an alternative to notepad).\par\par You can safely close and re-open the advanced options pane without worrying about any changes to the code; it will all remain exactly as you've left it, so you can get rid of it to remove clutter if you need too.\par\lang1033\hich\f2\dbch\f2\loch\f2\par\par Right-clicking on a code will bring up the following options:\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \pard\s0\ls1\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\fs18\b Open the disassembler at this location\b0 : It will open the memory view's disassembler at the code's location.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Replace with code that does nothing\b0 : It will replace the selected codes with NOPs, so the code(s) will do nothing.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Restore with original code\b0 : Restore the original code after you have replaced it.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Find out what addresses this code accesses\b0 : Use the debugger to find out what addresses are accessed by the code.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Find out what addresses this code writes to\b0 : Use the debugger to find out what addresses are written by the code.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Rename\b0 : Rename the code in the list.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Remove from list\b0 : Remove the selected codes from the list.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \b Replace all\b0 : Replace all codes with NOPs. \lang2057\hich\f2\dbch\f2\loch\f2\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Code list\plain\f2\fs24\par} N1Memory ViewerMemoryViewerMemoryViewerDateCreated=16/01/2009 DateModified=16/01/2009 DateReview=16/01/2009 CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=7 Y1=83 X2=0 Y2=13" sIcon=13 exp=1 sel=0 sBook=28/12/2009 17:01 sBookPage=30/12/2009 19:42 HW=Main sBookPage2=16{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\par Cheat Engines memory viewer is a more advanced and feature-rich component of the software. While many users will only ever use the main GUI that is first presented to them, some will move into the memory viewer.\par\par When first visiting the memory viewer screen, you will see various menus, a disassembly view area and a hex-editor pane at the bottom. This chapter in the help document will cover the areas of the program here. It contains many features which are very effective in the hands of experience gamehackers, such as script-engines, an auto-assembler engine, debugging tools and memory-enumeration features.\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Memory Viewer\plain\f2\fs24\par} N1Memory viewMemoryviewMemoryviewHelpMacro=12 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=19/09/2016 18:47 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=28 Y1=2 X2=0 Y2=13Memory view inject codecave thread debugger assembler dll About the debugger _0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset2 Symbol;}{\f3 \fswiss \fcharset0 Arial;}{\f4 \fswiss \fcharset2 Wingdings;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} {\*\listtable {\list\listtemplateid1 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293834413_1;}\listid1293834413 } {\list\listtemplateid2 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293834495_1;}\listid1293834495 } } {\*\listoverridetable {\listoverride\listid1293834413\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } \ls1} {\listoverride\listid1293834495\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnum"bers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2} } \ls2} } \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f3\dbch\f3\loch\f3\cf2\fs18\b Overview\fs24\b0\par\lang1033\hich\f1\dbch\f1\loch\f1\line\cf0\fs18 The memory view can be reached by clicking on the memory view in the main cheat engine window.\line\line The memory view contains several tools and functions for advanced game hackers like the autoassembler\lang2057\hich\f3\dbch\f3\loch\f3 engine\lang1033\hich\f1\dbch\f1\loch\f1 , a codecave scanner, a thread generator, a memory allocator, a code dissector, a DLL injector, debugger options, a disassembler, an assembler, a hex viewer and more.\lang2057\hich\f3\dbch\f3\loch\f3\par\par\par\b Manipulation\lang1033\hich\f1\dbch\f1\loch\f1\b0\line\line To change assembler code just stand on the address you want to edit and type in your now code.\line To edit the value of some bytes directly in memory just click on a byte and start typing in the new values.\line\lang2057\hich\f3\dbch\f3\loch\f3\par\par\b Hotkeys\b0\par\lang1033\hich\f1\dbch\f1\loch\f1\line There are also some hotkeys, like CTRL+G to jump which will pop-up a box where you can fill in the new address you want to go to and ctrl+f in the hex view to do a simple scan\line If you have a jmp or call selected you can press SPACE to follow that address. BACKSPACE will go back.\par\par Also, pressing CTRL+SPACE when either the disassembler is focused, or the hexview is focused, will set the other object's location to the same as the selected one.\line\lang2057\hich\f3\dbch\f3\loch\f3\par\par\b Layout\b0\par\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par\lang2057\hich\f3\dbch\f3\loch\f3\fs18 You can access the various menus along the top of the window, you can see a registers and flags pane to the right of the screen\lang1033\hich\f3\dbch\f3\loch\f3 when a breakpoint has been hit\lang2057\hich\f3\dbch\f3\loch\f3 (which can be modified while debugging; also note the arrow-button allowing access to FPU information), and you can make use of the hex-view pane at the bottom of the window.\par\par You can perform binary copies/pastes, force regions to be writeable, make general edits and search memory in this view by right-clicking and choosing the corresponding option from the menu that appears. You can also change the display type to different settings to make it that much more legible. Along the top edge of this pane you will see module information, such as AllocBase, Size and protection\lang1033\hich\f3\dbch\f3\loch\f3\par\par Disassemblerview:\par Right-clicking on a code in the disassembler view will bring up the following options:\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \pard\s0\ls1\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f3\dbch\f3\loch\f3\cf2\fs18\b Go to address\b0 : Go to the given address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Replace with code that does nothing:\b0 It will replace the selected codes with NOPs, so the code(s) will do nothing. The replaced codes will be added to the code list automatically, so you can track your changes easily.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Add to the code list\b0 : Add the code to the code list.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Copy to clipboard\b0 : Copy the selected area to the clipboard.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Change register at this location\b0 : You can change the value of the registers whenever this code is executed. This feature is using the debugger.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Toggle breakpoint\b0 : Set/delete a breakpoint on the code.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Break and trace instructions\b0 : Set a breakpoint and trace the instructions when this code is executed. You can set a trace count and also set a condition to stop the tracing.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Find out what addresses this instruction accesses\b0 : Use the debugger to find out what addresses are accessed by the code.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Set/Change break condition\b0 : You can set/change the break condition on existing breakpoints.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Select current function\b0 : This option will select the current function and jump to the start of the function in the disassembler view. \lang2057\hich\f3\dbch\f3\loch\f3\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par\hich\f3\dbch\f3\loch\f3\cf2\fs18\par\par Hexview\par Right-clicking on a value in the hex view will bring up the following options:\par\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \pard\s0\ls2\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f3\dbch\f3\loch\f3\cf2\fs18\b Edit\b0 : Edit the value on the address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Go to address\b0 : Go to the specified address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Search memory\b0 : Search in the memory for text or an array of bytes.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Copy to clipboard, Paste from clipboard\b0 : Copy and paste using the clipboard.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Display type\b0 : Select a display type for the values.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Separators\b0 : Set the number and range of separators.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Lock current rowsize\b0 : Locking the rowsize will fix the size even if the window is resized.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Link with other hexview\b0 : Link the window with another hexview so You can navigate in the windows together, instead of controlling them separately.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Unlink from other hexview\b0 : Remove the link with the other hexview.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Show difference\b0 : Show the difference between the choosen memory viewer.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Add this address to the list\b0 : Add the address to the cheat list.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Make page writable\b0 : Give permission to write in a readable area.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Data breakpoint\b0 : Set a data breakpoint on the address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Data breakpoint->Break on Write\b0 : Break when the address is written by a code.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Data breakpoint->Break on Access\b0 : Break when the address is accessed by a code.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Data breakpoint->Break and trace\b0 : Set a write or access breakpoint and trace the instructions when this address is written or accessed. You can set a trace count and also set a condition to stop the tracing.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Find out what accesses this address\b0 : Use the debugger to show codes that are accessing to the address.\par {\listtext\pard\plain\f2\fs18 \'b7\tab} \b Find out what writes to this address\b0 : Use the debugger to show codes that are writing to the address. \par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} ]{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}"} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\b Memory view\lang2057\hich\f2\dbch\f2\loch\f2 (Disassembly View)\lang1033\hich\f1\dbch\f1\loch\f1\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1$Menus and Featuresfile-menufile-menu(HelpMacro=1036 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=28/12/2009 DateModified=28/12/2009 DateReview=28/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=111 Y1=0 X2=0 Y2=11 sChange=Under Construction sBook=28/12/2009 18:45 sBookPage=31/12/2010 23:34 sIcon=10 exp=0 sel=0"{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs20\par\fs18\ul\i The \b File\b0 menu gives you access to some simple save/load-type options:\ul0\par\i0\par\b New Window\b0 will allow you to create multiple disassembly view instances; good for viewing many spots of code at once. You can access the same menus from these new windows with the exception of the Debug menu which is exclusive to the original window.\par\par\b Save disassembled output \b0 allows you to save a range of memory in this format, which is good for using as code-snippets to post online or illustrate certain concepts to others. It outputs as a plain text .txt file.\par\par\b Save/Load memory region \b0 gives you the ability to dump a memory region to file and then load it back in later. It saves as a Cheat Engine memory file (with an optional CE header). Not an option for standard users.\par\par\par\ul\i The \b Search\b0 menu will reveal two options for traversing through a program:\ul0\par\par\b\i0 Find memory \b0 will allow you to run a scan for either text (ASCII or Unicode) or an array of bytes, between a memory region of your choosing.\par\par\b Find assembly code \b0 is similar to the above, but will allow you to specifically chose a game instruction to locate. For example I could search for:\par MOV [ESI+000007E8],EAX\par All of the results (if any) will be displayed in the box. You can then double-click these entries to go to that spot in memory. This is a great feature for quickly updating cheats to a new version of a game. You have to be fairly specific or you could end up with several hundred results to trawl through depending on the target.\par\par\par\ul\i The \b View \b0 menu will give you a bunch of options relating to how you 'see into' the game:\ul0\par\i0\par You can view a list of \b breakpoints\b0 , process \b threads\b0 and \b debug strings\b0 here. You can also view the \b heaplist\b0 and a \b memory region \b0 window, which allows you to quickly see details about areas in memory (such as location, protection, size and type).\par\par You can click on \b Enumerate DLLs and Symbols\b0 to show a list of loaded modules and their respective symbol names.\par\par You can toggle the display of user-mode, kernel-mode and user-defined \b symbols\b0 here, which can be very useful for creating game hacks from, because you can easily locate and manipulate certain structures. See the website tables section for some examples of this. A good example of a symbol-fanatic in game-training is the user: Recifense :-)\par\par\b Show module addresses \b0 will toggle how the address column is displayed in the memory viewer. Instead of showing an exact virtual address, it will display the location in base+offset notation. This is especially useful in games that code-shift; that is when game's allocate their modules (.dll's etc) to different spots in memory on a new restart or level load. This will allow you to find the right spot every time despite this 'shifting' process. You can use the base+offset notation in a cheat engine script. It will parse it fine, so long as the game (and module) is loaded and you have picked the process in CE.\par\par An example could be as follows (the number is hex):\par 20468042\tab =>\tab client.dll+468042\par\par From this we can deduce that client.dll is actually loaded at 0x20000000 by performing a simple subtraction. You can also see this information in the hex view windows however, which is tagged along to the bottom of the memory view pane. Along with 'AllocationBase' you will also find 'Image Protection', 'Image Size' and (optionally) 'Physical Address'.\par\par The next time the game is ran, client.dll may be mapped to 0x32000000 and so by taking this address and adding our previous offset of 0x468042 we can arrive at the right code spot.\par\par\par\ul\i The \b Debug\b0 menu gives us access to our debugging controls:\par\par\ul0\i0 If you haven't yet attached the debugger to the target, then you will be prompted to do so when you try to use any of these options. You can \b toggle a breakpoint (F5) \b0 at a certain point in code and \b break\b0 on a chosen program thread (you will be prompted for which thread; main thread or otherwise if there are more).\par\par With the former option, a few more options open up once you have 'broke' on an opcode. You can simply choose to \b run (F9)\b0 and continue execution, or you can \b step in (F7)\b0 or \b step over (F8)\b0 certain instructions. For quick code tracing you would generally use step over (F8), but stepping in can be great for investigation certain CALL's should the need arise. Finally you have the option to \b run till (F4)\b0 user return, which is handy for breaking on certain message boxes, prompts and other events which are tricky to reach using other methods.\par\par\par\ul\i The \b Tools\b0 menu gives us access to the main powerful features of CE:\par\par\b\ul0\i0 Allocate Memory\b0 allows the user to add a custom amount of extra memory to the current process (in KB).\par\par\b Scan for codecaves \b0 helps to find (likely) unused areas of memory to use as a code cave for cheats. You can specific the range of memory to search within and whether or not to include read-only memory (not advised).\par\par\b Fill Memory\b0 can be used to fill a specific region of memory with a certain byte value or sequence (hex).\par\par\b Create Thread\b0 will allow you to create a remote program thread which runs independently of the main program thread/execution but still has access to the target processes memory space. (Advanced)\par\par The \b Dissect\b0 options allow you to map out various structures in memory and make them easier to interpret. For example the class of TPlayer coul"d contain a pointer to TWeapon which could then be expanded further like a tree. You can also dissect windows and change caption text (which can be useful for simple anti-cheat evasion) and you can view basic PE Info of a file.\par\par\b Pointer Scan\b0 will reveal CE's pscan engine interface, which allows you to automatically find a 'path' through memory to a specific variable. You can then use this resultant path or 'pointer' in the future, as it's end location will always be the same; your variable! It's used extensively as a method of bypassing DMA (dynamic memory allocation) in more difficult games, or cheat-protected games, or by beginner users who aren't accustomed to code-injection methods.\par\par\b Find static addresses \b0 will get CE to trawl through memory (of your choice) in an attempt to locate all static addresses residing in that memory space. This can be useful for locating static base pointers for your otherwise broken pointer paths. It is also useful when hacking emulated game targets when there is no obvious base address.\par\par\b Inject DLL\b0 is a generic DLL injection feature (surprise, surprise) which will prompt you for the DLL to inject and then do so into the current process.\par\par\b Auto Assemble\b0 is one of the most powerful and frequently used features of CE. It will allow you to create your own code injection scripts and then make the modifications to memory at the click of a button. Scripts created here will be added to the main cheat list, which can then be named. Scripts can also be saved from this box.\par\par\lang1033\hich\f2\dbch\f2\loch\f2\b LUA \lang2057\hich\f2\dbch\f2\loch\f2 Console\b0 will reveal an interface into the \lang1033\hich\f2\dbch\f2\loch\f2 lua\lang2057\hich\f2\dbch\f2\loch\f2 -script engine, allowing to create \lang1033\hich\f2\dbch\f2\loch\f2 lua\lang2057\hich\f2\dbch\f2\loch\f2 -scripts and run them.\par\par\par\i The \b Kernel tools\b0 menu is only available if you have chosen to use kernelmode debugging routines\i0 instead of the original windows versions (see the settings). It contains a selection of advanced and specialized features which are beyond the scope of this help file, and will never be utilized by most users.\par\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Menus and Features\cf0\fs20\b0\par} N1&Auto Assembler help&auto-assembler-help&auto-assembler-helpHelpMacro=1089 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=65 Y1=0 X2=0 Y2=0 sChange=Complete sBook=20/01/2010 16:06 sBookPage=24/12/2015 19:08 sIcon=10 exp=0 sel=0{{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf2\fs18 Auto assemble allows you to write assembler code at different locations using a script. It can be found in the \lang2057\hich\f2\dbch\f2\loch\f2 '\lang1033\hich\f1\dbch\f1\loch\f1 memory\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 view\lang2057\hich\f2\dbch\f2\loch\f2 '\lang1033\hich\f1\dbch\f1\loch\f1 part of cheat engine under extra.\line\line There are 3 special commands you can give it, ALLOC , LABEL and FULLACCESS. With LABEL you can give a address a name by declaring it before you use it. ALLOC is basicaly the same as LABEL but allocates some memory for you.\line Usage: \line LABEL(labelname) //Enables the word labelname to be used as a address\line ALLOC(allocname,sizeinbytes, preferedregion OPTIONAL) //same as label, but allocates the memory it points to itself\line DEALLOC(allocname) //Deallocates a block of memory allocated with alloc. It always gets executed last, no matter where it is positioned in the code, and only actually frees the memory when all allocations have been freed. only usable in a script designed as cheattable. (e.g used for the disable cheat)\line FULLACCESS(address,size) //makes a memory region at the specified address and at least "size" bytes readable, writable and executable\line\line REGISTERSYMBOL(symboname) //adds the symbol to the userdefined symbol list so cheattables and the memory browser can use that name instead of a address (The symbol has to be declared in the script when using it)\line UNREGISTERSYMBOL(symbolname) //removes the symbol from the userdefined symbol list. It won't give a error if it isn't found\line\par DEFINE(name,whatever) :Will replace all tokens with the specified name with the text of whatever\line INCLUDE(filename) :includes another auto assembler file at that spot\line LOADBINARY(address,filename) :Will load a binary file at the specified address\line CREATETHREAD(address) :Will spawn a thread in the process at the specified address\line LOADLIBRARY(filename) :Will inject the specified dll into the target process\line READMEM(address,size) :Will write the addresses at address at the location this instruction is placed\line\par GLOBALALLOC(name,size) : Will allocate a certain amount of memory and registers the specified name. Using GlobalAlloc in other scripts will then not allocate the memory again, but reuse the already existing memory. (Or allocate it anyhow if found it was not allocated yet)\par\par ASSERT(address, array of byte) : Will check the memory address for the given address. If the memory is not what is defined by the array of byte given, the auto assemble script will not execute.\par AOBSCAN(name, array of byte) : Will scan the memory for the given array of byte (Wildcards are supported) and replaces all tokens with the specified name with the address the array of byte was found. If it's not found, the auto assemble script will not execute\par AOBSCANMODULE(name, modulename, array of byte): Will scan the specific module for the given AOB\par AOBSCANREGION(name, startaddress, stopaddress, array of byte): Will scan the specific range for the given AOB\par\par\par STRUCT / ENDSTRUCT: With STRUCT you can define an internal structure in your auto assembler scri"pt. This can be used to keep your code clear.\par Example:\par STRUCT stackview\par returnaddress: DD ?\par param1: \par DD ?\par param2: DB ? ? ? ?\par ENDSTRUCT\par\par mov eax,[EBP+stackview.param1]\par mov ebx,[EBP+param2]\par\par \{$LUA\}/\{$ASM\} : Code between \{$LUA\} and \{$ASM\} (separate lines) will execute that lua script. If it returns a string, the result will be handled as an auto assembler commands.\par Note: The lua code is executed before anything else of the auto assembler is parsed.\par\par\par\b Value notation:\b0\par Normally everything is written as hexadecimal in auto assembler, but there are ways to override this so you can input decimal values, and even floating point values.\par for example, a integer value of 100 can be written in hex as 64, but you can also write it as #100, or as (int)100\par for floating point value like 100.1 you can use (float)100.1\par\par and for a double, you could use (double)100.1 \par\par\line\b Basic Example\b0 :\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line\line 00410000:\line mov [00580120],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp 00451031\line\line\b Example using LABEL\b0 :\line label(mylabel)\line\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line mylabel:\line\line 00410000:\line mov [00580120],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp mylabel\line\line\b Example using ALLOC\b0 :\line alloc(memloc1,4)\line\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line\line 00410000:\line mov [alloc1],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp 00451031\line\line\b Example using ALLOC and LABEL\b0\line alloc(alloc1,4)\line label(mylabel)\line\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line mylabel:\line\line 00410000:\line mov [alloc1],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp mylabel\line\line\line\b Example using FULLACCESS\b0\line FULLACCESS(00400800,4) //00400800 is usually read only non executable data, this makes it writeable and executable\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line\line 00410000:\line mov [00400800],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp 00451031\line\line\b Example using DEFINE\b0\line DEFINE(clear_eax,xor eax,eax)\line 00400500:\line clear_eax\line\line\b ReadMem example\b0\line alloc(x,16)\line alloc(script,2048)\line\line script:\line mov eax,[x]\line mov edx,[x+c]\line ret\line\line x:\line readmem(00410000,16) //place the contents of address 00410000 at the address of X\line\cf3\fs24\par\lang2057\hich\f2\dbch\f2\loch\f2\fs20\par\par The absolute best way to learn these is by practical use. So for a start, follow the tutorial program all the way through and then apply it to some games. The more you use it, the quicker and more capable you will become with it. It looks daunting at first sight (like a coding language), but if you're serious about gamehacking, this will soon become your new best friend!\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs24\b Auto Assembler help\plain\f1\fs20\par} N1Script engineScriptengineScriptengineHelpMacro=19 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=24/12/2015 19:10 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=33 Y1=15 X2=0 Y2=13:Script engine Other stuff {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 List of CE specific functions and variables:\par\par TrainerOrigin : A variable that contains the path of the trainer that launched cheat engine (Only set when launched as a trainer)\par process : A variable that contains the main modulename of the currently opened process\par\par getCEVersion(): Returns a floating point value specifying the version of cheat engine\par\par\par activateProtection(): Prevents basic memory scanners from opening the cheat engine process\par fullAccess(address,size): Changes the protection of a block of memory to writable and executable\par\par loadTable(filename, merge OPTIONAL): Loads a .ct or .cetrainer. If merge is provided and set to true it will not clear the old table\par saveTable(filename, protect OPTIONAL): Saves the current table. If protect is provided and set to true and the filename has the .CETRAINER extension, it will \par protect it from reading normally\par\par note: addresses can be strings, they will get interpreted by ce's symbolhandler\par\par readBytes(address,bytecount, ReturnAsTable ) : returns the bytes at the given address. If ReturnAsTable is true it will return a table instead of multiple bytes\par Reads the bytes at the given address and returns a table containing the read out bytes\par\par writeBytes(address, x,x,x,x,...) : Write the given bytes to the given address from a table\par writeBytes(address, table) : Write the given bytes to the given address from a table\par\par\par readInteger(address) : Reads an integer from the specified address\par readQword(address): Reads a 64-bit integer from the specified address\par readPointer(address): In a 64-bit target this equals readQword, in a 32-bit target readInteger()\par readFloat(address) : Reads a single precision floating point value from the specified address\par readDouble(address) : Reads a double precision floating point value from the specified address\par readString(address, maxlength, widechar OPTIONAL) : Reads a string till it encounters a 0-terminator. Maxlength is just so you won't freeze for too long, set to \par 6000 if you don't care too much. Set WideChar to true if it is encoded using a widechar formatting\par writeInteger(address,value) : Writes an integer to the specified address. Returns true on success\par writeQword(address, value): Write a 64-bit integer to the specified address\par writeFloat(address,value) : Writes a single precision floating point to the specified address. Returns true on success\par writeDouble(address,value) : Writes a double precision floating point to the specifi" ed address. Returns true on success\par writeString(address,text, widechar OPTIONAL) : Write a string to the specified address. Returns true on success\par\par readBytesLocal(address,bytecount, ReturnAsTable) : See readBytes but then it's for Cheat engine's memory\par readIntegerLocal(address) : Reads an integer from the specified address in CE's memory\par readQwordLocal(address) : Reads a 64-bit integer from the specified address in CE's memory\par readPointerLocal(address) : ReadQwordLocal/ReadIntegerLocal depending on the cheat engine build\par readFloatLocal(address) : Reads a single precision floating point value from the specified address in CE's memory\par readDoubleLocal(address) : Reads a double precision floating point value from the specified address in CE's memory\par readStringLocal(address, maxlength, widechar OPTIONAL)\par writeIntegerLocal(address,value) : Writes an integer to the specified address in CE's memory. Returns true on success\par writeQwordLocal(address,value) : Writes a 64-bit integer to the specified address in CE's memory. Returns true on success\par writeFloatLocal(address,value) : Writes a single precision floating point to the specified address in CE's memory. Returns true on success\par writeDoubleLocal(address,value) : Writes a double precision floating point to the specified address in CE's memory. Returns true on success\par writeStringLocal(address,string, widechar OPTIONAL)\par writeBytesLocal(address, x,x,x,x,...) : See writeBytes but then it's for Cheat Engine's memory\par writeBytesLocal(address, table, , count) : See writeBytes but then it's for Cheat Engine's memory\par\par\par wordToByteTable(number): \{\} - Converts a word to a bytetable\par dwordToByteTable(number): \{\} - Converts a dword to a bytetable\par qwordToByteTable(number): \{\} - Converts a qword to a bytetable\par floatToByteTable(number): \{\} - Converts a float to a bytetable\par doubleToByteTable(number): \{\} - Converts a double to a bytetable\par stringToByteTable(string): \{\} - Converts a string to a bytetable\par wideStringToByteTable(string): \{\} - Converts a string to a widestring and converts that to a bytetable\par\par byteTableToWord(table): number - Converts a bytetable to a word\par byteTableToDword(table): number - Converts a bytetable to a dword\par byteTableToQword(table): number - Converts a bytetable to a qword\par byteTableToFloat(table): number - Converts a bytetable to a float\par byteTableToDouble(table): number - Converts a bytetable to a double\par byteTableToString(table): string - Converts a bytetable to a string\par byteTableToWideString(table): string - Converts a bytetable to a widestring and convets that to a string\par\par bOr(int1, int2) : Binary Or\par bXor(int1, int2) : Binary Xor\par bAnd(int1, int2) : Binary And\par bShl(int, int2) : Binary shift left\par bShr(int, int2) : Binary shift right\par bNot(int) : Binary not\par\par\par writeRegionToFile(filename, sourceaddress,size) : Writes the given region to a file. Returns the number of bytes written\par readRegionFromFile(filename, destinationaddress)\par\par resetLuaState(): This will create a new lua state that will be used. (Does not destroy the old one, so memory leak)\par\par createRef(...): integer - Returns an integer reference that you can use with getRef. Useful for objects that can only store integers and need to reference lua \par objects. (Component.Tag...)\par getRef(integer): ... - Returns whatever the reference points out\par destroyRef(integer) - Removes the reference\par\par reloadSettingsFromRegistry(): This will cause cheat engine to reload the settings from the registry and apply them\par\par getTranslationFolder(): Returns the path of the current translation files. Empty if there is no translation going on\par loadPOFile(path): Loads a .PO file used for translation\par translate(string): Returns a translation of the string. Returns the same string if it can't be found\par translateID(translationid: string, originalstring: string OPTIONAL): Returns a translation of the string id\par\par ansiToUtf8(string): Converts a string in Ansi encoding to UTF8\par utf8ToAnsi(string): Converts a string in UTF8 encoding to Ansi\par Note: GUI components mainly show in UTF8, some other functions use Ansi, try to find out which ones...\par\par enumModules(processid OPTIONAL):\par Returns a table containing information about each module in the current process, or the specified processid\par Each entry is a table with fields\par Name : String containing the modulename Address: Integer representing the address the module is loaded\par Is64Bit: Boolean set to true if it's a 64-bit module\par PathToFile: String to the location this module is loaded\par\par\par getAddress(string, local OPTIONAL): returns the address of a symbol. Can be a modulename or an export. set Local to true if you wish to querry the symboltable of \par the ce process\par getSymbolInfo(symbolname): Returns a table as defined by the SymbolList class object (modulename, searchkey, address, size)\par getModuleSize(modulename): Returns the size of a given module (Use getAddress to get the base address)\par reinitializeSymbolhandler(waittilldone: BOOLEAN OPTIONAL, default=TRUE): reinitializes the symbolhandler. E.g when new modules have been loaded\par reinitializeDotNetSymbolhandler(modulename OPTIONAL): Reinitializes only the DotNet part of the symbol list. (E.g After an ILCode has been JITed) (6.4+)\par\par errorOnLookupFailure(state): If set to true (default) address lookups in stringform will raise an error if it can not be looked up. This includes symbolnames that \par are not defined and pointers that are bad. If set to false it will return 0 in those cases\par (Useful for pointers that don't work 100% of the time)\par 6.4+:Returns the original state\par\par generateAPIHookScript(address, addresstojumpto, addresstogetnewcalladdress OPT) : Generates an auto assembler script which will hook the given address when executed\par autoAssemble(text, targetself OPTIONAL) : runs the auto assembler with the given text. Returns true on success (if targetself is set it will assemble into Cheat \par Engine itself)\par\par registerAutoAssemblerCommand(command, function(parameters, syntaxcheckonly)): Registers an auto assembler command to call the specified function. The command will \par be replaced by the string this function returns when executed. The function can be called twice. Once for syntax check and symbol lookup(1), and the second time for \par actual execution by the assembler(2) if it has not been removed in phase1.\par Note: The callback function can return multiple values\par Nil, : Will raise an error with the given string\par MultilineString: Replaces the line in the script with the given strings.\par\par\par If the function returns nil, and as secondary parameter a string, this will make the auto assembler fail with that error\par\par unregisterAutoAssemblerCommand(command)\par\par\par registerSymbolLookupCallback(function(string):integer, location): ID 6.4+\par Registers a function to be called when a a symbol is parsed\par Location determines at what part of the symbol lookup the function is called\par slStart: The very start of a symbol lookup. Before tokenization\par slNotInt: Called when it has been determined it's not a hexadecimal only string. Before tokenization\par --The following locations can be called multiple times for one string as they are called for each token and appended token\par slNotModule: Called when it has been determined the current token is not a modulename\par slNotUserdefinedSymbol: Called when it has been determined it's not a userdefined symbol\par slNotSymbol: Called when it has been determined it's not a symbol in the symbollist\par slFailure: Called when it has no clue what the given string is\par\par Note: slNotSymbol and slFailure are similar, but failure comes only if ther" !e's no token after the current token that can be concatenated. Else slNotSymbol will \par loop several times till all tokens make up the full string\par\par\par Return an Integer with the corresponding address if you found it. Nil or 0 if you didn't.\par\par unregisterSymbolLookupCallback(ID): Removes the callback\par\par\par registerAddressLookupCallback(function(integer):string): ID\par Registers a function to be called when the name of an address is requested\par\par unregisterAddressLookupCallback(ID): Removes the callback\par\par\par registerStructureDissectOverride(function(structure, baseaddress): table):\par same as onAutoGuess, but is called by the structure dissect window when the user chooses to let cheat engine guess the structure for him.\par Use the structure object to fill it in\par Return true if you have filled it in, or false or nil if you did not\par\par Tip: Use inputQuery to ask the user the size if your function doesn't do that automatically\par\par\par unregisterStructureDissectOverride(ID)\par\par registerStructureNameLookup(function(address): name, address OPTIONAL):\par Registers a function to be called when dissect data asks the user for the name of a new structure define. If you have code that can look up the name of a \par structure, and perhaps also the real starting point, you can use this to improve the data dissection.\par\par unregisterStructureNameLookup(ID)\par\par registerAssembler(function(address, instruction):bytetable)\par Registers a function to be called when the single line assembler is invoked to convert an instruction to a list of bytes\par Return a bytetable with the specific bytes, or nil if you wish to let another function, or the original x86 assembler to assemble it\par\par unregisterAssembler(ID): Unregisters the registered assembler\par\par registerAutoAssemblerPrologue(function(script, syntaxcheck))\par Registers a function to be called when the auto assembler is about to parse an auto assembler script. The script you get is after the [ENABLE] and [DISABLE] tags \par have been used to strip the script to the according one, but before comment stripping and trimming has occured\par\par script is a Strings object which when changed has direct effect to the script\par\par unregisterAutoAssemblerPrologue(ID)\par\par\par showMessage(text) : shows a messagebox with the given text\par inputQuery(caption, prompt, initialstring): Shows a dialog where the user can input a string. This function returns the given string, or nil on cancel CE6.4+\par messageDialog(text, type, buttons...) : pops up a messagebox with a specific icon/sound with the specified buttons (mbok, mbyes, ....)\par sleep(milliseconds): pauses for the number of specified milliseconds (1000= 1 sec...)\par\par getProcesslist(Strings): Fills a Strings inherited object with the processlist of the system. Format: %x-pidname\par getProcesslist(): Returns a table with the processlist (pid - name )\par getWindowlist(Strings): Fills a Strings inherited object with the top-window list of the system. Format: %x-windowcaption\par getWindowlist(): Returns a table with the windowlist (pid - window caption )\par\par getThreadlist(List): fills a List object with the threadlist of the currently opened process. Format: %x\par\par function onOpenProcess(processid):\par If this function is defined it will be called whenever cheat engine opens a process.\par Note: The the same process might be opened multiple times in a row internally\par Note 2: This function is called before attachment is fully done. You can call reinitializeSymbolhandler() to force the open to complete, but it will slow down \par process opens. Alternatively, you could launch a timer which will run when the opening has finished\par\par\par getOpenedProcessID() : Returns the currently opened process. If none is open, returns 0\par getProcessIDFromProcessName(name) : returns a processid\par openProcess(processid) : causes cheat engine to open the given processid\par openProcess(processname): causes cheat engine to find and open the given process\par setPointerSize(size): Sets the size cheat engine will deal with pointers in bytes. (Some 64-bit processes can only use 32-bit addresses)\par pause() : pauses the current opened process\par unpause(): resumes the current opened process\par\par\par getPixel(x,y) : returns the rgb value of the pixel at the specific screen coordinate\par getMousePos: returns the x,y coordinates of the mouse\par setMousePos(x,y): sets the mouse position\par\par isKeyPressed(key) : returns true if the specified key is currently pressed\par keyDown(key) : causes the key to go into down state\par keyUp(key) :causes the key to go up\par doKeyPress(key) : simulates a key press\par\par shortCutToText(shortcut): Returns the textual representation of the given shortut value (integer) (6.4+)\par textToShortCut(shortcutstring): Returns an shortcut integer that the given string represents. (6.4+)\par\par convertKeyComboToString(key1,...): Returns a string representation of the given keys like the hotkey handler does\par convertKeyComboToString(\{key1,...\}): ^\par\par\par outputDebugString(text): Outputs a message using the windows OutputDebugString message. You can use tools like dbgview to read this. Useful for testing situations \par where the GUI freezes\par\par shellExecute(command, parameters OPTIONAL, folder OPTIONAL, showcommand OPTIONAL): Executes a given command\par\par getTickCount() : Returns the current tickcount since windows was started. Each tick is one millisecond\par processMessages() : Lets the main eventhandler process the new messages (allows for new button clicks)\par inMainThread(): Returns true if the current code is running inside the main thread (6.4+)\par integerToUserData(int): Converts a given integer to a userdata variable\par userDataToInteger(UserDataVar): Converts a given userdata variable to an integer\par\par synchronize(function(...), ...): Calls the given function from the main thread. Returns the return value of the given function\par checkSynchronize(): Calls this from an infinite loop in the main thread when using threading and synchronize calls. This will execute any queued synchronize calls\par\par writeToClipboard(text): Writes the given text to the clipboard\par readFromClipboard(): Reads the text from the clipboard\par\par speedhack_setSpeed(speed) : Enables the speedhack if needed and sets the specific speed\par speedhack_getSpeed(): Returns the last set speed\par\par injectDLL(filename): Injects a dll, and returns true on success\par\par loadPlugin(dllnameorpath): Loads the given plugin. Returns nil on failure. On success returns a value of 0 or greater\par\par\par\par registerCustomTypeLua(typename, bytecount, bytestovaluefunction, valuetobytesfunction, isFloat)\par Registers a Custom type based on lua functions\par The bytes to value function should be defined as "function bytestovalue (b1,b2,b3,b4)" and return an integer as result\par The value to bytes function should be defined as "function valuetobytes (integer)" and return the bytes it should write\par\par\par registerCustomTypeAutoAssembler(script)\par Registers a custom type based on an auto assembler script. The script must allocate an "ConvertRoutine" and "ConvertBackRoutine"\par\par onAutoGuess(function) :\par Registers an function to be called whenever autoguess is used to predict a variable type\par function override (address, ceguess): Return the variable type you want it to be. If no change, just return ceguess\par\par\par\par\par closeCE() : just closes ce\par hideAllCEWindows() : makes all normal ce windows invisible (e.g trainer table)\par unhideMainCEwindow() : shows the main cheat engine window\par\par getAutoAttachList(): returns the AutoAttach StringList object. It can be controlled with the stringlist_ routines (it's not recommended to destroy this list object)\par\par\par AOBScan(x,x,x,x,...):\par scans the currently opened process and returns a StringList object containing all the results. don't forget to "! "free this list when done\par Bytevalue of higher than 255 or anything not an integer will be seen as a wildcard\par AOBScan(aobstring): see above but here you just input one string\par\par\par\par\par Regarding eventhandlers. You can initialize them using both a string of a functionname or the function itself.\par If initialized using a function itself it won't be able to get saved in the table\par\par allocateSharedMemory(name, size):\par Creates a shared memory object of the given size if it doesn't exist yet. If size is not given and there is no shared region with this name then the default size \par of 4096 is used\par It then maps this shared memory block into the currently targeted process. It returns the address of mapped region in the target process\par\par\par getForegroundProcess() : Returns the processID of the process that is currently on top\par\par cheatEngineIs64Bit(): Returns true if CE is 64-bit, false if 32-bit\par targetIs64Bit(): Returns true if the target process is 64-bit, false if 32-bit\par\par\par getCheatEngineDir(): Returns the folder Cheat Engine is located at\par\par disassemble(address): Disassembles the given address and returns a string in the format of "address - bytes - opcode : extra"\par splitDisassembledString(disassembledstring): Returns 4 strings. The address, bytes, opcode and extra field\par\par getInstructionSize(address): Returns the size of an instruction (basically it disassembles the instruction and returns the number of bytes for you)\par getPreviousOpcode(address): Returns the address of the previous opcode (this is just an estimated guess)\par\par\par beep() : Plays the fabulous beep/ping sound!\par playSound(stream, waittilldone OPTIONAL): Plays the given memorystream containing a .WAV formatted memory object. If waittilldone is true the script will stop \par executing till the sound has stopped\par playSound(tablefile, waittilldone OPTIONAL) : Takes the memorystream from the tablefile and plays it.\par There are two tablefiles predeclared inside cheat engine "Activate" and "Deactivate" . You are free to use or override them\par\par getUserRegistryEnvironmentVariable(name): string - Returns the environment variable stored in the user registry environment\par setUserRegistryEnvironmentVariable(name, string) - Sets the environment variable stored in the user registry environment\par broadcastEnvironmentUpdate() : Call this when you've changed the environment variables in the registry. This will cause at least the shell to update so you don't \par have to reboot. (It's always recommended to reboot though)\par\par stringToMD5String(string): Returns an md5 hash string from the provided string\par\par\par getFormCount() : Returns the total number of forms assigned to the main CE application\par getForm(index): Returns the form at the specific index\par\par registerFormAddNotification(function(form)): Registers a function to be called when a form is attached to ce's form list. This is useful for extentions that add new \par functionality to certain existing forms. It returns an object you can use with unregisterFormAddNotification\par unregisterFormAddNotification(Object)\par\par\par getSettingsForm(): Returns the main settings form\par getMemoryViewForm() : Returns the main memoryview form class object which can be accessed using the Form_ class methods and the methods of the classes it inherits \par from. There can be multiple memory views, but this will only find the original/base\par getMainForm() : Returns the main form class object which can be accessed using the Form_ class methods and the methods of the classes it inherits from\par getLuaEngine() : Returns the lua engine form object (Creates it if needed)\par getApplication() : Returns the application object. (the titlebar)\par getAddressList() : Returns the cheat table addresslist object\par getFreezeTimer() : Returns the freeze timer object\par getUpdateTimer() : Returns the update timer object\par\par setGlobalKeyPollInterval(integer): Sets the global keypoll interval. The interval determines the speed of how often CE checks if a key has been pressed or not. \par Lower is more accurate, but eats more cpu power\par setGlobalDelayBetweenHotkeyActivation(integer): Sets the minimum delay between the activation of the same hotey in milliseconds. Affects all hotkeys that do not set \par their own minimum delay\par\par\par\par undefined property functions. Not all properties of all classes have been explicitly exposed to lua, but if you know the name of a property of a specific class you \par can still access them (assuming they are declared as published in the pascal class declaration)\par getPropertyList(class) : Returns a stringlist object containing all the published properties of the specified class (free the list when done) (Note, not all classed \par with properties have 'published' properties. E.g: stringlist)\par setProperty(class, propertyname, propertyvalue) : Sets the value of a published property of a class (Won't work for method properties)\par getProperty(class, propertyname) : Gets the value of a published property of a class (Won't work for method properties)\par setMethodProperty(class, propertyname, function): Sets the method property to the specific function\par getMethodProperty(Class, propertyname): Returns a function you can use to call the original function\par\par\par\par registerSymbol(symbolname, address, OPTIONAL donotsave): Registers a userdefined symbol. If donotsave is true this symbol will not get saved when the table is saved\par unregisterSymbol(symbolname)\par\par getNameFromAddress(address): Returns the given address as a string. Registered symbolname, modulename+offset, or just a hexadecimal string depending on what address\par inModule(address) : returns true if the given address is inside a module\par inSystemModule(address) : returns true if the given address is inside a system module\par getCommonModuleList: Returns the commonModuleList stringlist. (Do not free this one)\par\par\par\par AOBScan("aobstring", protectionflags OPTIONAL, alignmenttype OPTIONAL, alignmentparam HALFOPTIONAL):\par protectionflags is a string.\par X=Executable W=Writable memory C=Copy On Write. Add a + to indicate that flag MUST be set and a - to indicate that that flag MUST NOT be set. (* sets it to don't \par care)\par Examples:\par +W-C = Writable memory exluding copy on write and doesn't care about the Executable flag\par +X-C-W = Find readonly executable memory\par +W = Finds all writable memory and don't care about copy on write or execute\par "" = Find everything (is the same as "*X*C*W" )\par\par\par alignmenttype is an integer:\par 0=No alignment check\par 1=Address must be dividable by alignmentparam\par 2=Address must end with alignmentparam\par alignmentparam is a string which either holds the value the addresses must be dividable by or what the last digits of the address must be\par\par\par\par\par -debugging\par\par debug variables\par EFLAGS\par 32-bit: EAX, EBX, ECX, EDX, EDI, ESP, EBP, ESP, EIP\par 64-bit: RAX, EBX, RBX, RDX, RDI, RSP, RBP, RSP, RIP, R8, R9, R10, R11, R12, R13, R14, R15 : The value of the register\par\par Debug related routines:\par function debugger_onBreakpoint():\par When a breaking breakpoint hits (that includes single stepping) and the lua function debugger_onBreakpoint() is defined it will be called and the global variables \par EAX, EBX, .... will be filled in\par Return 0 if you want the userinterface to be updated and anything else if not (e.g: You continued from the breakpoint in your script)\par\par\par\par createProcess(path, parameters OPTIONAL, debug OPTIONAL, breakonentrypoint OPTIONAL) : Creates a process. If debug is true it will be created using the windows \par debugger and if breakonentry is true it will cause a breakpoint to occur on entrypoint\par\par debugProcess(interface OPT): starts the debugger for the currently opened process (won't ask the user) Optional interface: 0=default, 1=windows debug, 2=VEHDebug, \par 3=Kerneldebug\par\par debug_i""!#sDebugging(): Returns true if the debugger has been started\par debug_getCurrentDebuggerInterface() : Returns the current debuggerinterface used (1=windows, 2=VEH 3=Kernel, nil=no debugging active)\par debug_canBreak(): Returns true if there is a possibility the target can stop on a breakpoint. 6.4+\par debug_isBroken(): Returns true if the debugger is currently halted on a thread\par debug_getBreakpointList(): Returns a lua table containing all the breakpoint addresses\par\par debug_addThreadToNoBreakList(threadid): This will cause breakpoints on the provided thread to be ignored\par debug_removeThreadFromNoBreakList(threadid): removed the threadid from the list\par\par\par debug_setBreakpoint(address, size OPTIONAL, trigger OPTIONAL, breakpointmethod OPTIONAL, functiontocall() OPTIONAL) : sets a breakpoint of a specific size at the \par given address. if trigger is bptExecute then size is ignored. If trigger is ignored then it will be of type bptExecute, which obviously also ignores the size then \par as well\par debug_setBreakpoint(address, size OPTIONAL, trigger OPTIONAL, functiontocall() OPTIONAL) \par debug_setBreakpoint(address, functiontocall() OPTIONAL)\par debug_removeBreakpoint(address) : if the given address is a part of a breakpoint it will be removed\par debug_continueFromBreakpoint(continueMethod) : if the debugger is currently waiting to continue you can continue with this. Valid parameters are :co_run (just \par continue), co_stepinto(when on top of a call, follow it), co_stepover (when on top of a call run till after the call)\par debug_getXMMPointer(xmmregnr) :\par Returns the address of the specified xmm register of the thread that is currently broken\par This is a LOCAL Cheat Engine address. Use Local memory access functions to read and modify\par xmmregnr can be 0 to 15 (0 to 7 on 32-bit)\par\par\par The following routines describe last branch recording. These functions only work when kernelmode debugging is used and using windows XP (vista and later work less \par effective or not at all because the operating system interferes. Might also be intel specific. A dbvm upgrade in the future might make this work for windows vista \par and later)\par debug_setLastBranchRecording(boolean): When set the Kernel debugger will try to record the last branch(es) taken before a breakpoint happens\par debug_getMaxLastBranchRecord() : Returns the maximum branch record your cpu can store (-1 if none)\par debug_getLastBranchRecord(index): Returns the value of the Last Branch Record at the given index (when handling a breakpoint)\par\par\par function debugger_onModuleLoad(modulename, baseaddress) :\par this routine is called when a module is loaded. Only works for the windows debugger\par return 1 if you want to cause the debugger to break\par\par\par Changing registers:\par When the debugger is waiting to continue you can change the register variables. When you continue those register values will be set in the thread's context\par\par\par If the target is currently stopped on a breakpoint, but not done through an onBreakpoint function. The context won't be set.\par You can get and set the context back with these functions before execution continues"\par debug_getContext(BOOL extraregs) - Fills the global variables for the regular registers. If extraregs is true, it will also set FP0 to FP7 and XMM0 to XMM15\par debug_setContext(BOOL extraregs)\par debug_updateGUI() - Will refresh the userinterface to reflect the new context if the debugger was broken\par\par\par\par detachIfPossible() : Detaches the debugger from the target process (if it was attached)\par\par getComment(address) : Gets the userdefined comment at the specified address\par setComment(address, text) : Sets a userdefined comment at the specifried address. %s is used to display the autoguess value if there is one\par getHeader(address) : Gets the userdefined header at the specified address\par setHeader(address) : Sets the userdefined header at the specified address\par\par registerBinUtil(config) Registers a binutils toolset with CE (for assembling and disassembling in other cpu instruction sets)\par config is a table containing several fields that describe the tools, and lets you specify extra parameters\par\par Name : The displayed name in the binutils menu in memview\par Description: The description for this toolset\par Architecture: used by the objdump -m (required)\par ASParam : extra parameters to pass on to AS (optional)\par LDParam : extra parameters to pass on to LD\par OBJDUMPParam: extra parameters to pass on to OBJDUMP\par OnDisassemble: a lua function that gets called each time an address is disassembled. The return value will be passed on to OBJDUMP\par Path: filepath to the binutils set\par Prefix: prefix (e.g: "arm-linux-androideabi-")\par DisassemblerCommentChar: Depending on which target you're disassembling, the comment character can be different. (ARM=";" x86='#' )\par\par\par\par\par\par class helper functions\par inheritsFromObject(object): Returns true if given any class\par inheritsFromComponent(object): Returns true if the given object inherits from the Component class\par inheritsFromControl(object): Returns true if the given object inherits from the Control class\par inheritsFromWinControl(object): Returns true if the given object inherits from the WinControl class\par\par createClass(classname): Creates an object of the specified class (Assuming it's a registered class and has a default constructor)\par\par\par Class definitions\par Object class: (Inheritance: )\par Properties:\par ClassName: String - The name of class (Read only)\par Methods:\par getClassName(): Returns the classname\par destroy(): Destroys the object\par\par\par\par Component Class: (Inheritance: Object)\par properties\par ComponentCount: Integer - Number of child components . Readonly\par Component[int]: Component - Array containing the child components. Starts at 0. Readonly\par ComponentByName[string]: Component - Returns a component based on the name. Readonly\par Name: string - The name of the component\par Tag: integer - Free to use storage space. (Useful for id's)\par Owner: Component - Returns the owner of this object. Nil if it has none\par\par methods\par getComponentCount() : Returns the number of components attached to his component\par getComponent(index) : Returns the specific component\par findComponentByName(name) : Returns the component with this name\par getName() : Return the name\par setName(newname) : Changes the name\par getTag() : Sets an integer value. You can use this for ID's\par setTag(tagvalue) : Get the tag value\par getOwner() : Returns the owner of this component\par\par\par\par Control Class: (Inheritance: Component->Object)\par properties:\par Caption: string - The text of a control\par Top : integer - The x position\par Left : integer - The y position\par Width : integer - The width of the control\par Height : integer - The height of the control\par ClientWidth: integer - The usable width inside the control (minus the borders)\par ClientHeight: integer - The usable height the control (minus the borders)\par Align: AlignmentOption - Alignment of the control\par Enabled: boolean - Determines if the object is usable or greyed out\par Visible: boolean - Determines if the object is visible or not\par Color: ColorDefinition/RGBInteger - The color of the object. Does not affect the caption\par Parent: WinControl - The owner of this control\par PopupMenu: PopupMenu - The popup menu that shows when rightclicking the control\par Font: Font - The font class associated with the control\par OnClick: function - The function to call when a button is pressed\par\par\par methods:\par getLeft()\par setLeft(integer)\par getTop()\par setTop(integer)\par getWidth()\par setWidth(integer)\par getHeight()\par setHeight()\par setCaption(caption) : sets the text on a control. All the GUI objects fall in this category\par getCaption() : Returns the text of the cont"#"$rol\par setPosition(x,y): sets the x and y position of the object base don the top left position (relative to the client array of the owner object)\par getPosition(): returns the x and y position of the object (relative to the client array of the owner object)\par setSize(width,height) : Sets the width and height of the control\par getSize() : Gets the size of the control\par setAlign(alignmentoption): sets the alignment of the control\par getAlign(alignmentoption): gets the alignment of the control\par getEnabled() : gets the enabled state of the control\par setEnabled(boolean) : Sets the enabled state of the control\par getVisible() : gets the visible state of the control\par setVisible(boolean) : sets the visible state of the control\par getColor() : gets the color\par setColor(rgb) : Sets the color\par getParent() : Returns nil or an object that inherits from the Wincontrol class\par setParent(wincontrol) : Sets the parent for this control\par getPopupMenu()\par setPopupMenu()\par getFont(): Returns the Font object of this object\par setFont(): Assigns a new font object. (Not recommended to use. Change the font object that's already there if you wish to change fonts)\par repaint(): Invalidates the graphical area of the control and forces and update\par update() : Only updates the invalidated areas\par setOnClick(functionnameorstring) : Sets the onclick routine\par getOnClick(): Gets the onclick function\par doClick(): Executes the current function under onClick\par\par GraphicsObject : (GraphicsObject->Object)\par\par\par\par Region Class : (Region->GraphicsObject->Object)\par createRegion(): Created an empty region\par\par properties\par -\par methods\par addRectangle(x1, y1, x2, y2): Adds a rectangle to the region\par addPolygon(tablewithcoordinates): Adds an array of 2D locations. (example : \{\{0,0\},\{100,100\}, \{0,100\}\} for a triangle )\par\par\par\par WinControl Class: (Inheritance: Control->Component->Object)\par properties\par DoubleBuffered: boolean - Graphical updates will go to a offscreen bitmap which will then be shown on the screen instead of directly to the screen. May reduce \par flickering\par ControlCount : integer - The number of child controls of this wincontrol\par Control[] : Control - Array to access a child control\par OnEnter : function - Function to be called when the WinControl gains focus\par OnExit : function - Function to be called when the WinControl loses focus\par\par methods\par getControlCount() Returns the number of Controls attached to this class\par getControl(index) : Returns a WinControl class object\par getControlAtPos(x,y): Gets the control at the given x,y position relative to the wincontrol's position\par canFocus(): returns true if the object can be focused\par focused(): returns boolean true when focused\par setFocus(): tries to set keyboard focus the object\par setShape(Region): Sets the region object as the new shape for this wincontrol\par setShape(Bitmap):\par setOnEnter(function) : Sets an onEnter event. (Triggered on focus enter)\par getOnEnter()\par setOnExit(function) : Sets an onExit event. (Triggered on lost focus)\par getOnExit()\par\par\par MenuItem class(Inheritance: Component->Object)\par createMenuItem(ownermenu) : Creates a menu item that gets added to the owner menu\par\par properties\par Caption : String - Text of the menu item\par Shortcut : string - Shortcut in textform to trigger the menuitem\par Count : integer - Number of children attached to this menuitem\par Menu: Menu - The menu this item resides in\par Parent: MenuItem - The menuitem this item hangs under\par MenuIndex: integer - The position this menu item is in it's parent\par Item[] : Array to access each child menuitem\par [] : Item[]\par OnClick: Function to call when the menu item is activated\par\par methods\par getCaption() : Gets the caption of the menu item\par setCaption(caption) : Sets the caption of the menu item\par getShortcut(): Returns the shortcut for this menu item\par setShortcut(shortcut): Sets the shortcut for this menuitem. A shortcut is a string in the form of ("ctrl+x")\par getCount()\par getItem(index) : Returns the menuitem object at the given index\par add(menuitem) : Adds a menuItem as a submenu item\par insert(index, menuitem): Adds a menuItem as a submenu item at the given index\par delete(index)\par setOnClick(function) : Sets an onClick event\par getOnClick()\par doClick(): Executes the onClick method if one is assigned\par\par\par\par Menu Class: (Inheritance: Component->Object)\par properties\par Items : MenuItem - The base MenuItem class of this menu (readonly)\par methods\par getItems() : Returns the main MenuItem of this Menu\par\par MainMenu Class: (Inheritance: Menu->Component->Object)\par createMainMenu(form)\par The mainmenu is the menu at the top of a window\par\par PopupMenu Class: (Inheritance: Menu->Component->Object)\par createPopupMenu(owner)\par The popup menu is the menu that pops up when showing the (rightclick) context of an control\par\par\par Strings Class: (Inheritance : Object) (Mostly an abstract class)\par properties\par Text : String - All the strings in one string\par Count: Integer - The number of strings in this list\par String[]: String - Array to access one specific string in the list\par [] = String[]\par\par methods\par clear() : Deletes all strings in the list\par add(string) : adds a string to the list\par delete(index) : Deletes a string from the list\par getText() : Returns all the strings as one big string\par setText() : Sets the strings of the given strings object to the given text (can be multiline)\par indexOf(string): Returns the index of the specified string. Returns -1 if not found\par insert(index, string): Inserts a string at a specific spot moving the items after it\par\par getCount(): Returns the number is strings in the list\par remove(string); Removes the given string from the list\par loadFromFile(filename) : Load the strings from a textfile\par saveToFile(filename) : Save the strings to a textfile\par\par getString(index) : gets the string at the given index\par setString(index, string) : Replaces the string at the given index\par\par\par\par Stringlist Class: (Inheritance : Strings->Object)\par createStringlist() : Creates a stringlist class object (for whatever reason, lua strings are probably easier to use)\par\par properties\par Duplicates : DuplicatesType - Determines how duplicates should be handled\par Sorted : boolean - Determines if the list should be sorted\par CaseSensitive: boolean - Determines if the list is case sensitive or not.\par\par methods\par getDuplicates() : returns the duplicates property\par setDuplicates(Duplicates) : Sets the duplicates property (dupIgnore, dupAccept, dupError)\par getSorted() : returns true if the list has the sorted property\par setSorted(boolean) : Sets the sorted property\par getCaseSensitive() : Returns true if the case sensitive property is set\par setCaseSensitive(boolean): Sets the case sensitive property\par\par Application Class: (Inheritance: CustomApplication->Component->Object)\par properties\par Title: The title of cheat engine in the bar\par\par methods\par bringToFront(): Shows the cheat engine app\par\par\par Form Class: (Inheritance: ScrollingWinControl->CustomControl->WinControl->Control->Component->Object)\par properties\par AllowDropFiles: boolean - Allows files to be dragged into the form\par ModalResult: integer - The current ModalResult value of the form. Note: When this value gets set the modal form will close\par Menu: MainMenu - The main menu of the form\par\par OnClose: function(sender) - The function to call when the form gets closed\par OnDropFiles: function(sender, \{filenames\}) - Called when files are dragged on top of the form. Filenames is an arraytable with the files\par\par\par methods\par centerScreen(); : Places the form at the center of the sc"$#%reen\par hide() : Hide the form\par show() : show the form\par close(): Closes the form. Without an onClose this will be the same as hide\par bringToFront(): Brings the form to the foreground\par showModal() : show the form and wait for it to close and get the close result\par isForegroundWindow(): returns true if the specified form has focus\par setOnClose(function) : function (sender) : Return a CloseAction to determine how to close the window\par getOnClose() : Returns the function\par getMenu() : Returns the mainmenu object of this form\par setMenu(mainmenu)\par\par setBorderStyle( borderstyle): Sets the borderstyle of the window\par getBorderStyle()\par\par printToRasterImage(rasterimage): Draws the contents of the form to a rasterimage class object\par dragNow(): Call this on mousedown on any object if you wish that the mousemove will drag the whole form arround. Useful for borderless windows (Dragging will \par stop when the mouse button is released)\par\par\par CEForm Class: (Inheritance: Form->ScrollingWinControl->CustomControl->WinControl->Control->Component->Object)\par createForm(visible OPT): creates a CEForm class object(window) and returns the pointer for it. Visible is default true but can be changed\par createFormFromFile(filename): Returns the generated CEform\par\par properties\par DoNotSaveInTable: boolean - Set this if you do not wish to save the forms in the table\par methods\par saveToFile(filename): Saves a userdefined form\par getDoNotSaveInTable(): Returns the DoNotSaveInTable property\par setDoNotSaveInTable(boolean): Sets the DoNotSaveInTable property\par\par\par GraphicControl Class: (Inheritance: Control->Component->Object)\par properties\par Canvas: Canvas - The canvas for rendering this control\par\par methods\par getCanvas() : Returns the Canvas object for the given object that has inherited from customControl\par\par\par PaintBox class: (Inheritance: GraphicControl->Control->Component->Object)\par createPaintBox(owner): Creates a Paintbox class object\par\par\par Label Class: (Inheritance: GraphicControl->Control->Component->Object)\par createLabel(owner): Creates a Label class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par\par Splitter Class: (Inheritance: CustomControl->WinControl->Control->Component->Object)\par createSplitter(owner): Creates a Splitter class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par\par Panel Class: (Inheritance: CustomControl->WinControl->Control->Component->Object)\par createPanel(owner): Creates a Panel class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Alignment: alignment\par BevelInner: panelBevel\par BevelOuter: panelBevel\par BevelWidth: Integer\par FullRepaint: boolean\par methods\par getAlignment() : gets the alignment property\par setAlignment(alignment) : sets the alignment property\par getBevelInner()\par setBevelInner(PanelBevel)\par getBevelOuter()\par setBevelOuter(PanelBevel)\par getBevelWidth()\par setBevelWidth(BevelWidth)\par getFullRepaint()\par setFullRepaint(boolean)\par\par\par\par Image Class: (Inheritance: GraphicControl->Control->Component->Object)\par createImage(owner): Creates an Image class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Canvas: Canvas - The canvas object to access the picture of the image\par Transparent: boolean - Determines if some parts of the picture are see through (usually based on the bottomleft corner)\par Stretch: boolean - Determines if the picture gets stretched when rendered in the image component\par Picture: Picture - The picture to render\par\par methods\par loadImageFromFile(filename)\par getStretch()\par setStretch(boolean)\par getTransparent()\par setTransparent(boolean)\par getCanvas()\par setPicture(picture)\par getPicture() : Returns the Picture object of this image\par\par\par Edit Class: (Inheritance: WinControl->Control->Component->Object)\par createEdit(owner): Creates an Edit class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Text: string - The current contents of the editfield\par OnChange: function - The function to call when the editfield is changed\par\par methods\par clear()\par selectAll()\par clearSelection()\par copyToClipboard()\par cutToClipboard()\par pasteFromClipboard()\par onChange(function)\par\par\par Memo Class: (Inheritance: Edit->WinControl->Control->Component->Object)\par createMemo(owner): Creates a Memo class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Lines: Strings - Strings object for this memo\par WordWrap: boolean - Set if words at the end of the control should go to the next line\par WantTabs: Boolean - Set if tabs will add a tab to the memo. False if tab will go to the next control\par WantReturns: Boolean - Set if returns will send a event or not\par Scrollbars: Scrollstyle - Set the type of ascrollbars to show (ssNone, ssHorizontal, ssVertical, ssBoth,\par ssAutoHorizontal, ssAutoVertical, ssAutoBoth)\par\par\par methods\par append(string)\par getLines() : returns a Strings class\par getWordWrap()\par setWordWrap(boolean)\par getWantTabs()\par setWantTabs(boolean)\par getWantReturns()\par setWantReturns(boolean)\par getScrollbars()\par setScrollbars(scrollbarenumtype) :\par Sets the scrollbars. Horizontal only takes affect when wordwrap is disabled\par valid enum types:\par ssNone : No scrollbars\par ssHorizontal: Has a horizontal scrollbar\par ssVertical: Has a vertical scrollbar\par ssBoth: Has both scrollbars\par ssAutoHorizontal: Same as above but only shows when there actually is something to scroll for\par ssAutoVertical: " " " " ...\par ssAutoBoth: " " " " ...\par\par\par\par\par\par ButtonControl Class: (Inheritance: WinControl->Control->Component->Object)\par\par\par Button Class: (Inheritance: ButtonControl->WinControl->Control->Component->Object)\par createButton(owner): Creates a Button class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par ModalResult: ModalResult - The result this button will give the modalform when clicked\par\par methods\par getModalResult(button)\par setModalResult(button, mr)\par\par CheckBox Class: (Inheritance: ButtonControl->WinControl->Control->Component->Object)\par createCheckBox(owner): Creates a CheckBox class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Checked: boolean - True if checked\par AllowGrayed: boolean - True if it can have 3 states. True/False/None\par State: checkboxstate - The state. (cbUnchecked=0, cbChecked=1, cbGrayed=2)\par OnChange: function - Function to call when the state it changed\par\par methods\par getAllowGrayed()\par setAllowGrayed(boolean)\par getState(): Returns a state for the checkbox. (cbUnchecked, cbChecked, cbGrayed)\par setState(boolean): Sets the state of the checkbox\par onChange(function)\par\par ToggleBox Class: (Inheritance: CheckBox->ButtonControl->WinControl->Control->Component->Object)\par createToggleBox(owner): Creates a ToggleBox class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par GroupBox Class: (Inheritance: WinControl->Control->Component->Object)\par createGroupBox(owner): Creates a GroupBox class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par\par RadioGroup class: (Inheritance: GroupBox->WinControl->Control->Component->Object)\par createRadioGroup(owner): Creates a RadioGroup class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par pro"%$&perties\par Items: Strings - Strings derived object containings all the items in the list\par Columns: Integer - The number of columns to split the items into\par ItemIndex: Integer - The currently selected item\par OnClick: Called when the control is clicked\par\par methods\par getRows(): Returns the number of rows\par getItems(): Returns a Strings object\par getColumns(): Returns the nuber of columns\par setColumns(integer)\par getItemIndex()\par setItemIndex(integer)\par setOnClick(function)\par getOnClick()\par\par\par ListBox Class: (Inheritance: WinControl->Control->Component->Object)\par createListBox(owner): Creates a ListBox class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par MultiSelect: boolean - When set to true you can select multiple items\par Items: Strings - Strings derived object containings all the items in the list\par Selected[] - Returns true if the given line is selected. Use Items.Count-1 to find out the max index\par ItemIndex: integer - Get selected index. -1 is nothing selected\par Canvas: Canvas - The canvas object used to render on the object\par\par methods\par clear()\par clearSelection() : Deselects all items in the list\par selectAll(): Selects all items in the list\par getItems(): Returns a strings object\par setItems(Strings): sets a strings object to the listbox\par getItemIndex()\par setItemIndex(integer)\par getCanvas()\par\par\par Calendar Class: (Inheritance: WinControl->Control->Component->Object)\par createCalendar(owner): Creates a Calendar class object which belongs to the given owner. Owner can be any object inherited from WinControl. Valid date is between \par "September 14, 1752" and "December 31, 9999"\par\par properties\par Date: string - current date of the Calendar, format: yyyy-mm-dd\par DateTime: number - days since December 30, 1899\par\par methods\par getDateLocalFormat - returns current date of the Calendar, format: ShortDateFormat from OS local settings\par\par\par ComboBox Class: (Inheritance: WinControl->Control->Component->Object)\par createComboBox(owner): Creates a ComboBox class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Items: Strings - Strings derived object containings all the items in the list\par ItemIndex: integer - Get selected index. -1 is nothing selected\par Canvas: Canvas - The canvas object used to render on the object\par\par methods\par clear()\par getItems()\par setItems()\par getItemIndex()\par setItemIndex(integer)\par getCanvas()\par\par\par\par\par ProgressBar Class: (Inheritance: WinControl->Control->Component->Object)\par createProgressBar(owner): Creates a ProgressBar class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Min: integer - The minimum positionvalue the progressbar can have (default 0)\par Max: integer - The maximum positionvalue the progressbar can have (default 100\par Position: integer - The position of the progressbar\par Step: integer- The stepsize to step by when stepIt() is called\par\par methods\par stepIt() - Increase position with "Step" size\par stepBy(integer) - increase the position by the given integer value\par getMax() - returns the Max property\par setMax(integer) - sets the max property\par getMin() - returns the min property\par setMin(integer)- sets the min property\par getPosition() - returns the current position\par setPosition(integer) - sets the current position\par\par\par\par\par TrackBar Class : (Inheritance: WinControl->Control->Component->Object)\par createTrackBar(owner): Creates a TrackBar class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Min: integer - Minimal value for the trackbar\par Max: integer - Maximum value for the trackbar\par Position: integer - The current position\par OnChange: function - Function to call when\par\par methods\par getMax()\par setMax(integer)\par getMin(trackbar)\par setMin(trackbar, integer)\par getPosition(progressbar)\par setPosition(progressbar, integer)\par getOnChange(function)\par setOnChange()\par\par\par CollectionItem Class: (Inheritance: Object)\par Base class for some higher level classes. Often used for columns\par\par properties\par ID: integer\par Index: integer - The index in the array this item belong to\par DisplayName: string\par\par methods\par getID()\par getIndex()\par setIndex()\par getDisplayName()\par setDisplayName()\par\par\par\par\par\par ListColumn class: (Inheritance: CollectionItem->Object)\par properties\par AutoSize: boolean\par Caption: string\par MaxWidth: integer\par MinWidth: integer\par Width: integer\par Visible: boolean\par methods\par getAutosize()\par setAutosize(boolean)\par getCaption()\par setCaption(caption)\par getMaxWidth()\par setMaxWidth(width)\par getMinWidth()\par setMinWidth(width)\par getWidth()\par setWidth(width)\par\par\par Collection Class: (Inheritance: TObject)\par\par properties\par Count: integer\par\par methods\par clear(collection)\par getCount(collection)\par delete(collection, index)\par\par\par ListColumns class : (Inheritance: Collection->Object)\par properties\par Columns[]: Array to access a column\par [] = Columns[]\par\par methods\par add(): Returns a new ListColumn object\par getColumn(index): Returns a ListColum object;\par setColumn(index, listcolumns): Sets a ListColum object (not recommended, use add instead)\par\par ListItem Class : (Inheritance: TObject)\par properties\par Caption: boolean - The text of this listitem\par Checked: boolean - Determines if the checkbox is checked (if it has a checkbox)\par SubItems: Strings - The Strings object that hold the subitems\par Selected: boolean - Returns true if selected\par Index: integer - The index in the Items object of the owner of this listitem (readonly)\par Owner: ListItems - The ListItems object that owns this ListItem (readonly)\par\par methods\par delete()\par getCaption() : Returns the first columns string of the listitem\par setCaption(string) : Sets the first column string of the listitem\par getChecked() : Returns true if the listitem is checked\par setChecked(boolean): Sets the checkbox of the listbox to the given state\par getSubItems(): Returns a Strings object\par makeVisible(partial): Scrolls the listview so this item becomes visible (Cheat Engine 6.4 and later)\par\par\par ListItems class : (Inheritance: TObject)\par properties\par Count : Integer - The number of ListItems this object holds (Normally read only, but writable if OwnerData is true in the listview)\par Item[]: ListItem[] - Array to access each ListItem object\par [] = Item[]\par methods\par clear()\par getCount()\par getItem(integer) : Return the listitem object at the given index\par add(): Returns a new ListItem object\par\par\par\par Listview Class : (Inheritance: WinControl->Control->Component->Object)\par createListView(owner): Creates a ListView class object which belongs to the given owner. Owner can be any object inherited from WinControl\par\par properties\par Columns: ListColumns - The Listcolumns object of the listview (Readonly)\par Items: ListItems - The ListItems objects of the listview\par ItemIndex: integer - The currently selected index in the Items object (-1 if nothing is selected)\par Selected: ListItem - The currently selected listitem (nil if nothing is selected)\par Canvas: Canvas - The canvas object used to render the listview (Readonly)\par AutoWidthLastColumn: Boolean - When set to true the last column will resize when the control resizes\par HideSelection: Boolean - When set to true the selection will not hide when the focus leaves the control\par RowSelect: Boolean - When set to true the whole row will be selected instead of just the first column\par "&%' OwnerData: Boolean - When set to true the listview will call the onData function for every line being displayed. Use Items.Count to set the number of virtual \par lines\par\par OnData: function(sender, ListItem) - Called when a listview with OwnerData true renders a line\par\par methods\par clear()\par getColumns() : ListColumns - Returns a ListColumns object\par getItems(): ListItems - Returns a ListItems object\par getItemIndex(): integer - Returns the currently selected index in the Items object\par setItemIndex(index: integer)- Sets the current itemindex\par getCanvas() : Canvas - Returns the canvas object used to render the listview\par\par\par TreeNode class : (Inheritance: TObject)\par properties\par Text: string - The text of the treenode\par Parent: Treenode - The treenode this object is a child of. (can be nil) (ReadOnly)\par Level: Integer - The level this node is at\par HasChildren: boolean - Set to true if it has children, or you wish it to have an expand sign\par Expanded: boolean - Set to true if it has been expanded\par Count : Integer - The number of children this node has\par Items[]: Treenode - Array to access the child nodes of this node\par [] = Items[]\par Index: Integer - The index based on the parent\par AbsoluteIndex: Integer - The index based on the TreeView's Treenodes object (Items)\par Selected: Boolean - Set to true if currently selected\par MultiSelected: Boolean - Set to true if selected as well, but not the main selected object\par Data: Pointer - Space to store 4 or 8 bytes depending on which version of CE is used\par methods\par delete()\par deleteChildren()\par makeVisible()\par expand(recursive:boolean=TRUE OPTIONAL) : Expands the given node\par collapse(recursive:boolean=TRUE OPTIONAL) : collapses the given node\par getNextSibling(): Returns the treenode object that's behind this treenode on the same level\par add(text:string): Returns a Treenode object that is a child of the treenode used to create it\par\par\par\par\par TreeNodes class : (Inheritance: TObject)\par properties\par Count : Integer - The total number of Treenodes this object has\par Item[]: TreeNode - Array to access each node\par [] = Item[]\par methods\par clear()\par getCount()\par getItem(integer) : Return the TreeNode object at the given index (based on the TreeView's Treenodes)\par add(text:string): Returns a new root Treenode object\par insert(treenode, string): Returns a new treenode object that has been inserted before the given treenode\par insertBehind(treenode, string): Returns a new treenode object that has been inserted after the given treenode\par\par\par\par Treeview Class : (Inheritance: CustomControl->WinControl->Control->Component->Object)\par createTreeView(owner)\par\par properties\par Items: TreeNodes - The Treenodes object of the treeview (ReadOnly)\par Selected: TreeNode - The currently selected treenode\par\par methods\par getItems()\par getSelected()\par setSelected()\par fullCollapse() : Collapses all the nodes, including the children's nodes\par fullExpand() : Expands all the nodes and all their children\par saveToFile(filename): Saves the contents of the treeview to disk\par\par\par\par Timer Class : (Inheritance: Component->object)\par createTimer(owner OPT, enabled OPT):\par Creates a timer object. If enabled is not given it will be enabled by default (will start as soon as an onTimer event has been assigned)\par Owner may be nil, but you will be responsible for destroying it instead of being the responsibility of the owner object)\par\par properties\par Interval: integer - The number of milliseconds (1000=1 second) between executions\par Enabled: boolean\par OnTimer: function(timer) - The function to call when the timer triggers\par\par methods\par getInterval()\par setInterval(interval) : Sets the speed on how often the timer should trigger. In milliseconds (1000=1 second)\par getOnTimer()\par setOnTimer(function(timer))\par getEnabled()\par setEnabled(boolean)\par\par CustomControl class (CustomControl->WinControl->Control->Component->Object)\par properties\par Canvas : The canvas object for drawing on the control/. Readonly\par methods\par getCanvas() : Returns the Canvas object for the given object that has inherited from customControl\par\par\par Canvas Class : (Inheritance: CustomCanvas->Object)\par properties\par Brush: Brush - The brush object\par Pen: Pen - The pen object\par Font: Font - The font object\par Width: integer - Width of the canvas\par Height: integer - Height of the canvas\par\par\par\par methods\par getBrush(): Returns the brush object of this canvas\par getPen(): Returns the pen object of this canvas\par getFont(): Returns the font object of this canvas\par getWidth()\par getHeight()\par getPenPosition()\par setPenPosition(x,y)\par clear() - Clears the canvas\par line(sourcex, sourcey, destinationx, destinationy)\par lineTo(destinationx, destinationy)\par rect(x1,y1,x2,y2)\par fillRect(x1,y1,x2,y2)\par textOut(x,y, text)\par getTextWidth(text)\par getTextHeight(text)\par getPixel(x,y)\par setPixel(x,y,color)\par floodFill(x,y)\par ellipse(x1,y1,x2,y2)\par gradientFill(x1,y1,x2,y2, startcolor, stopcolor, direction) : Gradient fills a rectangle. Direction can be 0 or 1. 0=Vertical 1=Horizontal\par copyRect(dest_x1,dest_y1,dest_x2,dest_y2, sourceCanvas, source_x1,source_y1,source_x2,source_y2) : Draws an image from one source to another. Useful in cases of \par doublebuffering\par draw(x,y, graphic) : Draw the image of a specific Graphic class\par getClipRect() : Returns a table containing the fields Left, Top, Right and Bottom, which define the invalidated region of the graphical object. Use this to only \par render what needs to be rendered in the onPaint event of objects\par\par Pen Class : (Inheritance: CustomPen->CanvasHelper->Object)\par properties\par Color: Integer - The color of the pen\par Width: integer - Thickness of the pen\par methods\par getColor()\par setColor(color)\par getWidth()\par setWidth(width)\par\par\par Brush Class : (Inheritance: CustomBrush->CanvasHelper->Object)\par properties\par Color : Integer\par methods\par getColor()\par setColor()\par\par Font Class : (Inheritance: CustomFont->CanvasHelper->Object)\par createFont(): Returns a font object (default initialized based on the main ce window)\par\par properties\par Name: string\par Size: integer\par Color: integer\par\par methods\par getName(): Gets the fontname of the font\par setName(string): Sets the fontname of the font\par getSize(): Gets the size of the font\par setSize(integer): Sets the size of the font\par getColor(): Gets the color of the font\par setColor(integer): Sets the color of the font\par assign(font): Copies the contents of the font given as parameter to this font\par\par\par Graphic Class : (Inheritance: Object) : Abstract class\par properties\par Width: integer\par Height: integer\par Transparent: boolean\par\par methods\par getWidth(graphic): Gets the current width in pixels of this graphics object\par setWidth(graphic, width): Sets thw width in pixels\par getHeight(graphic)\par setHeight(graphic, height)\par\par RasterImage class: (Inheritance: Graphic->Object) : Base class for some graphical controls\par properties\par Canvas: Canvas\par PixelFormat: PixelFormat - the pixelformat for this image. Will clear the current image if it had one. Supported pixelformats: pf1bit, pf4bit, pf8bit, pf15bit, \par pf16bit, pf24bit, pf32bit (recommended)\par TransparentColor: integer\par\par methods\par getCanvas(): Returns the Canvas object for this image\par getPixelFormat(): Returns the current pixelformat\par getPixelFormat(pixelformat): Sets the pixelformat for this image. Will clear the current image if it had one. Supported pixelformats: pf1bit, pf4bit, pf8bit, \par pf15bit, pf16bit, pf24bit, pf32bit (recommended)\par setTransparentColor(integer): Sets th"'&(e color that will be rendered as transparent when drawn\par getTransparentColor(): Returns the color set to be transparent\par\par\par Bitmap class: (Inheritance: CustomBitmap->RasterImage->Graphic->Object) : Bitmap based Graphic object\par createBitmap(width, height) - Returns a Bitmap object\par\par PortableNetworkGraphic Class: (Inheritence: CustomBitmap->RasterImage->Graphic->Object)\par createPNG(width, height) - Returns a PortableNetworkGraphic object\par\par JpegImage Class: (Inheritence: CustomBitmap->RasterImage->Graphic->Object)\par createJpeg(width, height) - Returns a Jpeg object\par\par\par\par Picture Class : (Inheritance: Object) : Container for the Graphic class\par createPicture() : Returns a empty picture object\par\par properties\par Graphic\par PNG\par Bitmap\par Jpeg\par\par methods\par loadFromFile(filename)\par saveToFile(filename)\par loadFromStream(stream, originalextension OPTIONAL) : Loads a picture from a stream. Note that the stream position must be set to the start of the picture\par assign(sourcepicture)\par getGraphic() : Gets the Graphic object of this picture\par getPNG(): Returns a PortableNetworkGraphic Class object (Can be used from scratch)\par getBitmap(): Returns a Bitmap Class object (Can be used from scratch)\par getJpeg(): Returns a JpegImage Class object (Picture must be initialized with a jpeg file first)\par\par\par\par\par GenericHotkey Class : (Inheritance: Object)\par createHotkey(function, keys, ...) : returns an initialized GenericHotkey class object. Maximum of 5 keys\par createHotkey(function, \{keys, ...\}) : ^\par\par properties\par DelayBetweenActivate: integer - Interval in milliseconds that determines the minimum time between hotkey activations. If 0, the global delay is used\par onHotkey: The function to call when the hotkey is pressed\par\par methods\par getKeys()\par setKeys(key, ....)\par setOnHotkey(table)\par getOnHotkey\par\par\par CommonDialog class:\par properties\par OnShow: function(sender)\par OnClose: function(sender)\par Title: string - The caption at top of the dialog\par methods\par Execute() : Shows the dialog and return true/false depending on the dialog\par\par FindDialog Class: (Inheritance: CommonDialog->Component->Object)\par properties\par FindText: String - The text the user wishes to find\par Options: Enum - Find Options\par \{ frDown, frFindNext, frHideMatchCase, frHideWholeWord,\par frHideUpDown, frMatchCase, frDisableMatchCase, frDisableUpDown,\par frDisableWholeWord, frReplace, frReplaceAll, frWholeWord, frShowHelp,\par frEntireScope, frHideEntireScope, frPromptOnReplace, frHidePromptOnReplace \}\par OnFind: function (sender) - Called when the find button has been clicked\par OnHelp: function (sender) - Called when the help button is visible (see Options) and clicked\par methods\par\par\par FileDialog Class: (Inheritance: CommonDialog->Component->Object)\par properties\par\par DefaultExt: string - When not using filters this will be the default extention used if no extension is given\par Files: Strings - Stringlist containing all selected files if multiple files are selected\par FileName: string - The filename that was selected\par Filter: string - A filter formatted string\par FilterIndex: integer - The index of which filter to use\par\par InitialDir: string - Sets the folder the filedialog will show first\par methods\par\par\par\par OpenDialog Class: (Inheritance: FileDialog->CommonDialog->Component->Object)\par createOpenDialog(owner) : Creates an opendialog object\par\par properties\par Options: String\par A string formatted as "[param1, param2, param3]" to set OpenDialogs options\par Valid parameters are:\par ofReadOnly,\par ofOverwritePrompt : if selected file exists shows a message, that file will be overwritten\par ofHideReadOnly : hide read only file\par ofNoChangeDir : do not change current directory\par ofShowHelp : show a help button\par ofNoValidate\par ofAllowMultiSelect : allow multiselection\par ofExtensionDifferent\par ofPathMustExist : shows an error message if selected path does not exist\par ofFileMustExist : shows an error message if selected file does not exist\par ofCreatePrompt\par ofShareAware\par ofNoReadOnlyReturn : do not return filenames that are readonly\par ofNoTestFileCreate\par ofNoNetworkButton\par ofNoLongNames\par ofOldStyleDialog\par ofNoDereferenceLinks : do not expand filenames\par ofEnableIncludeNotify\par ofEnableSizing : dialog can be resized, e.g. via the mouse\par ofDontAddToRecent : do not add the path to the history list\par ofForceShowHidden : show hidden files\par ofViewDetail : details are OS and interface dependent\par ofAutoPreview : details are OS and interface dependent\par\par\par methods\par -\par\par\par SaveDialog Class: (Inheritance: OpenDialog->FileDialog->CommonDialog->Component->Object)\par createSaveDialog(owner)\par\par SelectDirectoryDialog Class: (Inheritance: OpenDialog->FileDialog->CommonDialog->Component->Object)\par createSelectDirectoryDialog(owner)\par\par\par Stream Class\par\par properties\par Size: integer\par Position: integer\par\par methods\par copyFrom(stream, count) - Copies count bytes from the given stream to this stream\par read(count): bytetable - Returns a bytetable containing the bytes of the stream. This increases the position\par write(bytetable, count OPTIONAL)- Writes the given bytetable to the stream\par\par\par MemoryStream Class (Inheritance: Stream->Object)\par createMemoryStream()\par\par properties\par Memory: Integer - The address in Cheat Engine's memory this stream is loaded (READONLY, tends to change)\par\par methods\par loadFromFile(filename) : Replaces the contents in the memory stream with the contents of a file on disk\par saveToFile(filename) : Writes the contents of the memory stream to the specified file\par\par\par FileStream Class (Inheritance: HandleStream->Stream->Object)\par createFileStream(filename, mode)\par\par\par TableFile class (Inheritance: Object)\par findTableFile(filename): Returns the TableFile class object for the saved file\par\par properties\par Name: string\par Stream: MemoryStream\par\par methods\par saveToFile(filename)\par getData() : Gets a MemoryStream object\par\par\par xmplayer class\par The xmplayer class has already been defined as xmplayer, no need to create it manually\par\par properties\par IsPlaying : boolean - Indicator that the xmplayer is currently playing a xm file\par Initialized: boolean - Indicator that the xmplayer is actually actively loaded in memory\par\par methods\par setVolume(int)\par playXM(filename, OPTIONAL noloop)\par playXM(tablefile, OPTIONAL noloop)\par playXM(Stream, OPTIONAL noloop)\par pause()\par resume()\par stop()\par\par\par CheatComponent Class: (Inheritance: WinControl->Control->Component->Object)\par The cheatcomponent class is the component used in Cheat Engine 5.x trainers\par Most people will probably want to design their own components but for those that don't know much coding and use the autogenerated trainer this will be used\par\par properties\par Color: Integer - background color\par Textcolor: integer - text color\par Activationcolor: integer - The textcolor to show when activated is true\par Activated: boolean - Toggles between the ActivationColor and the TextColor\par Editleft:integer - The x position of the optional edit field\par Editwidth: integer - the width of the optional edit field\par Editvalue:string - The string of the optional edit field\par Hotkey:string read - The hotkeypart of the cheat line\par Description:string - Description part of the cheat line\par Hotkeyleft: integer - The x position of the hotkey line\par Descriptionleft:integer - The x position "(') of the Description line\par\par\par ShowHotkey: boolean - Decides if the hotkey label should be shown\par HasEditBox: boolean - Decides if the editbox should be shown\par HasCheckbox: boolean - Decides if the checkbox should be shown\par Font: Font - The font to use to render the text\par\par methods\par -\par\par\par\par MemoryRecordHotkey Class: (Inheritance: object)\par The memoryrecord hotkey class is mainly readonly with the exception of the event properties to be used to automatically create trainers\par Use the genreric hotkey class if you wish to create your own hotkeys\par\par properties\par Owner: MemoryRecord - The memoryrecord this hotkey belongs to (ReadOnly)\par ID: integer - Unique id of this hotkey (ReadOnly)\par Description: string - The description of this hotkey (ReadOnly)\par HotkeyString: string - The hotkey formatted as a string (ReadOnly)\par OnHotkey: function(sender) - Function to be called when a hotkey has just been pressed\par OnPostHotkey: function(sender) - Function to be called when a hotkey has been pressed and the action has been performed\par\par methods\par doHotkey: Executes the hotkey as if it got triggered by the keyboard\par\par\par MemoryRecord Class:\par The memoryrecord objects are the entries you see in the addresslist\par\par properties\par ID: Integer - Unique ID\par Index: Integer - The index ID for this record. 0 is top. (ReadOnly)\par Description: string- The description of the memory record\par Address: string - Get/set the interpretable address string. Useful for simple address settings.\par OffsetCount: integer - The number of offsets. Set to 0 for a normal address\par Offset[] : integer - Array to access each offset\par CurrentAddress: integer - The address the memoryrecord points to\par Type: ValueType - The variable type of this record. See vtByte to vtCustom\par If the type is vtString then the following properties are available:\par String.Size: Number of characters in the string\par String.Unicode: boolean\par\par If the type is vtBinary then the following properties are available\par Binary.Startbit: First bit to start reading from\par Binary.Size : Number of bits\par\par If the type is vtByteArray then the following properties are available\par Aob.Size : Number of bytes\par\par CustomTypeName: String - If the type is vtCustomType this will contain the name of the CustomType\par Script: String - If the type is vtAutoAssembler this will contain the auto assembler script\par Value: string - The value in stringform.\par Selected: boolean - Set to true if selected (ReadOnly)\par Active: boolean - Set to true to activate/freeze, false to deactivate/unfreeze\par Color: integer\par ShowAsHex: boolean - Self explanatory\par ShowAsSigned: boolean - Self explanatory\par AllowIncrease: boolean - Allow value increasing, unfreeze will reset it to false\par AllowDecrease: boolean - Allow value decreasing, unfreeze will reset it to false\par\par Count: Number of children\par Child[index] : Array to access the child records\par [index] = Child[index]\par\par HotkeyCount: integer - Number of hotkeys attached to this memory record\par Hotkey[] : Array to index the hotkeys\par\par OnActivate: function(memoryrecord,before,currentstate):boolean - The function to call when the memoryrecord will change (or changed) Active to true. If before is \par true, not returning true will cause the activation to stop.\par OnDeactivate: function(memoryrecord,before,currentstate):boolean - The function to call when the memoryrecord will change (or changed) Active to false. If before \par is true, not returning true will cause the deactivation to stop.\par OnDestroy: function() - Called when the memoryrecord is destroyed.\par DontSave: boolean - Don't save this memoryrecord and it's children\par\par methods\par getDescription()\par setDescription()\par getAddress() : Returns the interpretable addressstring of this record. If it is a pointer, it returns a second result as a table filled with the offsets\par setAddress(string) : Sets the interpretable address string, and if offsets are provided make it a pointer\par\par getOffsetCount(): Returns the number of offsets for this memoryrecord\par setOffsetCount(integer): Lets you set the number of offsets\par\par getOffset(index) : Gets the offset at the given index\par setOffset(index, value) : Sets the offset at the given index\par\par getCurrentAddress(): Returns the current address as an integer (the final result of the interpretable address and pointer offsets)\par\par appendToEntry(memrec): Appends the current memory record to the given memory record\par\par getHotkey(index): Returns the hotkey from the hotkey array\par getHotkeyByID(integer): Returns the hotkey with the given id\par\par\par Addresslist Class: (Inheritance: Panel->WinControl->Control->Component->Object)\par properties\par Count: Integer - The number of records in the table\par SelCount: integer- The number of records that are selected\par SelectedRecord: MemoryRecord - The main selected record\par MemoryRecord[]: MemoryRecord - Array to access the individial memory records\par [] = MemoryRecord - Default accessor\par\par methods\par getCount()\par getMemoryRecord(index)\par getMemoryRecordByDescription(description): returns a MemoryRecord object\par getMemoryRecordByID(ID)\par createMemoryRecord() : creates an generic cheat table entry and add it to the list\par\par getSelectedRecords(): Returns a table containing all the selected records\par\par doDescriptionChange() : Will show the GUI window to change the description of the selected entry\par doAddressChange() : Will show the GUI window to change the address of the selected entry\par doTypeChange() : Will show the GUI window to change the type of the selected entries\par doValueChange() : Will show the GUI window to change the value of the selected entries\par\par getSelectedRecord() : Gets the main selected memoryrecord\par setSelectedRecord(memrec) : Sets the currently selected memoryrecord. This will unselect all other entries\par\par\par\par\par MemScan Class (Inheritance: Object)\par getCurrentMemscan() : Returns the current memory scan object. If tabs are used the current tab's memscan object\par createMemScan(progressbar OPTIONAL) : Returns a new MemScan class object\par\par properties\par OnScanDone: function(memscan) - Set a function to be called when the scan has finished\par FoundList: FoundList - The foundlist currently attached to this memscan object\par OnlyOneResult: boolean - If this is set to true memscan will stop scanning after having found the first result, and written the address to "Result"\par Result: Integer - If OnlyOneResult is used this will contain the address after a scan has finished\par\par\par methods\par\par firstScan(scanoption, vartype, roundingtype, input1, input2 ,startAddress ,stopAddress ,protectionflags ,alignmenttype ,"alignmentparam" ,isHexadecimalInput \par ,isNotABinaryString, isunicodescan, iscasesensitive);\par Does an initial scan.\par memscan: The MemScan object created with createMemScan\par scanOption: Defines what type of scan is done. Valid values for firstscan are:\par soUnknownValue: Unknown initial value scan\par soExactValue: Exact Value scan\par soValueBetween: Value between scan\par soBiggerThan: Bigger than ... scan\par soSmallerThan: smaller than ... scan\par\par vartype: Defines the variable type. Valid variable types are:\par vtByte\par vtWord 2 bytes\par vtDword 4 bytes\par vtQword 8 bytes\par vtSingle float\par vtDouble\par vtString\par vtByteArray\par vtGrouped\par vtBinary\par vtAll\par\par roundingtype: Defined the way scans for exact value floating points are handled\par rtRounded : Normal rounded scans. If exact value = "3" then it includes 3.0 to 3.49999999. If exact value is "3.")(*!0" it includes 3.00 to 3.0499999999\par rtTruncated: Truncated algorithm. If exact value = "3" then it includes 3.0 to 3.99999999. If exact value is "3.0" it includes 3.00 to 3.099999999\par rtExtremerounded: Rounded Extreme. If exact value = "3" then it includes 2.0000001 to 3.99999999. If exact value is "3.0" it includes 2.900000001 to \par 3.099999999\par\par input1: If required by the scanoption this is a string of the given variable type\par input2: If requires by the scanoption this is the secondary input\par\par startAddress : The start address to scan from. You want to set this to 0\par stopAddress : The address the scan should stop at. (You want to set this to 0xffffffffffffffff)\par\par protectionflags : See aobscan about protectionflags\par alignmenttype : Scan alignment type. Valid options are:\par fsmNotAligned : No alignment check\par fsmAligned : The address must be dividable by the value in alignmentparam\par fsmLastDigits : The last digits of the address must end with the digits provided by alignmentparam\par\par alignmentparam : String that holds the alignment parameter.\par\par isHexadecimalInput: When true this will handle the input field as a hexadecimal string else decimal\par isNotABinaryString: When true and the varType is vtBinary this will handle the input field as a decimal instead of a binary string\par isunicodescan: When true and the vartype is vtString this will do a unicode (utf16) string scan else normal utf8 string\par iscasesensitive : When true and the vartype is vtString this check if the case matches\par\par\par\par\par nextScan(scanoption, roundingtype, input1,input2, isHexadecimalInput, isNotABinaryString, isunicodescan, iscasesensitive, ispercentagescan, savedresultname \par OPTIONAL);\par Does a next scan based on the current addresslist and values of the previous scan or values of a saved scan\par memscan: The MemScan object that has previously done a first scan\par scanoption:\par soExactValue: Exact Value scan\par soValueBetween: Value between scan\par soBiggerThan: Bigger than ... scan\par soSmallerThan: smaller than ... scan\par soIncreasedValue: Increased value scan\par soIncreasedValueBy: Increased value by scan\par soDecreasedValue: Decreased value scan\par soDecreasedValueBy: Decreased value by scan\par soChanged: Changed value scan\par soUnchanged: Unchanged value scan\par\par roundingtype: Defined the way scans for exact value floating points are handled\par rtRounded : Normal rounded scans. If exact value = "3" then it includes 3.0 to 3.49999999. If exact value is "3.0" it includes 3.00 to 3.0499999999\par rtTruncated: Truncated algoritm. If exact value = "3" then it includes 3.0 to 3.99999999. If exact value is "3.0" it includes 3.00 to 3.099999999\par rtExtremerounded: Rounded Extreme. If exact value = "3" then it includes 2.0000001 to 3.99999999. If exact value is "3.0" it includes 2.900000001 to \par 3.099999999\par\par input1: If required by the scanoption this is a string of the given variable type\par input2: If requires by the scanoption this is the secondary input\par\par isHexadecimalInput: When true this will handle the input field as a hexadecimal string else decimal\par isNotABinaryString: When true and the varType is vtBinary this will handle the input field as a decimal instead of a binary string\par isunicodescan: When true and the vartype is vtString this will do a unicode (utf16) string scan else normal utf8 string\par iscasesensitive : When true and the vartype is vtString this check if the case matches\par ispercentage: When true and the scanoption is of type soValueBetween, soIncreasedValueBy or soDecreasedValueBy will cause CE to do a precentage scan instead of \par a normal value scan\par savedResultName: String that holds the name of a saved result list that should be compared against. First scan is called "FIRST"\par\par newScan() : Clears the current results\par waitTillDone() : Waits for the memscan thread(s) to finish scanning. Always use this\par saveCurrentResults(name) : Save the current scanresults to a unique name for this memscan. This save can be used to compare against in a subsequent next scan\par getAttachedFoundlist() : Returns a FoundList object if one is attached to this scanresults. Returns nil otherwise\par\par\par setOnlyOneResult(state): If set to true before you start a scan, this will cause the scanner to only return one result. Note that it does not work with a \par foundlist\par getOnlyResult(): Only works if returnOnlyOneResult is true. Returns nil if not found, else returns the address that was found (integer)\par\par\par\par FoundList\par The foundlist is an object that opens the current memscan's result file and provides an interface for reading out the addresses\par\par createFoundList(memscan)\par\par properties\par Count: integer;\par Address[index]\par Value[index]\par\par methods\par initialize() : Call this when a memscan has finished scanning. This will open the results for reading\par deinitialize() : Release the results\par getCount()\par getAddress(index) : Returns the address as a string\par getValue(index) : Returs the value as a string\par\par\par Memoryview class: (Inheritance: Form->ScrollingWinControl->CustomControl->WinControl->Control->Component->Object)\par createMemoryView() - Creates a new memoryview window. This window will not receive debug events. Use getMemoryViewForm() function to get the main memoryview window\par properties\par DisassemblerView: The disassemblerview class of this memoryview object\par HexadecimalView: The hexadecimalview class of this memoryview object\par methods\par -\par\par DisassemblerviewLine class: (Inheritance: Object)\par properties\par Address: The current address of this line\par Owner: The Disassemblerview that owns this line\par\par methods\par -\par\par Disassemblerview class: (Inheritance: Panel->CustomControl->WinControl->Control->Component->Object)\par The visual disassembler used on the memory view window\par properties\par SelectedAddress: integer - The currently selected address in the disassemblerview\par SelectedAddress2: integer - The secondary selected address in the disassemblerview\par TopAddress: Integer - The first address to show\par ShowJumplines: boolean - Determines if the jumplines should be shown\par OnSelectionChange: function(sender, address, address2) - Function to call when the selection has changed\par OnExtraLineRender: function(sender, Address, AboveInstruction, Selected): RasterImage OPTIONAL, x OPTIONAL, y OPTIONAL\par Function to call when you wish to provide the disassembler view with an extra image containing data you wish to show.\par This function is called once to get an image to show above the instruction, and once to get an image to show under the instruction and optional comments.\par The image for both calls must be different objects as rendering will only be done when both calls have been completed\par\par Sender is a DisassemblerviewLine object\par If no coordinates are given the image will be centered above/below the instruction\par\par\par methods\par -\par\par\par Hexadecimal class: (Inheritance: Panel->CustomControl->WinControl->Control->Component->Object)\par The visual hexadecimal object used on the memory view window\par properties\par OnAddressChange(hexadecimalview, function): function(hexadecimalview, address)\par OnByteSelect(hexadecimalview, function): function(hexadecimalview, address, address2)\par\par methods\par -\par\par\par Thread Class: (Inheritance: Object)\par createNativeThread(function(Thread,...), ...) :\par Executes the given function in another thread using the systems thread mechanism\par The function returns the Thread class object\par function declaration: function (Thread, ...)\par\par properties\par name: string - This"*)+" name will be shown when the thread terminated abnormally\par\par methods\par freeOnTerminate(state) :\par When set to true the thread object will free itself when the function ends (default=true)\par Note: Use this only from inside the thread function as the thread might have already terminated and freed itself when called\par\par synchronize(function(thread, ...), ...) :\par Called from inside the thread. This wil cause the tread to get the main thread to execute the given function and wait for it to finish.\par Usually for GUI access\par Returns the return value of the given function\par\par waitfor() :\par Waits for the given thread to finish (Not recommended to call this from inside the thread itself)\par\par\par\par StructureFrm class:\par createStructureForm(address)\par properties:\par Column[index]: structColumn - Fetches a structColumn object from the structure form\par Group[index]: structGroup - Fetches a structGroup object from the structure form\par\par methods:\par structChange() : Forces a refresh\par addColumn(): Adds a new column in the currently focuses group and returns it's structColumn object\par addGroup(): Adds a new group and returns the structGroup object\par\par structColumn class:\par properties:\par Address: integer - The current address\par AddressText: string - Gets/sets the visual address\par Focused: boolean - Gets/sets the focused state \par\par methods:\par focus(): focuses the current column\par\par\par structGroup class:\par properties:\par name: string - gets the current name\par box: Groupbox - Gets the groupbox object\par columnCount: integer- Gets the number of columns in the group\par columns[index]: structColumn - Returns the specific structColumn object\par\par\par methods:\par addColumns(): Adds a new columns to the specific group and returns it's structColumn objecy\par\par\par\par\par Structure class related functions:\par getStructureCount(): Returns the number of Global structures. (Global structures are the visible structures)\par getStructure(index): Returns the Structure object at the given index\par createStructure(name): Returns an empty structure object (Not yet added to the Global list. Call structure.addToGlobalStructureList manually)\par\par\par\par structure class: (Inheritance: Object)\par Properties:\par Name: String - The name of the structure\par Size: Integer - The number of bytes between the last element and the start. ReadOnly\par Count: Integer - Number of elements in the structure. ReadOnly\par Element[]: structureElement - Returns the structure element at the given index. Readonly\par Methods:\par getName(): Returns the name\par setName(name): Sets the name\par getElement(index): Returns a structureElement object (Changing offsets can change the index)\par getElementByOffset(offset): Returns a structureElement object where the specified offset is at least the requested offset\par addElement(): Adds a new blank structureElement and returns it\par autoGuess(baseaddresstoguessfrom, offset, size)\par fillFromDotNetAddress(address, changeName): Fills the structure with the layout gathered from querying .NET. If changeName is true, the structure will take the \par name of the .NET class. (6.4+)\par\par beginUpdate(): Call this when you want to make multiple updates to a structure. It will speed up the update process\par endUpdate(): Call this when done\par addToGlobalStructureList(): Add this to the list of structures for the user to select from. (Global structures will get saved to the table)\par removeFromGlobalStructureList(): Remove from the list of structures.\par\par\par StructureElement class: (Inheritance: Object)\par Properties:\par Owner: structure - The structure this element belongs to. Readonly\par Offset: integer - The offset of this element\par Name: string - The name of this element\par Vartype: integer - The variable type of this element\par ChildStruct: structure - If not nil this element is a pointer to the structure defined here\par ChildStructStart: integer - The number of bytes inside the provided childstruct. (E.g: It might point to offset 10 of a certain structure)\par Bytesize: integer - The number of bytes of this element. Readonly for basic types, writable for types that require a defined length like strings and array of \par bytes\par\par Methods:\par getOwnerStructure(): Returns the structure this element belongs to\par getOffset(): Returns the offset of this element\par setOffset(offset): Sets the offset of this element\par getName(): Returns the name of this element\par setName(name): Sets the name of this element (tip: Leave blank if you only want to set the name of the variable)\par getVartype(): Returns the variable type of this element (check Variable types in defines.lua)\par setVartype(vartype)\par getChildStruct()\par setChildStruct(structure)\par getChildStructStart()\par setChildStructStart(offset)\par getBytesize(): Gets the bytesize of the element. Usually returns the size of the type, except for string and aob\par setBytesize(size): sets the bytesize for types that are affected (string, aob)\par\par\par\par\par\par supportCheatEngine(attachwindow, hasclosebutton, width, height, position ,yoururl OPTIONAL, extraparameters OPTIONAL, percentageshown OPTIONAL):\par Will show an advertising window which will help keep the development of Cheat Engine going.\par If you provide your own url it will be shown Up to 75% of the time.\par\par attachwindow: Type=Form : The form that the ad is attached to\par hasclosebutton: Type=boolean : If true the window will have a border an a close button at top\par width, height: Type=integer :\par The client width and height of the window.\par Prefered formats are : 120x600 , 160x600, 300x250, 468x60, 728x90 ,But you are free to use different formats\par\par Position: Type=integer/enum: The place of the window\par 0=Top, 1=Right, 2=Bottom, 3=left\par\par Yoururl: Type=string: The url you want to show. When given instead of showing CE's ads 100% it will show your url up to 75%.\par You can use it for your own income, or for updating users about new versions of your trainer or whatever you feel like\par\par Extraparameters: Type=String : are url request parameters you can add to the default parameters (e.g trainername=mytrainer for tracking purposes)\par\par PercentageShown: You can change the default of 75% to a smaller value like 50%\par\par\par fuckCheatEngine() : Removes the ad window if it was showing\par\par\par Following are some more internal functions for Cheat Engine\par\par dbk_initialize() : Returns true if the dbk driver is loaded in memory. False if it failed for whatever reason (e.g 64-bit and not booted with unsigned driver \par support)\par dbk_useKernelmodeOpenProcess() : Switches the internal pointer of the OpenProcess api to dbk_OpenProcess\par dbk_useKernelmodeProcessMemoryAccess() : Switches the internal pointer to the ReadProcessMemory and WriteProcessMemory apis to dbk_ReadProcessMemory and \par dbk_WriteProcessMemory\par dbk_useKernelmodeQueryMemoryRegions() : Switches the internal pointer to the QueryVirtualMemory api to dbk_QueryVirtualMemory\par dbk_getPEProcess(processid) : Returns the pointer of the EProcess structure of the selected processid\par dbk_getPEThread(threadid) : Gets the pointer to the EThread structure\par\par dbk_readMSR(msr): Reads the msr\par dbk_writeMSR(msr, msrvalue): Writes the msr\par dbk_executeKernelMemory(address, parameter) :\par Executes a routine from kernelmode (e.g a routine written there with auto assembler)\par parameter can be a value or an address. It's up to your code how it's handled\par\par\par dbvm_initialize(offloados OPTIONAL) : Initializes the dbvm functions (dbk_initialize also calls this) offloados is a boolean that when set will offload the system \par onto dbvm if it's not yet running (and only IF the dbk driver is loaded)\par dbvm_readMSR(msr): See dbk_readMSR\par dbvm_writeMSR(msr, value): See dbk_"+*,#writeMSR\par\par\par dbk_getCR0(): Returns Control Register 0\par dbk_getCR3(): Returns Control Register 3 of the currently opened process\par dbk_getCR4(): Returns Control Register 4\par dbk_getPhysicalAddress(address): Returns the physical address of the given address\par dbk_writesIgnoreWriteProtection(state): Set to true if you do not wish to initiate copy-on-write behaviour\par\par dbvm_getCR4(): Returns the real Control Register 4 state\par\par\par onAPIPointerChange(function): Registers a callback when an api pointer is changed (can happen when the user clicks ok in settings, or when dbk_use*** is used. Does \par NOT happen when setAPIPointer is called)\par\par\par setAPIPointer(functionid, address): Sets the pointer of the given api to the given address. The address can be a predefined address set at initialization by Cheat \par Engine, or an address you got from an autoassembler script or injected dll (When Cheat Engine itself was targeted)\par\par functionid:\par 0: OpenProcess\par Known compatible address defines:\par windows_OpenProcess\par dbk_OpenProcess\par\par 1: ReadProcessMemory\par Known compatible address defines:\par windows_ReadProcessMemory\par dbk_ReadProcessMemory\par dbk_ReadPhysicalMemory\par dbvm_ReadPhysicalMemory\par\par 2: WriteProcessMemory\par Known compatible address defines:\par windows_WriteProcessMemory\par dbk_WriteProcessMemory\par dbk_WritePhysicalMemory\par dbvm_WritePhysicalMemory\par\par\par 3: VirtualQueryEx\par Known compatible address defines:\par windows_VirtualQueryEx\par dbk_VirtualQueryEx\par VirtualQueryExPhysical\par\par Extra variables defined:\par dbk_NtOpenProcess : Address of the NtOpenProcess implementation in DBK32\par\par\par The dbvm_ addresses should only be used with auto assembler scripts injected into Cheat Engine\par dbvm_block_interrupts : Address of function dbvm_block_interrupts : DWORD; stdcall;\par dbvm_raise_privilege : Address of function dbvm_raise_privilege : DWORD; stdcall;\par dbvm_restore_interrupts: Address of function dbvm_restore_interrupts : DWORD; stdcall;\par dbvm_changeselectors : Address of function dbvm_changeselectors(cs,ss,ds,es,fs,gs: dword): DWORD; stdcall;\par\par\par D3DHOOK class:\par The d3dhook functions provide a method to render graphics and text inside the game, as long as it is running in directx9, 10 or 11\par\par createD3DHook(textureandcommandlistsize OPTIONAL, hookmessages OPTIONAL)\par Hooks direct3d and allocates a buffer with given size for storage of for the rendercommand list\par\par hookmessages defines if you want to hook the windows message handler for the direct3d window. The d3dhook_onClick function makes use of that\par\par\par If no size is provided 16MB is used and hookmessages is true\par\par Note: You can call this only once for a process\par\par It returns a d3dhook object\par\par properties\par Width: Integer : The width of the screen (readonly)\par Height: integer: The height of the screen (readonly)\par DisabledZBuffer: boolean : Set this to true if you don't want previously rendered walls to overlap a newly rendered object (e.g map is rendered first, then the \par players are rendered)\par WireframeMode: boolean : Set this to true if you don't want the faces of 3d objects to be filled\par MouseClip: boolean : Set this if to true if you have one of those games where your mouse can go outside of the gamewindow and you don't want that.\par OnClick: function(d3dhook_sprite, x, y)\par A function to be called when clicked on an sprite (excluding the mouse)\par x and y are coordinates in the sprite object. If sprites overlap the highest zorder sprite will be given. It does NOT care if a transparent part is clicked or \par not\par\par Note: If you set this it can cause a slowdown in the game if there are a lot of sprites and you press the left button a lot\par\par OnKeyDown: function(virtualkey, char)\par function(vkey, char) : boolean\par A function to be called when a key is pressed in the game window (Not compatible with DirectInput8)\par Return false if you do not wish this key event to pass down to the game\par\par\par methods\par beginUpdate() : Use this function when you intent to update multiple sprites,textcontainers or textures. Otherwise artifacts may occur (sprite 1 might be drawn at \par the new location while sprite 2 might still be at the old location when a frame is rendered)\par endUpdate() : When done updating, call this function to apply the changes\par enableConsole(virtualkey): Adds a (lua)console to the specific game. The given key will bring it up (0xc0=tilde)\par createTexture(filename) : Returns a d3dhook_texture object\par createTexture(picture, transparentColor OPTIONAL): Returns a d3dhook_texture object\par if the picture is not a transparent image the transparentcolor parameter can be used to make one of it's colors transparent\par\par createFontmap(font) : Returns a d3dhook_fontmap object created from the given font\par createSprite(d3dhook_texture): returns a d3dhook_sprite object that uses the given texture for rendering\par createTextContainer(d3dhook_fontmap, x, y, text): Returns a d3dhook_textContainer object\par\par\par D3DHook_Texture Class (Inheritance: Object)\par This class controls the texture in memory. Without a sprite to use it, it won't show\par\par properties\par Height: integer (ReadOnly)\par Width: integer (ReadOnly)\par methods\par loadTextureByPicture(picture)\par\par\par\par D3DHook_FontMap Class (Inheritance: D3DHook_Texture->Object)\par A fontmap is a texture that contains extra data regarding the characters. This class is used by the textcontainer\par Current implementation only supports 96 characters (character 32 to 127)\par\par properties\par -\par methods\par changeFont(font): Changes the fontmap to the selected font\par getTextWidth(string): Returns the width of the given string in pixels\par\par\par D3DHook_RenderObject Class (Inheritance: Object)\par The renderobject is the abstract class used to control in what manner objects are rendered.\par The sprite and TextContainer classed inherit from this\par\par properties\par X: Float - The x-coordinate of the object on the screen\par Y: Float - The y-coordinate of the object on the screen\par CenterX: Float - X coordinate inside the object. It defines the rotation spot and affects the X position\par CenterY: Float - Y " "\par Rotation: Float - Rotation value in degrees (0 and 360 are the same)\par Alphablend: Float - Alphablend value. 1.0 is fully visible, 0.0=invisible\par Visible: boolean - Set to false to hide the object\par ZOrder: integer - Determines if the object will be shown in front or behind another object\par methods\par -\par\par\par\par D3DHook_Sprite Class (Inheritance: D3DHook_RenderObject->Object)\par A d3dhook_sprite class is a visible texture on the screen.\par\par\par properties\par Width: Integer - The width of the sprite in pixels. Default is the initial texture width\par Height: Integer - The height of the sprite in pixels. Default is the initial texture height\par Texture: d3dhook_texture - The texture to show on the screen\par\par methods\par -\par\par\par D3Dhook_TextContainer Class (Inheritance: D3DHook_RenderObject->Object)\par A d3dhook_sprite class draws a piece of text on the screen based on the used fontmap.\par While you could use a texture with the text, updating a texture in memory is slow. So if you wish to do a lot of text updates, use a textcontainer\par\par properties\par FontMap : The D3DHook_FontMap object to use for rendering text\par Text : The text to render\par methods\par -\par\par\par\par\par Disassembler Class (Inheritance: Object)\par\par\par\par createDisassembler() - Creates a disassembler object that can be used to disassemble an instruction and at the same time get more data\par getDefaultDisassembler() - Returns the default disassembler object used by ",+-$a lot of ce's disassembler routines\par getVisibleDisassembler() - Returns the disassembler used by the disassemblerview. Special codes are: \{H\}=Hex value \{R\}=Register \{S\}=Symbol \{N\}=Nothing special\par\par registerGlobalDisassembleOverride(function(sender: Disassembler, address: integer, LastDisassembleData: Table): opcode, description): Same as \par Disassembler.OnDisassembleOverride, but does it for all disassemblers, including newly created ones. Tip: Check the sender to see if you should use syntax \par highlighting codes or not\par This function returns an ID you can pass on to unregisterGlobalDisassembleOverride() 6.4+\par\par unregisterGlobalDisassembleOverride(id)\par\par properties\par LastDisassembleData : Table\par OnDisassembleOverride: function(sender: Disassembler, address: integer, LastDisassembleData: Table): opcode, description\par syntaxhighlighting: boolean : This property is set if the syntax highlighting codes are accepted or not\par\par Methods\par disassemble(address): Disassembles the given instruction and returns the opcode. It also fills in a LastDisassembleData record\par decodeLastParametersToString() : Returns the unedited "Comments" information. Does not display userdefined comments\par getLastDisassembleData() : Returns the LastDisassembleData table.\par The table is build-up as follow:\par address: integer - The address that was disassembled\par opcode: string - The opcode without parameters\par parameters: string - The parameters\par description: string - The description of this opcode\par bytes: table - A table containing the bytes this instruction consists of (1.. )\par\par modrmValueType: DisAssemblerValueType - Defines the type of the modrmValue field (dvtNone=0, dvtAddress=1, dvtValue=2)\par modrmValue: Integer - The value that the modrm specified. modrmValueType defines what kind of value\par\par parameterValueType: DisAssemblerValueType\par parameterValue: Integer - The value that the parameter part specified\par\par isJump: boolean - Set to true if the disassembled instruction can change the EIP/RIP (not ret)\par isCall: boolean - Set to true if it's a Call\par isRet: boolean - Set to true if it's a Ret\par isConditionalJump: boolean - Set to true if it's a conditional jump\par\par\par\par DissectCode class: (Inheritance: Object)\par getDissectCode() : Creates or returns the current code DissectCode object\par\par properties:\par methods:\par clear() : Clears all data\par dissect(modulename) : Dissects the memory of a module\par dissect(base,size) : Dissect the specified memory region\par\par addReference(fromAddress, ToAddress, type, OPTIONAL isstring):\par Adds a reference. Type can be jtCall, jtUnconditional, jtConditional, jtMemory\par In case of jtMemory setting isstring to true will add it to the referenced strings list\par\par deleteReference(fromAddress, ToAddress)\par\par\par getReferences(address) : Returns a table containing the addresses that reference this address and the type\par getReferencedStrings(): Returns a table of addresses and their strings that have been referenced. Use getReferences to find out which addresses that are\par getReferencedFunctions(): Returns a table of functions that have been referenced. Use getReferences to find out which callers that are\par\par saveToFile(filename)\par loadFromFile(filename)\par\par RIPRelativeScanner class: (Inheritance: Object)\par createRipRelativeScanner(modulename): Creates a RIP relative scanner. This will scan the provided module for RIP relative instructions which you can use for \par whatever you like\par properties:\par Count: integer - The number of instructions found that have a RIP relative address\par Address[]: integer - An array to access the results. The address is the address of the RIP relative offset in the instruction\par\par methods:\par -\par \par\par\par\par LuaPipe class: (Inheritance: Object)\par Abstract class that LuaPipeServer and LuaPipeclient inherit from. It implements the data transmission methods\par\par properties\par Connected: boolean: True if the pipe is connected\par\par methods\par lock() : Acquire a lick on this pipe till unlock is called. If lock can not be acquired, wait. Recursive calls are allowed\par unlock()\par writeBytes(ByteTable, size OPTIONAL): Writes the provided byte table to the pipe. if size is not provided, the whole table is sent. Returns the number of bytes \par sent, or nil on failure\par readBytes(size: integer): returns a byte table from the pipe, or nil on failure\par\par readDouble(): Read a double from the pipe, nil on failure\par readFloat(): Read a float from the pipe, nil on failure\par readQword(): Read an 8 byte value from the pipe, nil on failure\par readDword(): Read a 4 byte value from the pipe, nil on failure\par readWord(): Read a 2 byte value from the pipe, nil on failure\par readByte(): Read a byte from the pipe, nil on failure\par\par readString(size: integer): Reads a string from the pipe, nil on failure. (Can support 0-byte chars)\par readWideString(size: integer): Reads a widestring from the pipe, nil on failure\par\par writeDouble(v: double): Writes a double to the pipe. Returns the number of bytes sent, nil on failure\par writeFloat(v: single): writes a float to the pipe. Returns the number of bytes sent, nil on failure\par writeQword(v: qword): writes an 8 byte value to the pipe. Returns the number of bytes sent, nil on failure\par writeDword(v: dword): writes a 4 byte value to the pipe. Returns the number of bytes sent, nil on failure\par writeWord(v: word): writes a word to the pipe. Returns the number of bytes sent, nil on failure\par writeByte(v: byte): writes a byte to the pipe. Returns the number of bytes sent, nil on failure\par\par writeString(str: string; include0terminator: boolean OPTIONAL); Writes a string to the pipe. If include0terminator is false or not provided it will not write the \par 0 terminator byte. Returns the number of bytes written, or nil on failure\par writeWideString(str: widestring; include0terminator: boolean OPTIONAL); Writes a widestring to the pipe. If include0terminator is false or not provided it will \par not write the 0 terminator bytes. Returns the number of bytes written, or nil on failure\par\par LuaPipeClient class: (Inheritance: LuaPipe>Object)\par Class implementing a client that connects to a pipe\par\par connectToPipe(pipename): Returns a LuaPipeClient connected to the given pipename. Nil if the connection fails\par\par properties:\par methods:\par -\par\par LuaPipeServer Class: (Inheritance: LuaPipe>Object)\par Class launching the server side of a pipe\par\par createPipe(pipename, inputsize OPTIONAL, outputsize OPTIONAL) : Creates a LuaPipeServer which can be connected to by a pipe client. InputSize and Outputsize define \par buffers how much data can be in the specific buffer before the writer halts. Default input and output size is 4096 for both\par\par properties\par valid: boolean - Returns true if the pipe has been created properly. False on failure (e.g wrong pipename)\par\par methods\par acceptConnection() - Waits for a client to connect to this pipe (Warning: Freezes the thread this is executed in)\par\par\par\par openLuaServer(Name):\par Opens a pipe with the given name. The LuaClient dll needs this name to connect to ce\par\par\par LuaClient.dll functions:\par BOOL CELUA_Initialize(char *name) : Initializes\par UINT_PTR CELUA_ExecuteFunction(char *luacode, UINT_PTR parameter)\par This function executes a lua function with parameters (parameter) and with the luacode as body Parameter will be treated as an integer\par In short:\par function(parameter)\par \par end\par\par\par the return value of this function is the return value of the lua function (integer)\par\par\par Settings class\par This class can be used to read out and set settings of cheat engin"-,.%e and of plugins, and store your own data\par\par global functions\par getSettings(path Optional): Settings - Returns a settings object. If path is nil it will points to the Cheat Engine main settings (Registry) . If name is provides \par the settings currently accessed will be the one at the subkey provided\par Note: Keep in mind that it returns a new object each call, even if he same name is used multiple times\par\par\par properties\par Path: string - Gets/Sets the current subkey (nil if main)\par Value[]: A table access into the settings. e.g: Value["Count"]=12\par\par methods\par\par\par\par\par SymbolList class\par This class can be used to look up an address to a symbolname, and a symbolname to an address\par It can also be registered with the internal symbol handler of cheat engine\par\par This class makes use of a special "Symbol" table construction that contains size and optionally other data\par Symbol Table:\par modulename: string\par searchkey: string\par address: integer\par symbolsize: integer\par\par Global functions\par createSymbolList() : Creates an empty symbollist\par\par\par\par\par Properties\par Methods\par clear()\par getSymbolFromAddress(address) : Searches the list for the given address. The address does not have to match the exact address. As long as it falls withing the \par range\par getSymbolFromString(searchkey)\par addSymbol(modulename, searchkey, address, symbolsize, skipAddressToSymbolLookup OPTIONAL, extradata OPTIONAL)\par Adds a symbol to the symbollist\par extradata is a table which can be used to fill in a return type and parameters for function calls. It has the following fields:\par returntype: string\par parameters: string\par\par\par\par deleteSymbol(searchkey)\par deleteSymbol(address)\par register() : Registers the current symbol list with the symbol handler\par unregister(): Unregisters the current symbol list from the symbol handler\par\par\par Pagecontrol Class (WinControl->Control->Component->Object)\par This is an object that can hold multiple pages\par\par global functions\par createPageControl(owner)\par properties\par ShowTabs: boolean - Shows the tabs\par TabIndex: integer - Gets and sets the current tab\par ActivePage: TabSheet - Returns the current tabsheet.\par PageCount: integer - Gets the number of pages\par Page[]: TabSheet - Get a specific page (TabSheet)\par methods\par addTab() : TabSheet - Creates a new TabSheet\par\par TabSheet class (WinControl->Control->Component->Object)\par Part of a page control. This object can contain other objects\par properties\par TabIndex: integer - the current index in the pagelist of the owning pagecontrol\par methods\par\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\fs24\b Script engine\cf2\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par} N1DebuggingDateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 CT1=0 CT2=0 CT3=0 CT4=0 CT5=0 CT6=0 CT7=0 CT8=0 CT9=0 CX1=0 CX2=0 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=0 sel=0 sBook=11/05/2011 19:39 sBookPage=11/05/2011 19:39{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} N1bFind out what addresses this instruction accessesbfind-out-what-addresses-this-instruction-accessesbfind-out-what-addresses-this-instruction-accesses&HelpMacro=1090 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=16 Y1=48 X2=0 Y2=0 sChange=Under Construction sBook=01/01/2011 01:36 sBookPage=01/01/2011 01:36 sIcon=10 exp=0 sel=0J{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 This option will set a breakpoint on the code and open a new window. You will see every address that is accessed by the code when the program is running.\par\par The address field contains the address which is accessed by the code. The value field i".-/&s containing the value of the address at the moment. You can choose the displayed value type from the dropdown menu. The count number shows how many times did the code access to that address.\par\par Right-clicking on an address will offer some new options.\par Show register states: This will show the value of the registers that were logged when the address has been accessed by the code the first time. In the register window, you can click on F to see the FPU registers and S to see a snapshot from the stack.\par\par Browse this memory region will open the memory view at the address and Show as hexadecimal will display the value in hexadecimal.\par\par You can stop the debugger with the Stop button. \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Find out what addresses this instruction accesses\par} N1TFind out what writes/accesses this addressRfind-out-what-writesaccesses-this-addressRfind-out-what-writesaccesses-this-address&HelpMacro=1091 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=16 Y1=48 X2=0 Y2=0 sChange=Under Construction sBook=01/01/2011 01:39 sBookPage=01/01/2011 01:39 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 This option will set a breakpoint on the address and open a new window. You will see every instructions that are accessing to the address while the program is running.\par\par You can see a counter to display how many times has the instruction accessed to the address and you can see the instruction.\par\par The following options are available for the selected instruction.\par Replace: Replace the code with NOPs and also add it to the code list.\par\par Show disassembler: Open the disassembler and jump to the code.\par\par Add to the code list: Add the selected addresses to the code list.\par\par More information: Show the code along with the register values that were logged after the code has accessed to the address. You can open the FPU window with F and the Stack View with S.\par\par You can stop the debugger with the Stop button. \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Find out what writes/accesses this address\par} N1Dissect codedissect-codedissect-code$HelpMacro=1092 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=85 X2=0 Y2=0 sChange=Under Construction sBook=01/01/2011 01:40 sBookPage=01/01/2011 01:40 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 This simple option will analyze the code of the target process and place useful information in the disassembler view. When you see a code, it will be displayed if the code is a destination for call or jump instructions. Of course it will also display the source of the call or jump. \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Dissect code\par} N1.Dissect data/structures,dissect-datastructures,dissect-datastructures&HelpMacro=1093 HW=Main"/.0' CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=01/01/2011 DateModified=01/01/2011 DateReview=01/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=27 Y1=78 X2=0 Y2=0 sChange=Under Construction sBook=01/01/2011 01:41 sBookPage=13/06/2013 11:04 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 This option is a fine tool to examine or compare data in similar memory regions or structures. It can be used if you wish to compare your charachter's structure with the enemy's structure in an FPS or strategy game, but of course it can be used for other purposes too.\par\par File->New window: This option will open a new dissect window.\par File->Import: Import a structure.\par File->Export: Export a structure.\par File->Save values: Save the content of the window in a file.\par File->Add extra address: Add a slot for an extra address for comparing.\par\par View->Change colors: Customize the colors of this tool.\par View->Update interval: Customize the value update interval.\par\par Structures: Create a new structure with Define new structure, then give a name and a size for the structure. If you have more than one structure, you can choose the one that you need from here.\par\par Commands: Rename and Delete structure will rename and delete the currently used structure.\par Automatically guess offset types will allow CE to guess the type of values in the structure.\par\par If you have added one or more addresses to the window, you can right-click on an address and sort them into groups. This is very useful because you can compare the values in every structure and also see if the values are the same in the same group, or they are different inside the group too (e.g. you can add 2 enemy unit and 2 friendly unit in an RTS game and place the enemies in a different group, thus you will see what is common between friendly units and what is common between enemy units)\par\par If you right-click on an entry in the window, some additional options will be available, such as Memory browse this address, Memory browse this pointer and Add to address list.\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Dissect data/structures\par} N1Pointer scanpointer-scanpointer-scan&HelpMacro=1097 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=02/01/2011 DateModified=02/01/2011 DateReview=02/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=41 Y1=78 X2=0 Y2=0 sChange=Under Construction sBook=02/01/2011 20:18 sBookPage=02/01/2011 20:21 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 You can open the pointer scanner with Memory View->Tools->Pointer scan, or by right-clicking on an address in the address list and choose "Pointer scan for this address".\par\par If you use the first method, you can use File->Open to open a saved pointer list or you can use the Pointer scanner->Scan for pointer option.\par If you start a pointer scan, a new window will appear where you can customize the parameters of the scan.\par\par At the top of the window, you can choose to find pointer for an address or for a value. Searching for an address is much faster, so this is the default method.\par Below that, you can set the parameters of the scan. Usually you don't need to change the upper part at all, especially if you have no idea what it does.\par\par At the bottom part of the window, there are other options that you may need to change sometimes. The number of scanning threads is working fine with single and dual core processors but you may increase it if you have a better CPU. The maximum offset value should be changed only if you suspect that any of the offsets will be larger than 2048 bytes (e.g. an offset like eax+1F48 or similar, which is not so common for most of the values that cheaters are looking for). The max level of the pointer path is 5 by default, but some programs are using even longer pointer paths, so if you didn't find what you were looking for, probably you need to increase the max level.\par\par If you have typed in the address, checked the options and clicked on ok, you will have to choose a name for the pointer list that will be created. Then wait for the scan to finish the job.\par\par If the scanning is done, you will get a huge list of possible pointer paths, but not all of them will work for you if the address will be changed. For now, you have a saved pointer list which can be opened later from the File menu in the Pointer scan window.\par\par Now make sure to change the address of the value, which usually means die in the game, restart your level or restart your game.\par Find the value again by scanning for it and you will have the new address.\par If your pointer scan window was closed, open the saved pointerlist. Now probably you have noticed that many of the found pointers are pointing to wrong addresses, which means we have to remove the wrong ones.\par\par Now you can use t"0/1(he Pointer scanner->Rescan memory option.\par Type in the new address, choose a name for the new pointerlist and CE will filter out the pointers that are pointing to the wrong address.\par Now you should have much less pointers in the list but at least they are correct.\par\par It may happen that some of the pointers will fail to work from time to time, in this case, you need to filter them again, until you find reliable pointers which are working for you in every case. Keep rescanning the pointers until you have found one that is perfect for you.\par\par If you wish to add a pointer to the address list, all you need to do is double-click on it in the pointer list and it will be added to your table as a new pointer. \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Pointer scan\par} N1Break and tracebreak-and-tracebreak-and-trace$HelpMacro=1098 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=02/01/2011 DateModified=02/01/2011 DateReview=02/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=4 Y1=29 X2=0 Y2=0 sChange=Under Construction sBook=02/01/2011 20:21 sBookPage=02/01/2011 20:23 sIcon=10 exp=0 sel=0D{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 If you have used the Break and trace option in CE 5.x, you will notice that this option has been improved to be a much more advanced feature in CE 6. First you are able to use break and trace with data breakpoints too. Furthermore, you can set a breaking condition and stopping condition for the trace and you also have the option to log the stack to a certain level (4096 bytes are used to make the stack snapshots).\par If you see a trace log, you will notice additional, very important changes.\par The trace log is displayed as a tree, so you can see calls and returns easily. This way the log is also a structured map of the traced code, which is undoubtedly a huge improvement compared to the previous logs. It will not only help you to navigate, but you can also see where is your code in the tree and how "deep" is the function where it is used. Advanced users will probably appreciate this. Right-clicking in the log will offer the collapse and expand tree options.\par There are a few additional options like saving the log and searching in the log (which was not possible in earlier versions). Also an improvement that the values on the addresses in the codes are shown.\par Clicking on the F button will bring up the FPU register window, and the S button will show the Stack View window. If You right-click in the stack view, you can change the offset display between ebp+* and esp+* which is very useful when you are tracing values in the stack. \par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Break and trace\par} N1 Structure spider structure-spider structure-spider"HelpMacro=1100 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/05/2012 DateModified=13/05/2012 DateReview=13/05/2012 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=13/05/2012 16:03 sBookPage=13/06/2013 11:03 sIcon=10 exp=0 sel=1{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 The structure spider is like the structure dissect a useful tool in finding common values and differences between structures.\par The structure spider goes a bit further in that it automatically follows all possible pointer paths.\par\par When doing a scan, you can give two base pointers and tell the scanner that the values should be the same, or different\par\par\par Another use of the structure spider is that it can focus on stringscans, which is useful for heavily scripted games. For example, if a script engine changes the value of a variable named "ammo" you could do a structure scan for the text "ammo" . This will show all paths to that variablename.\par De a rescan a few times to filter out the paths that are wrong, and you'll have a pretty stable pointerpath you can use in a code injection to see if the script engine is going to change ammo, or something else\par\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 "102) {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Structure spider\par} N1Plugin systemPluginsystemPluginsystemDateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=13 HW=Main sBookPage2=1 sBookPage=20/01/2010 05:46 sIcon=13 exp=1 sel=0 sBook=30/12/2008 22:15{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs18\par\lang1033\hich\f1\dbch\f1\loch\f1 Cheat Engine comes with a plugin system so developers can add extra functions and features to ce without having to code in Delphi (Any language that can create standard DLL's with normal exports can make plugins for ce), or having to share their sourcecode.\par\par To make use of the plugin system you need to create a dll that exports 3 functions:\par GetVersion, DisablePlugin, and InitializePlugin\par\par Note: Unless stated otherwise, all function calls use the stdcall calling mechanism.\par\par Cheat Engine comes with some example plugins. They generally make use of a common SDK file. Currently, there is a version for Delphi and a version for C available\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs24\b Plugin system\plain\f1\fs20\par} N1GetVersiongetversiongetversion(HelpMacro=1001 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=11 Y1=20 X2=0 Y2=10 sChange=Under Construction sBook=28/12/2008 13:37 sBookPage=20/01/2010 05:43 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \froman \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ltrpar\ql\lang1033\hich\f2\dbch\f2\loch\f2\fs18\ltrch The GetVersion routine is a routine that will get called when the dll is queried for the first time.\par\ltrch\b\par\par BOOL GetVersion(\ltrch\i\par\ltrch\i0 PPluginVersion\ltrch\i \ltrch\b0 pv,\ltrch\b \tab\tab\ltrch\b0\i0 //pointer to structure you have to fill in\ltrch\b\i\par int \ltrch\b0 sizeofpluginversion \tab\tab\ltrch\i0 //size of pluginversion\ltrch\b\i\par\ltrch\i0 );\lang1023\hich\f2\dbch\f2\loch\f2\ltrch\b0\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\fs18\ltrch\par\par\plain\lang1033\hich\f1\dbch\f1\loch\f1\fs18 Parameters\par\i pv\par\tab\i0 Pointer to a \cf2\ul{\field{\*\fldinst HYPERLINK pluginversion}{\fldrslt PluginVersion struct}}\cf3\ul0 that you'll have to fill in.\par\i\par\hich\f2\dbch\f2\loch\f2\ltrch sizeofpluginversion\par\li720\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\fs18\ltrch Size of the PluginVersion struct provided in the pv parameter. You can use this to make sure that your plugin version is compatible with the current implementation of Cheat Engine's plugin system.\par Currently, it should be 8.\plain\lang1033\hich\f1\dbch\f1\loch\f1\fs18\par\li0\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs18\par Return Value\par Return value has to be TRUE\cf0\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\b GetVersion\fs20\b0\par} N1DisablePlugindisableplugindisableplugin$HelpMacro=1002 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT"213*8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=8 Y1=0 X2=0 Y2=13 sChange=Under Construction sBook=28/12/2008 13:39 sBookPage=29/12/2009 16:08 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \froman \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ltrpar\ql\lang1033\hich\f2\dbch\f2\loch\f2\fs18\ltrch The DisablePlugin routine is a routine that will get called when Cheat Engine closes or when the user deselects the plugin in settings.\par\ltrch\b\par\par BOOL DisablePlugin(void)\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\fs18\par\b Return Value\b0\par Return value has to be TRUE\fs20\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\b DisablePlugin\fs20\b0\par} N1 InitializePlugin initializeplugin initializeplugin&HelpMacro=1003 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=19 Y1=0 X2=0 Y2=16 sChange=Under Construction sBook=28/12/2008 13:39 sBookPage=29/12/2009 16:09 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \froman \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx1260\ltrpar\ql\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\ltrch The InitializePlugin routine is called when Cheat Engine is started and the plugin is enabled in the registry, or when the user enables it in settings and clicks ok.\ltrch\b\i\par\pard\s0\ltrpar\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\ltrch\b\i\par\ltrch\i0 BOOL InitializePlugin(\par PExportedFunctions \ltrch\b0\i ef\ltrch\i0 \ltrch\b , \par int \ltrch\b0\i pluginid\ltrch\b\par\ltrch\i0 );\lang1023\hich\f2\dbch\f2\loch\f2\ltrch\b0\par\lang1033\hich\f2\dbch\f2\loch\f2\ltrch\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\fs18 Parameters\par\i ef\par\fi-720\li720\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\fs18\i\tab\i0 Address to a copy of CE's \cf3\ul{\field{\*\fldinst HYPERLINK exportedfunctions}{\fldrslt ExportedFunctions}}\cf0\ul0 struct . Make a copy of this structure before returning from the InitializePlugin function.\par\fi0\li0\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\fs18\i\par\hich\f2\dbch\f2\loch\f2\ltrch pluginid\par\li720\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\fs18\ltrch The pluginid for your plugin for as long as it is active. This ID is used to register callbacks.\plain\lang1033\hich\f1\dbch\f1\loch\f1\fs18\par\li0\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\fs18\par Return Value\par\ltrpar\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\fs18 Return value has to be TRUE\par\hich\f2\dbch\f2\loch\f2\cf2\ltrch\par\par It is recommended to register the callback functions in this routine and save ExportedFunctions for later usage. For more information about the callbacks see the relevant help topics\par\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs18\par } {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\b InitializePlugin\fs20\b0\par} N1StructuresDateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 CT1=0 CT2=0 CT3=0 CT4=0 CT5=0 CT6=0 CT7=0 CT8=0 CT9=0 CX1=0 CX2=0 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=30/12/2008 22:15 sBookPage=30/12/2008 22:15{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogro"324+wautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} N1PluginVersionpluginversionpluginversion(HelpMacro=1004 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=20 Y1=58 X2=0 Y2=13 sChange=Under Construction sBook=28/12/2008 22:05 sBookPage=29/12/2009 16:09 sIcon=10 exp=0 sel=0C{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20 The PluginVersion lets you specify for which plugin version the dll was developed and what the name of that plugin is.\par\cf3\par typedef\cf0 \cf3 struct\cf0 _PluginVersion\par \{\par \cf3 unsigned\cf0 \cf3 int\cf0 version; \cf4\par\cf0 \cf3 char\cf0 *pluginname;\cf4\par\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\fs20 \} PluginVersion, *PPluginVersion;\par\par\cf2\b Members\b0\par\cf0\par\cf2\b version\b0\par\li270\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20 Set this to the plugin version this dll is expecting. Cheat Engine will then try to provide your plugin with a compatible pointer/functionlists on initializePlugin.\par\li0\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20\par\b pluginname\b0\par\li270\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20 Set this to a 0-terminated string containing the name of the plugin shown to the user in the plugin menu in settings. Make sure this string is NOT stored on the stack as this pointer can be used at random times after return of the GetVersion function call.\hich\f1\dbch\f1\loch\f1\cf0\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b PluginVersion\cf0\fs20\b0\par} N1"ExportedFunctions"ExportedFunctions"ExportedFunctionsDateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=127 Y1=0 X2=0 Y2=0 sBookPage2=1 sBookPage=31/12/2010 02:31 sIcon=13 exp=1 sel=0 sBook=30/12/2008 22:15N%{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}{\f3 \fmodern \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20 The ExportedFunctions structure contains several pointers to usefull functions in CE, and pointers to the pointers of specific functions that might be worth hooking.\par\cf3\par\par typedef\cf2 \cf3 struct\cf2 _ExportedFunctions\par \{\par \cf3 int\cf2 sizeofExportedFunctions;\par CEP_SHOWMESSAGE ShowMessage; \cf4\par\cf2 CEP_REGISTERFUNCTION RegisterFunction; \cf4\par\cf2 CEP_UNREGISTERFUNCTION \hich\f3\dbch\f3\loch\f3\cf0 UnregisterFunction\hich\f2\dbch\f2\loch\f2 ; \cf4\par\cf2 PULONG \hich\f3\dbch\f3\loch\f3\cf0 OpenedProcessID\hich\f2\dbch\f2\loch\f2 ; \cf4\par \cf2 PHANDLE \hich\f3\dbch\f3\loch\f3\cf0 OpenedProcessHandle\hich\f2\dbch\f2\loch\f2 ; \cf4\par\par\cf2 CEP_GETMAINWINDOWHANDLE GetMainWindowHandle; \cf4\par\cf2 CEP_AUTOASSEMBLE AutoAssemble; \cf4\par\cf2 CEP_ASSEMBLER Assembler;\cf4\par\cf2 CEP_DISASSEMBLER \hich\f3\dbch\f3\loch\f3\cf0 Disassembler\hich\f2\dbch\f2\loch\f2 ;\par CEP_CHANGEREGATADDRESS \hich\f3\dbch\f3\loch\f3 ChangeRegistersAtAddress\hich\f2\dbch\f2\loch\f2 ; \cf4\par\cf2 CEP_INJECTDLL \hich\f3\dbch\f3\loch\f3\cf0 InjectDLL\hich\f2\dbch\f2\loch\f2 ; \cf4\par\cf2 CEP_FREEZEMEM FreezeMem; \cf4\par\cf2 CEP_UNFREEZEMEM UnfreezeMem; \cf4\par\cf2 CEP_FIXMEM FixMem; \cf4\par\cf2 CEP_PROCESSLIST ProcessList; \cf4\par\cf2 CEP_RELOADSETTINGS ReloadSettings; \cf4\par \cf0 CEP_GETADDRESSFROMPOINTER \hich\f3\dbch\f3\loch\f3 GetAddressFromPointer\hich\f2\dbch\f2\loch\f2 ; \cf4\par\par\cf2 \cf4 //pointers to the address that contains the pointers to the functions\par\cf2 \cf4 //!!!!!!!"435,!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\par\cf2 PVOID ReadProcessMemory;\tab\tab\tab\cf4\par\cf2 PVOID WriteProcessMemory;\tab\tab\tab\cf4\par\cf2 PVOID GetThreadContext;\tab\tab\tab\cf4\par\cf2 PVOID SetThreadContext;\tab\tab\tab\cf4\par\cf2 PVOID SuspendThread;\tab\tab\tab\tab\cf4\par\cf2 PVOID ResumeThread;\tab\tab\tab\tab\cf4\par\cf2 PVOID OpenProcess;\tab\tab\tab\tab\cf4\par\cf2 PVOID WaitForDebugEvent;\tab\tab\tab\cf4\par\cf2 PVOID ContinueDebugEvent;\tab\tab\tab\cf4\par\cf2 PVOID DebugActiveProcess;\tab\tab\tab\cf4\par\cf2 PVOID StopDebugging;\tab\tab\tab\tab\cf4\par\cf2 PVOID StopRegisterChange;\tab\tab\tab\cf4\par\cf2 PVOID VirtualProtect;\tab\tab\tab\tab\cf4\par\cf2 PVOID VirtualProtectEx;\tab\tab\tab\cf4\par\cf2 PVOID VirtualQueryEx;\tab\tab\tab\tab\cf4\par\cf2 PVOID VirtualAllocEx;\tab\tab\tab\tab\cf4\par\cf2 PVOID CreateRemoteThread;\tab\tab\tab\cf4\par\cf2 PVOID OpenThread;\tab\tab\tab\tab\cf4\par\cf2 PVOID GetPEProcess;\tab\tab\tab\tab\cf4\par\cf2 PVOID GetPEThread;\tab\tab\tab\tab\cf4\par\cf2 PVOID GetThreadsProcessOffset;\tab\cf4\par\cf2 PVOID GetThreadListEntryOffset;\tab\cf4\par\cf2 PVOID GetProcessnameOffset;\tab\tab\cf4\par\cf2 PVOID GetDebugportOffset;\tab\tab\cf4\par\cf2 PVOID GetPhysicalAddress;\tab\tab\cf4\par\cf2 PVOID ProtectMe;\tab\tab\tab\cf4\par\cf2 PVOID GetCR4;\tab\tab\tab\tab\cf4\par\cf2 PVOID GetCR3;\tab\tab\tab\tab\cf4\par\cf2 PVOID SetCR3;\tab\tab\tab\tab\cf4\par\cf2 PVOID GetSDT;\tab\tab\tab\tab\cf4\par\cf2 PVOID GetSDTShadow;\tab\tab\tab\cf4\par\cf2 PVOID setAlternateDebugMethod;\tab\cf4\par\cf2 PVOID getAlternateDebugMethod;\tab\cf4\par\cf2 PVOID DebugProcess;\tab\tab\tab\cf4\par\cf2 PVOID ChangeRegOnBP;\tab\tab\tab\cf4\par\cf2 PVOID RetrieveDebugData;\tab\tab\cf4\par\cf2 PVOID StartProcessWatch;\tab\tab\cf4\par\cf2 PVOID WaitForProcessListData;\tab\cf4\par\cf2 PVOID GetProcessNameFromID;\tab\tab\cf4\par\cf2 PVOID GetProcessNameFromPEProcess;\cf4\par\cf2 PVOID KernelOpenProcess;\tab\tab\cf4\par\cf2 PVOID KernelReadProcessMemory;\tab\cf4\par\cf2 PVOID KernelWriteProcessMemory;\tab\cf4\par\cf2 PVOID KernelVirtualAllocEx;\tab\tab\cf4\par\cf2 PVOID IsValidHandle;\tab\tab\tab\cf4\par\cf2 PVOID GetIDTCurrentThread;\tab\tab\cf4\par\cf2 PVOID GetIDTs;\tab\tab\tab\tab\cf4\par\cf2 PVOID MakeWritable;\tab\tab\tab\cf4\par\cf2 PVOID GetLoadedState;\tab\tab\tab\cf4\par\cf2 PVOID DBKSuspendThread;\tab\tab\cf4\par\cf2 PVOID DBKResumeThread;\tab\tab\cf4\par\cf2 PVOID DBKSuspendProcess;\tab\tab\cf4\par\cf2 PVOID DBKResumeProcess;\tab\tab\cf4\par\cf2 PVOID KernelAlloc;\tab\tab\tab\cf4\par\cf2 PVOID GetKProcAddress;\tab\tab\cf4\par\cf2 PVOID CreateToolhelp32Snapshot;\tab\cf4\par\cf2 PVOID Process32First; \tab\cf4\par\cf2 PVOID Process32Next; \tab\cf4\par\cf2 PVOID Thread32First; \tab\cf4\par\cf2 PVOID Thread32Next; \tab\cf4\par\cf2 PVOID Module32First; \tab\cf4\par\cf2 PVOID Module32Next; \tab\cf4\par\cf2 PVOID Heap32ListFirst; \tab\cf4\par\cf2 PVOID Heap32ListNext; \tab\cf4\par\cf2 \cf4 //^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\par\par\cf2 \cf4\par\cf2 PVOID mainform; \cf4\par\cf2 PVOID memorybrowser; \cf4\par\par\cf2 CEP_GENERATEAPIHOOKSCRIPT sym_nameToAddress;\par CEP_ADDRESSTONAME \hich\f3\dbch\f3\loch\f3\cf0 sym_addressToName\hich\f2\dbch\f2\loch\f2 ;\par CEP_NAMETOADDRESS \hich\f3\dbch\f3\loch\f3 sym_generateAPIHookScript;\par\par\hich\f2\dbch\f2\loch\f2 CEP_LOADDBK32 \hich\f3\dbch\f3\loch\f3 loadDBK32;\par\hich\f2\dbch\f2\loch\f2 CEP_LOADDBVMIFNEEDED \hich\f3\dbch\f3\loch\f3 loaddbvmifneeded;\par\hich\f2\dbch\f2\loch\f2 CEP_PREVIOUSOPCODE \hich\f3\dbch\f3\loch\f3 previousOpcode;\par\hich\f2\dbch\f2\loch\f2 CEP_NEXTOPCODE \hich\f3\dbch\f3\loch\f3 nextOpcode;\par\hich\f2\dbch\f2\loch\f2 CEP_DISASSEMBLEEX \hich\f3\dbch\f3\loch\f3 disassembleEx;\par\hich\f2\dbch\f2\loch\f2 CEP_LOADMODULE \hich\f3\dbch\f3\loch\f3 loadModule;\par\hich\f2\dbch\f2\loch\f2 CEP_AA_ADDCOMMAND \hich\f3\dbch\f3\loch\f3 aa_AddExtraCommand;\par\hich\f2\dbch\f2\loch\f2 CEP_AA_DELCOMMAND \hich\f3\dbch\f3\loch\f3 aa_RemoveExtraCommand;\par\par\lang1033\hich\f2\dbch\f2\loch\f2 CEP_CREATETABLEENTRY createTableEntry;\par CEP_GETTABLEENTRY getTableEntry;\par CEP_MEMREC_SETDESCRIPTION memrec_setDescription;\par CEP_MEMREC_GETDESCRIPTION memrec_getDescription;\par CEP_MEMREC_GETADDRESS memrec_getAddress;\par CEP_MEMREC_SETADDRESS memrec_setAddress;\par CEP_MEMREC_GETTYPE memrec_getType;\par CEP_MEMREC_SETTYPE memrec_setType;\par CEP_MEMREC_GETVALUETYPE memrec_getValue;\par CEP_MEMREC_SETVALUETYPE memrec_setValue;\par CEP_MEMREC_GETSCRIPT memrec_getScript;\par CEP_MEMREC_SETSCRIPT memrec_setScript;\par CEP_MEMREC_ISFROZEN memrec_isfrozen;\par CEP_MEMREC_FREEZE memrec_freeze;\par CEP_MEMREC_UNFREEZE memrec_unfreeze;\par CEP_MEMREC_SETCOLOR memrec_setColor;\par CEP_MEMREC_APPENDTOENTRY memrec_appendtoentry;\par CEP_MEMREC_DELETE memrec_delete;\par\par CEP_GETPROCESSIDFROMPROCESSNAME getProcessIDFromProcessName;\par CEP_OPENPROCESS openProcessEx;\par CEP_DEBUGPROCESS debugProcessEx;\par CEP_PAUSE pause;\par CEP_UNPAUSE unpause;\par\par CEP_DEBUG_SETBREAKPOINT debug_setBreakpoint;\par CEP_DEBUG_REMOVEBREAKPOINT debug_removeBreakpoint;\par CEP_DEBUG_CONTINUEFROMBREAKPOINT debug_continueFromBreakpoint;\par\par CEP_CLOSECE closeCE;\par CEP_HIDEALLCEWINDOWS hideAllCEWindows;\par CEP_UNHIDEMAINCEWINDOW unhideMainCEwindow;\par CEP_CREATEFORM createForm;\par CEP_FORM_CENTERSCREEN form_centerScreen;\par CEP_FORM_HIDE form_hide;\par CEP_FORM_SHOW form_show;\par CEP_FORM_ONCLOSE form_onClose;\par\par CEP_CREATEPANEL createPanel;\par CEP_CREATEGROUPBOX createGroupBox;\par CEP_CREATEBUTTON createButton;\par CEP_CREATEIMAGE createImage;\par CEP_IMAGE_LOADIMAGEFROMFILE image_loadImageFromFile;\par CEP_IMAGE_TRANSPARENT image_transparent;\par CEP_IMAGE_STRETCH image_stretch;\par\par CEP_CREATELABEL createLabel;\par CEP_CREATEEDIT createEdit;\par CEP_CREATEMEMO createMemo;\par CEP_CREATETIMER createTimer;\par CEP_TIMER_SETINTERVAL timer_setInterval;\par CEP_TIMER_ONTIMER timer_onTimer;\par CEP_CONTROL_SETCAPTION control_setCaption;\par CEP_CONTROL_GETCAPTION control_getCaption;\par CEP_CONTROL_SETPOSITION control_setPosition;\par CEP_CONTROL_GETX control_getX;\par CEP_CONTROL_GETY control_getY;\par CEP_CONTROL_SETSIZE control_setSize;\par CEP_CONTROL_GETWIDTH control_getWidth;\par CEP_CONTROL_GETHEIGHT control_getHeight;\par CEP_CONTROL_SETALIGN control_setAlign;\par CEP_CONTROL_ONCLICK control_onClick;\par\par CEP_OBJECT_DESTROY object_destroy;\par CEP_MESSAGEDIALOG messageDialog;\par CEP_SPEEDHACK_SETSPEED speedhack_setSpeed; \lang1033\hich\f3\dbch\f3\loch\f3\par\par\par\par\hich\f2\dbch\f2\loch\f2\fs16 \par\fs20\par\par\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20 \} ExportedFunctions, *PExportedFunctions;\hich\f3\dbch\f3\loch\f3\cf0\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\b ExportedFunctions\fs20\b0\par} N1.sizeofExportedFunctions.sizeofexportedfunctions.sizeofex"546-portedfunctions$HelpMacro=1013 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=6 Y1=41 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 21:56 sBookPage=30/12/2008 21:58 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f2\dbch\f2\loch\f2\cf3 int\cf0 sizeofExportedFunctions;\plain\f1\fs20\par\par As you might have guessed, it contains the size of the structure CE has sent to your plugin.\par You can check if it's what you expected or add in some checks to make sure you don't go over it. Or if sizeof is too hard to use use that instead when copying the memory block to your own region of memory. (As said before, ExportedFunctions you get in initializefunctions is a copy and will be invalidated when the function returns, so copy is crucial)\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 sizeofExportedFunctions\par} N1ShowMessageshowmessageshowmessage$HelpMacro=1014 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=64 X2=0 Y2=1 sChange=Under Construction sBook=30/12/2008 21:59 sBookPage=30/12/2008 22:06 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f2\dbch\f2\loch\f2 ShowMessage will display a small popup window containing a text message. \par Useful for testing that the plugin works, and for debug purposes\par\par ShowMessage(\par\cf3 char\cf2 * message //pointer to a 0-terminated string\par );\par\par\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 ShowMessage\par} N1 RegisterFunction registerfunction registerfunction$HelpMacro=1015 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=7 Y1=72 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:13 sBookPage=20/01/2010 15:03 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \froman \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch This function will register a callback function that gets called when a certain event happens and in some cases also creates a extra menu item.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i int\cf2\ltrch RegisterFunction(\cf3\ltrch int\cf2\ltrch pluginid,\hich\f2\dbch\f2\loch\f2\ltrch PluginType\hich\f0\dbch\f0\loch\f0\ltrch functiontype, PVOID init);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\lt"657.rch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par\ltrch\b pluginid\ltrch\b0 has to be the pluginid that you got from InitializePlugin\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b functiontype \ltrch\b0 defines what type of function you want to register (See \cf3\ltrch\ul{\field{\*\fldinst HYPERLINK Plugintypes}{\fldrslt PluginType}}\cf2\ltrch\ul0 )\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b init\ltrch\b0 holds a pointer to a structure that is dependant on the type of function.\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 RegisterFunction\par} N1$UnregisterFunction$unregisterfunction$unregisterfunction"HelpMacro=1016 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=9 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:13 sBookPage=30/12/2008 22:23 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will remove a previously registered callback function\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch UnregisterFunction(\cf3\ltrch int\cf0\ltrch pluginid, \cf3\ltrch int\cf0\ltrch functionid);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 pluginid\ltrch\b0 : The pluginid you got at InitializePlugin\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b functionid\ltrch\b0 : The result of RegisterFunction\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if the functionid was found and removed for this plugin\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 UnregisterFunction\par} N1OpenedProcessIDopenedprocessidopenedprocessid"HelpMacro=1017 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:13 sBookPage=30/12/2008 22:23 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch A pointer to the processid of the currently opened process.\par{\*\bkmkstart DDE_LINK1}{\*\bkmkend DDE_LINK1}Just the processid, but it is prefered to have both ID and HANDLE to point to the same process\par\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 OpenedProcessID\par} N1&OpenedProcessHandle&openedprocesshandle&openedprocesshandle"HelpMacro=1018 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7"768/=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:14 sBookPage=30/12/2008 22:24 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch A pointer to the handle of the currently opened process.\par This handle is used by almost all functions. Take good care to make it valid, or at least valid to the functions that use it.\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 OpenedProcessHandle\par} N1&GetMainWindowHandle&getmainwindowhandle&getmainwindowhandle"HelpMacro=1019 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:14 sBookPage=30/12/2008 22:24 sIcon=10 exp=0 sel=0L{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will remove a previously registered callback function\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i HANDLE \cf0\ltrch GetMainWindowHandle\ltrch\i0 ();\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\i0 Returns the window handle of the main window. For some basic widnow manipulations. For more advanced window manipulation it is recommended to write the DLL in Delphi 7 Enterprise, where you have access to the TFORM object of the main window\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 GetMainWindowHandle\par} N1AutoAssembleautoassembleautoassemble$HelpMacro=1020 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=24 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:14 sBookPage=30/12/2008 22:25 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will allow you to give it an auto assemble script and it will automatically inject it in the currently opened process\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch AutoAssemble(\cf3\ltrch char\cf0\ltrch *script);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 script\ltrch\b0 : A pointer to a 0 terminated string buffer that contains the auto assembler script.\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if the assemblage and injection was successfull\par\pard\s0\ql\plain\"8790f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 AutoAssemble\par} N1Assemblerassemblerassembler$HelpMacro=1021 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=14 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:14 sBookPage=30/12/2008 22:25 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will allow you to give it single assembler instruction and the address it should be put at, and it'll return you the generated bytes in a buffer you specify and the ammount of bytes it generated\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch Assembler(ULONG address, \cf3\ltrch char\cf0\ltrch * instruction, BYTE *output, \cf3\ltrch int\cf0\ltrch maxlength, \cf3\ltrch int\cf0\ltrch *returnedsize);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 address\ltrch\b0 : The address the instruction is supposed to be written. Usefull in cases of jumps and calls...\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b instruction: \ltrch\b0 A pointer to a 0 terminated string that contains the assembler instruction you want to assemble\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b output:\ltrch\b0 a pointer to the buffer the assembled bytes will be put in\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b maxlength: \ltrch\b0 maximum size of the buffer receiving the assembled bytes\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b returnedsize:\ltrch\b0 a pointer to the integer that gets how many bytes where used\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if the instruction was valid and there was enough space. Doesn't return why it fails, so it is recommended to always give at least 32 bytes space\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Assembler\par} N1Disassemblerdisassemblerdisassembler"HelpMacro=1022 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:14 sBookPage=20/01/2010 15:36 sIcon=10 exp=0 sel=09{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch This function will allow you to give it a address and it'll return you with the disassembled output.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf2\ltrch Disassembler(ULONG address, \cf3\ltrch char\cf2\ltrch * output, \cf3\ltrch int\cf2\ltrch maxsize);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 address\ltrch\b0 : The address of the instruction you want to disassemble\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b output:\ltrch\b0 pointer to the buffer the disassembled string will be put in\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b maxsize:\ltrch\b0 maximum size the string can be\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if there was enough memory to store the string.\par The returned string is build up as "Address - bytes - instruction"\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f"98:11 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Disassembler\par} N10ChangeRegistersAtAddress0changeregistersataddress0changeregistersataddress&HelpMacro=1023 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=11 Y1=29 X2=0 Y2=1 sChange=Under Construction sBook=30/12/2008 22:15 sBookPage=30/12/2008 23:24 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \froman \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will set a breakpoint at the address you specify and automatically change the registers in the way you want.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch ChangeRegistersAtAddress(ULONG address, PREGISTERMODIFICATIONINFO changereg);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 address\ltrch\b0 : The address of the instruction you want to break on\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b changereg:\ltrch\b0 a pointer to a \cf3\ltrch\ul{\field{\*\fldinst HYPERLINK registermodificationinfo}{\fldrslt REGISTERMODIFICATIONINFO}}\cf2\ltrch\ul0 \cf0\ltrch structure that holds all the changes you want to do\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par\par Returns TRUE if everything went as planned.\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 hangeRegistersAtAddress\par} N1InjectDLLinjectdllinjectdll"HelpMacro=1024 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=9 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:16 sBookPage=30/12/2008 23:31 sIcon=10 exp=0 sel=0,{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will allow you to inject a dll using ce's injection engine.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch InjectDLL(\cf3\ltrch char\cf0\ltrch *dllname, \cf3\ltrch char\cf0\ltrch *functiontocall);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 dllname\ltrch\b0 : the name of the dll to inject. \lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b functiontocall:\ltrch\b0 name of the function to call after injection. Can be NULL if you don't want to\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if the injection was successful\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 InjectDLL\par} N1FreezeMemfreezememfreezemem$HelpMacro=1025 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=":9;20 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=11 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:16 sBookPage=30/12/2008 23:31 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will freeze the memory of a specific address.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i int \cf0\ltrch FreezeMem(ULONG address, \cf3\ltrch int\cf0\ltrch size);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 address\ltrch\b0 : Address to freeze \lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b size:\ltrch\b0 Size in bytes of the address to freeze\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns the ID of the freeze sop you can later unfreeze it.\par Warning: If the process changes the freeze will still be active. It is recommended in this case to hook OpenProcess and watch for changes and unfreeze when a new process is selected\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 FreezeMem\par} N1UnfreezeMemunfreezememunfreezemem"HelpMacro=1026 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=8 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:16 sBookPage=30/12/2008 23:31 sIcon=10 exp=0 sel=0I{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will stop the freezing of a earlier freeze operation\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i int \cf0\ltrch UnfreezeMem\ltrch\i0 (\cf3\ltrch int\cf0\ltrch freezeID);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 freezeID\ltrch\b0 : Id returned by a previous FreezeMem instruction\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if the ID was found and unfrozen\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 UnfreezeMem\par} N1 FixMem fixmem fixmem$HelpMacro=1027 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=63 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:16 sBookPage=30/12/2008 23:32 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will scan the memory of CE itself for changes and fix them when possible. (Only works when the user also has the option enabled to fix memory";:<3 in settings)\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch FixMem\ltrch\i0 ();\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\i0 Returns TRUE if it didn't crash\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 FixMem\par} N1ProcessListprocesslistprocesslist"HelpMacro=1028 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:17 sBookPage=30/12/2008 23:32 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will return the processlist in a buffer you provide\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch ProcessList\ltrch\i0 (\cf3\ltrch char\cf0\ltrch *listbuffer, \cf3\ltrch int\cf0\ltrch listsize);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 listbuffer\ltrch\b0 : Pointer to buffer that will receive the processlist\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b listsize:\ltrch\b0 Size in bytes of the buffer\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if there was enough memory to fill the list.\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 ProcessList\par} N1ReloadSettingsreloadsettingsreloadsettings"HelpMacro=1029 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=6 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:17 sBookPage=30/12/2008 23:33 sIcon=10 exp=0 sel=0m{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function will reload the settings from the registry and apply them to ce\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch ReloadSettings\ltrch\i0 ();\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\i0 Returns TRUE\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 ReloadSettings\par} N1*GetAddressFromPointer*getaddressfrompointer*getaddressfrompointer"HelpMacro=1030 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 S"<;=4howTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=6 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:18 sBookPage=30/12/2008 23:33 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function converts a baseaddress + offsets to a final address.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i DWORD \cf0\ltrch GetAddressFromPointer(ULONG baseaddress, \cf3\ltrch int \cf0\ltrch offsetcount\cf3\ltrch , int\cf0\ltrch * offsets);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\i0 Returns the address the pointer is pointing to. If part of the pointerpath is unreadable, the result is 0\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 GetAddressFromPointer\par} N1"sym_nameToAddress"sym_nametoaddress"sym_nametoaddress$HelpMacro=1031 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=5 Y1=41 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:18 sBookPage=30/12/2008 23:36 sIcon=10 exp=0 sel=0@{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function converts a string to a dword\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf0\ltrch sym_nameToAddress\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 (\cf3 char\cf2 *name, DWORD *address);\lang1023\hich\f0\dbch\f0\loch\f0\cf0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\i0 Returns TRUE if the text was successfully translated into a working address, and will fill in the specified address in the provided pointer\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 sym_nameToAddress\par} N1"sym_addressToName"sym_addresstoname"sym_addresstoname"HelpMacro=1032 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=0 X2=0 Y2=2 sChange=Under Construction sBook=30/12/2008 22:18 sBookPage=30/12/2008 23:37 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch This function converts a dword representing an address to a readable string\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\tx5850\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i BOOL \cf0\ltrch sym_addressToName\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 (DWORD address, \cf3 char\cf2 *name, \cf3 int\cf2 maxnamesize);\lang1023\hich\f0\dbch\f0\loch\f0\cf0\fs24\ltrch\par\pard\s0\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\ltrch\i\par\ltrch\i0 Returns TRUE if the address wa"=<>5s converted to a textual representation.\par The output will be stored in "name"\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\ltrch maxnamesize defines the maximum length the string may be.\plain\f1\fs20\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 sm_addressToName\par} N14sym_generateAPIHookScript;2sym_generateapihookscript2sym_generateapihookscript"HelpMacro=1033 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 22:19 sBookPage=31/12/2008 02:56 sIcon=10 exp=0 sel=0E {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}{\f3 \fmodern \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch This function takes several strings and convert it into a working autoassembler script.\par\par\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\tx5850\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i BOOL \cf2\ltrch sym_addressToName\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 (\plain\f3\fs20\par\hich\f2\dbch\f2\loch\f2\cf3 char\cf0 *address, \hich\f0\dbch\f0\loch\f0\cf3\ltrch\i\par\plain\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs20 char\cf0 *addresstojumpto, \cf3\par char\cf0 *addresstogetnewcalladdress, \cf2\par\cf3 char\cf0 *script, \cf2\par\cf3 int\cf0 maxscriptsize\cf2\par\cf0 );\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\pard\s0\ltrpar\ql\plain\f1\fs20\lang1033\hich\f2\dbch\f2\loch\f2\cf2\par address=The address you want to hook. (e.g "00401234", "somegamemod.dll+1234" or "apidll!functionname")\par\par addresstojumpto=Address of the routine you want to jump to. (e.g "mydll!myhook" or just an static address like "12345678" )\par\par addresstogetnewcalladdress=Address to store the address of the routine in so you can call it without the hook. (Useful when you want to call the original routine from your own hook)\par\par script=Output. A pointer to a buffer where you want the script in.\par maxscriptsize makes sure the script won't go over it.\par\hich\f0\dbch\f0\loch\f0\ltrch\i\par\ltrch\i0 Returns TRUE if the script was properly generated and there was enough space. script will be filled with the script you can feed to the auto assembler\par\pard\s0\ql\plain\f1\fs20\plain\f3\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f2\dbch\f2\loch\f2\cf2 s\plain\f1\fs20 ym_generateAPIHookScript;\par} N1loadDBK32loaddbk32loaddbk32"HelpMacro=1077 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:49 sBookPage=20/01/2010 15:30 sIcon=10 exp=0 sel=0loadDBK32{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 This function will make cheat engine load dbk32.dll and initialize some of it's functions\par\par\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\tx5850\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i void \cf2\ltrch loadDBK32\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 (\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i void \plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 );\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1">=?6800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 loadDBK32\par} N1 loaddbvmifneeded loaddbvmifneeded loaddbvmifneeded"HelpMacro=1078 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=3 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:49 sBookPage=20/01/2010 15:31 sIcon=10 exp=0 sel=0"loaddbvmifneededX{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Times New Roman;}{\f3 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 This will launch dbvm if your system supports it. The user will get a popup asking if he wants to launch it\par\par\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i BOOL \cf2\ltrch loaddbvmifneeded\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 (\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i void \plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 );\hich\f3\dbch\f3\loch\f3\par\par returns true if dbvm has been properly loaded or is already loaded\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 loaddbvmifneeded\par} N1previousOpcodepreviousopcodepreviousopcode$HelpMacro=1080 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=0 X2=0 Y2=14 sChange=Under Construction sBook=20/01/2010 05:49 sBookPage=20/01/2010 15:32 sIcon=10 exp=0 sel=0Z{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 This function will return the previous instruction of the given address\par\par\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i DWORD \cf2\ltrch previousOpcode(\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 ULONG address);\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 previousOpcode\par} N1nextOpcodenextopcodenextopcode"HelpMacro=1081 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=2 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:50 sBookPage=20/01/2010 15:32 sIcon=10 exp=0 sel=0S{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\"?>@7headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 This instruction will retrieve the next address of the given address\par\par\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i DWORD \cf0\ltrch nextOpcode(\plain\lang1033\hich\f2\dbch\f2\loch\f2\cf0\fs20 ULONG address);\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 nextOpcode\par} N1disassembleExdisassembleexdisassembleex"HelpMacro=1082 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:50 sBookPage=20/01/2010 15:37 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 A more extended disassembler\par\par\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch\i BOOL \cf2\ltrch Disassembler(ULONG address, \cf3\ltrch char\cf2\ltrch * output, \cf3\ltrch int\cf2\ltrch maxsize);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\i0\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\i\par\ltrch\b\i0 address\ltrch\b0 : Pointer to the address of the instruction you want to disassemble. On return address contains the address of the next instruction\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b output:\ltrch\b0 pointer to the buffer the disassembled string will be put in\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\b maxsize:\ltrch\b0 maximum size the string can be\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Returns TRUE if there was enough memory to store the string.\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch The returned string is build up as "Address - bytes - instruction"\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20\par\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 disassembleEx\par} N1loadModuleloadmoduleloadmodule"HelpMacro=1083 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=7 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:50 sBookPage=20/01/2010 15:38 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Loads any module into memory. Can be a normal dll, but can also be a driver. Works in 64-bit\par\par\hich\f0\dbch\f0\loch\f0\ltrch\ul functiondefinition\ltrch\ul0 :\plain\f1\fs20\par\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i BOOL \cf2\ltrch loadModule\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs20 (\cf3 char\cf2 *modulepath, \cf3 char\cf2 *exportlist, \cf3 int\cf2 *maxsize);\par\par If the function succeeds exportlist will receive the list of all the exports in the loaded module. (Name Address)\par\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 loadModule\par} "@?A8N1$aa_AddExtraCommand$aa_addextracommand$aa_addextracommand"HelpMacro=1084 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:51 sBookPage=20/01/2010 15:39 sIcon=10 exp=0 sel=04{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Makes it so that the auto assembler window will recognize new instructions and marks them bold when you type them\par\par\ltrpar\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf3\ltrch\i void \cf2\ltrch aa_AddExtraCommand(char *command);\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 aa_AddExtraCommand\par} N1*aa_RemoveExtraCommand*aa_removeextracommand*aa_removeextracommand$HelpMacro=1085 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=3 Y1=14 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 05:51 sBookPage=20/01/2010 15:40 sIcon=10 exp=0 sel=0){\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 Removes an extra auto assembler command\par\par\ltrpar\ql\plain\f1\fs24\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\ul functiondefinition\ltrch\ul0 :\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f0\dbch\f0\loch\f0\cf2\fs20\ltrch\i void \cf0\ltrch aa_RemoveExtraCommand(char *command);\plain\lang1033\hich\f1\dbch\f1\loch\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 aa_RemoveExtraCommand\par} N1PluginTypePlugintypesPlugintypesDateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=10 Y1=33 X2=0 Y2=10 sBookPage2=1 sBookPage=20/01/2010 15:09 sIcon=13 exp=1 sel=0 sBook=30/12/2008 22:15 {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 The plugin system supports 9 different plugin callback types:\par\par 0: Address list rightclick menu plugin (\cf3\ul{\field{\*\fldinst HYPERLINK 0-ptaddresslist}{\fldrslt ptAddressList}}\plain\f1\fs20 )\par 1: Memory view menu plugin (\cf3\ul{\field{\*\fldinst HYPERLINK 1-ptmemoryview}{\fldrslt ptMemoryView}}\plain\f1\fs20 )\par 2: Debug event plugin (\cf3\ul{\field{\*\fldinst HYPERLINK 2-ptondebugevent}{\fldrslt ptOnDebugEven"A@B9t}}\plain\f1\fs20 )\par 3: Process watcher event plugin (\cf3\ul{\field{\*\fldinst HYPERLINK 3-ptprocesswatcherevent}{\fldrslt ptProcesswatcherEvent}}\plain\f1\fs20 )\par 4: Functionpointer change notification event (\cf3\ul{\field{\*\fldinst HYPERLINK 4-ptfunctionpointerschange}{\fldrslt ptFunctionPointerchange}}\hich\f2\dbch\f2\loch\f2\cf0\ul0 )\par\plain\f1\fs20 5: Main menu plugin menu (\cf3\ul{\field{\*\fldinst HYPERLINK 5-ptmainmenu}{\fldrslt ptMainMenu}}\hich\f2\dbch\f2\loch\f2\cf0\ul0 )\par\plain\f1\fs20 6: Disassembler rightclick context menu, entry and popup (\cf3\ul{\field{\*\fldinst HYPERLINK ptdisassemblercontext}{\fldrslt ptDisassemblerContext}}\hich\f2\dbch\f2\loch\f2\cf0\ul0 )\par\plain\f1\fs20 7: Disassembler render routine on a per line basic plugin (\cf3\ul{\field{\*\fldinst HYPERLINK ptdisassemblerrenderline}{\fldrslt ptDisassemblerRenderLine}}\hich\f2\dbch\f2\loch\f2\cf0\ul0 )\par\plain\f1\fs20 8: Auto assembler plugin (\cf3\ul{\field{\*\fldinst HYPERLINK ptautoassembler}{\fldrslt ptAutoAssembler}}\hich\f2\dbch\f2\loch\f2\cf0\ul0 )\par\plain\f1\fs20\par\hich\f2\dbch\f2\loch\f2 You create a callback by calling RegisterFunction. (Located in the \cf3\ul{\field{\*\fldinst HYPERLINK ExportedFunctions}{\fldrslt ExportedFunctions}}\cf0\ul0 \cf2 structure)\plain\f1\fs20\par} ={\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Arial;}{\f3 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\lang1033\hich\f2\dbch\f2\loch\f2\fs24\b Plugin\hich\f3\dbch\f3\loch\f3 Type\plain\f2\fs20\par\ql\plain\f1\fs20\plain\f2\fs20\par} N1 0: ptAddressList0-ptaddresslist0-ptaddresslist$HelpMacro=1006 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=18 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 18:03 sBookPage=30/12/2008 18:06 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch With this plugintype you create a new plugin menu on the rightclick menu of the addresslist.\par When the user clicks the menu item your callback routine will get information about the selected record if one is selected and will give you the ability to change the address, and description.\par\par callback definition:\par\cf3\ltrch typedef\cf2\ltrch \cf3\ltrch BOOL\cf2\ltrch (\cf3\ltrch __stdcall\cf2\ltrch *CEP_PLUGINTYPE0)(\cf3\ltrch struct\cf2\ltrch PLUGINTYPE0_RECORD *SelectedRecord);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par return TRUE if you edited the description or address\par\par\par definition of PLIGINTYPE0_RECORD:\par\cf3\ltrch struct\cf2\ltrch PLUGINTYPE0_RECORD\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \{\par\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch \lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch char\cf2\ltrch *interpretedaddress; \cf4\ltrch //pointer to a 255 bytes long string (0 terminated)\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par ULONG address;\lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //this is a read-only representaion of the address. Change interpretedaddress if you want to change this\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par BOOL ispointer; \lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //readonly\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par \lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch int\cf2\ltrch countoffsets; \cf4\ltrch //readonly\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par ULONG *offsets; \lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //array of dwords ranging from 0 to countoffsets-1 (readonly)\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par \lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch char\cf2\ltrch *description; \cf4\ltrch //pointer to a 255 bytes long string\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par \lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch char\cf2\ltrch valuetype; \cf4\ltrch //0=byte, 1=word, 2=dword, 3=float, 4=double, 5=bit, 6=int64, 7=string\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par \lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch char\cf2\ltrch size; \cf4\ltrch //stringlength or bitlength;\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \};\par\par Pointer to structure of init you have to pass:\par\cf3\ltrch struct\cf2\ltrch PLUGINTYPE0_INIT\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \{\par\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch \lang1033\hich\f0\dbch\f0\loch\f0\cf3\fs20\ltrch char\cf2\ltrch * name; \cf4\ltrch //0 terminated string describing the name for the user's menu item\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par CEP_PLUGINTYPE0 callbackroutine; \lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //pointer to a callback routine of the type 0 plugin\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \};\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 0: ptAddressList\par} N11: ptMemoryView1-ptmemoryview1-ptmemoryview"BAC:"HelpMacro=1007 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=1 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 18:03 sBookPage=30/12/2008 22:10 sIcon=10 exp=0 sel=0k{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\fi-720\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch\tab With this plugintype you create a new plugin menu at the top of the memoryview window.\par\fi0\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\ltrch When the user clicks the menu item your callback routine will get pointers to the address of the disassembler window, the address of the currently selected line in the disassembler, and the address of the hexadecimal view at the bottom. You can change these pointers to anything you like\par\par callback definition:\par\cf3\ltrch typedef\cf0\ltrch BOOL (\cf3\ltrch __stdcall\cf0\ltrch *CEP_PLUGINTYPE1)(ULONG *disassembleraddress, ULONG *selected_disassembler_address, ULONG *hexviewaddress);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par return TRUE if you changed any of the pointers so the memoryview will execute an update\par\par Pointer to structure of init you have to pass:\par\pard\s0\li720\ql\plain\f1\fs20\lang1033\hich\f2\dbch\f2\loch\f2\cf3 typedef\cf0 \cf3 struct\cf0 _PLUGINTYPE1_INIT\par \{\par \cf3 char\cf0 * name; \cf4\par\cf0 CEP_PLUGINTYPE1 callbackroutine; \cf4\par\cf0 \cf3 char\cf0 * shortcut; //string to a interpretable shortcut\cf4\par\cf0 \} PLUGINTYPE1_INIT, MEMORYVIEWPLUGIN_INIT, *PPLUGINTYPE1_INIT, *PMEMORYVIEWPLUGIN_INIT;\hich\f0\dbch\f0\loch\f0\ltrch\par\li0\plain\f1\fs20\lang1033\hich\f2\dbch\f2\loch\f2\par\plain\f1\fs20\par } {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 : ptMemoryView\par} N1"2: ptOnDebugEvent 2-ptondebugevent 2-ptondebugevent$HelpMacro=1008 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=18 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 18:03 sBookPage=30/12/2008 22:08 sIcon=10 exp=0 sel=0y{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\fi-720\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\tab With this plugintype you will get notified whenever a debug event happens in the default windows debugger. Your callback routine gets called right after the WaitForDebugEvent returns true with the pointer to the DebugEvent structure.\par\fi0\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\par callback definition:\par\cf3\ltrch typedef\cf2\ltrch \cf3\ltrch int\cf2\ltrch (\cf3\ltrch __stdcall\cf2\ltrch *CEP_PLUGINTYPE2)(LPDEBUG_EVENT DebugEvent);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par return 0 if you want to let ce or other plugins handle the debug event as well\par reutrn 1 if you don't want anything else to handle this event. You will have to call ContinueDebugEvent yourself\par\par Pointer to structure of init you have to pass:\par\cf3\ltrch struct\cf2\ltrch PLUGINTYPE2_INIT\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \{\par\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch CEP_PLUGINTYPE2 callbackroutine; \lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //pointer to a callback routine of the type 2 plugin\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \};\par\par NOTE: This event happens in a thread that is NOT the main thread. GUI specific calls (like showmessage) will not work properly.\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 2: ptOnDebugEvent\par} N103: ptProcesswatcherEvent.3-ptprocesswatcherevent.3-ptprocesswatcherevent$HelpMacro=1009 H"CBD;W=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=19 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 18:04 sBookPage=30/12/2008 22:08 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\fi-720\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\tab With this plugintype you will get notified when the processwatcher is used and it sees a new process has been created. Your callback routine gets the processid and the PEProcess address.\par\fi0\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch\par callback definition:\par\cf3\ltrch typedef\cf2\ltrch \cf3\ltrch void\cf2\ltrch (\cf3\ltrch __stdcall\cf2\ltrch *CEP_PLUGINTYPE3)(ULONG processid, ULONG peprocess, BOOL Created);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par Doesn't need a return value.\par\par\par Pointer to structure of init you have to pass:\par\cf3\ltrch struct\cf2\ltrch PLUGINTYPE3_INIT\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \{\par\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch CEP_PLUGINTYPE3 callbackroutine; \lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //pointer to a callback routine of the type 3 plugin\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \};\par\par\cf0\ltrch NOTE: This event happens in a thread that is NOT the main thread. GUI specific calls (like showmessage) will not work properly.\par\cf2\ltrch\par\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 3: ptProcesswatcherEvent\par} N164: ptFunctionPointerschange44-ptfunctionpointerschange44-ptfunctionpointerschange$HelpMacro=1010 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=16 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2008 18:04 sBookPage=30/12/2008 22:08 sIcon=10 exp=0 sel=0S{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\fi-720\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch\tab With this plugintype you will get notified when one or more of the pointers get changed due to user actions. (Other plugins that change the pointers excluded) This is usefull in cases you want to hook a api.\par\fi0\plain\f1\fs20\lang1033\hich\f0\dbch\f0\loch\f0\ltrch\par callback definition:\par\cf3\ltrch typedef\cf0\ltrch \cf3\ltrch void\cf0\ltrch (\cf3\ltrch __stdcall\cf0\ltrch *CEP_PLUGINTYPE4)(int reserved);\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par reserved: Contains the section in which a change happened. Not usefull at all...\par\par\par Pointer to structure of init you have to pass:\par\cf3\ltrch struct\cf0\ltrch PLUGINTYPE4_INIT\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \{\par\lang1023\hich\f0\dbch\f0\loch\f0\fs24\ltrch CEP_PLUGINTYPE4 callbackroutine; \lang1033\hich\f0\dbch\f0\loch\f0\cf4\fs20\ltrch //pointer to a callback routine of the type 4 plugin\lang1023\hich\f0\dbch\f0\loch\f0\cf0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch \};\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 4: ptFunctionPointerschange\par} N15: ptMainMenu5-ptmainmenu5-ptmainmenu"HelpMacro=1011 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=12/30/2008 DateModified=12/30/2008 DateReview=12/30/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus="DCE<1 X1=0 Y1=0 X2=0 Y2=9 sChange=Under Construction sBook=30/12/2008 18:04 sBookPage=20/01/2010 15:09 sIcon=10 exp=0 sel=0}{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch With this plugintype you create a new plugin menu at the top of the main window.\par When the user clicks the menu item your callback routine will get called and allows you to do whatever you like.\par\par callback definition:\par\plain\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs20 typedef\cf2 \cf3 void\cf2 (\cf3 __stdcall\cf2 *CEP_PLUGINTYPE5)(\cf3 void\cf2 );\lang1023\hich\f0\dbch\f0\loch\f0\cf0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par returns nothing\par\par Pointer to structure of init you have to pass:\par\pard\s0\li720\ql\plain\f1\fs20\lang1033\hich\f2\dbch\f2\loch\f2\cf3 typedef\cf2 \cf3 struct\cf2 _PLUGINTYPE5_INIT\par \{\par \cf3 char\cf2 * name; \cf4\par\cf2 CEP_PLUGINTYPE5 callbackroutine; \cf4\par\cf2 \cf3 char\cf2 * shortcut; \cf4\par\cf2 \} PLUGINTYPE5_INIT, MAINMENUPLUGIN_INIT, *PPLUGINTYPE5_INIT, *PMAINMENUPLUGIN_INIT\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ltrpar\ql\plain\f1\fs20 ptMainMenu\par} N106: ptDisassemblerContext*ptdisassemblercontext*ptdisassemblercontext"HelpMacro=1086 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 15:05 sBookPage=20/01/2010 15:14 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch With this plugintype you create a new entry in thecontext menu of the disassembler.\par When the user pops up the menu, or clicks the menu item, the apropriate callback routine will be called\par\par callback definition:\par\pard\s0\li720\ql\plain\f1\fs20\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef\cf2 BOOL (\cf3 __stdcall\cf2 *CEP_PLUGINTYPE6ONPOPUP)(ULONG selectedAddress, \cf3 char\cf2 **addre\cf0 ssofname);\par\ltrpar\ql\plain\f1\fs20\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef BOOL (__stdcall *CEP_PLUGINTYPE6)(ULONG *selectedAddress);\lang1033\hich\f2\dbch\f2\loch\f2\fs20\par\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par returns nothing\par\par Pointer to structure of init you have to pass:\par\pard\s0\tx720\li720\ql\plain\f1\fs20\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef\cf2 \cf3 struct\cf2 _PLUGINTYPE6_INIT\par \{\par \cf3 char\cf2 * name; \cf4 //0 terminated string describing the name for the user's menu item\par\cf2 CEP_PLUGINTYPE6ONPOPUP callbackroutineOnPopup; \par CEP_PLUGINTYPE6 callbackroutine; \par \cf3 char\cf2 * shortcut; \cf4 //0 terminated string containing the shortcut in textform. CE will try it's best to parse it to a valid shortcut\lang1033\hich\f2\dbch\f2\loch\f2\par\lang1033\hich\f2\dbch\f2\loch\f2\cf2 \} PLUGINTYPE6_INIT, DISASSEMBLERCONTEXT_INIT, *PPLUGINTYPE6_INIT, *PDISASSEMBLERCONTEXT_INIT;\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 ptDisassemblerContext\par} N167: ptDisassemblerRenderLine0ptdisassemblerrenderline0ptdisassemblerrenderline$HelpMacro=1087 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=17 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 15:06 sBookPage=20/01/2010 15:20 sIcon=10 exp=0 sel=0D{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}} {\colortbl ;\red255\gr"EDF=een255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\ltrch With this plugintype you get a callback each time a line is being rendered on the disassembler view. You then get the option to change the text and color of what is being displayed\par\par callback definition:\par\plain\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef\cf2 \cf3 void\cf2 (\cf3 __stdcall\cf2 *CEP_PLUGINTYPE7)(ULONG address, \cf3 char\cf2 **addressStringPointer, \cf3 char\cf2 **bytestringpointer, \cf3 char\cf2 **opcodestringpointer, \cf3 char\cf2 **specialstringpointer, ULONG *textcolor);\lang1023\hich\f0\dbch\f0\loch\f0\cf0\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par returns nothing\par\par Pointer to structure of init you have to pass:\par\pard\s0\tx90\li720\ql\plain\f1\fs20\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef\cf2 \cf3 struct\cf2 _PLUGINTYPE7_INIT\par \{\par CEP_PLUGINTYPE7 callbackroutine; \cf4 //pointer to a callback routine of the type 7 plugin\par\cf2 \} PLUGINTYPE7_INIT, DISASSEMBLERLINEPLUGIN_INIT, *PPLUGINTYPE7_INIT, *PDISASSEMBLERLINEPLUGIN_INIT; \plain\f1\fs20\par\pard\s0\ql\plain\f1\fs20\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 ptDisassemblerRenderLine\par} N1$8: ptAutoAssemblerptautoassemblerptautoassembler&HelpMacro=1088 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=20/01/2010 DateModified=20/01/2010 DateReview=20/01/2010 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=26 Y1=86 X2=0 Y2=0 sChange=Under Construction sBook=20/01/2010 15:06 sBookPage=24/12/2015 19:07 sIcon=10 exp=1 sel=0 {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}{\f3 \fmodern \fcharset0 Times New Roman;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\li720\ltrpar\ql\lang1033\hich\f0\dbch\f0\loch\f0\cf2\ltrch With this plugintype you get a callback when an auto assembler script is about to be executed, for each line on the first stage, and for each line on the second stage and when the auto assembler is finished.\par\par Because the auto assembler can be called from multiple threads, you will have to make sure that you keep all allocated variables separated (e.g by the hand of threadid)\par\par\par callback definition:\par\plain\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef\cf0 \cf3 void\cf0 (\cf3 __stdcall\cf0 *CEP_PLUGINTYPE8)(\cf3 char\cf0 **line, AutoAssemblerPhase phase, int aaID);\lang1023\hich\f0\dbch\f0\loch\f0\cf2\fs24\ltrch\par\lang1033\hich\f0\dbch\f0\loch\f0\fs20\ltrch\par returns nothing\par\par Phase can be one of the following:\par\plain\lang1033\hich\f2\dbch\f2\loch\f2\fs16 0: aaInitialize - When the auto assembler is about to start. Use this to initialize your internal structures \par 1: aaPhase1 - First stage when the syntax is being checked. Use this to configure whatever declarations the script requires you to save\par 2: aaPhase2 - When the code is actually being assembled into instructions\par 3: aaFinalize - When the auto assembler is finished, either with an error or not.\par\par\hich\f3\dbch\f3\loch\f3\fs20 If you replace 'line' with an empty line it will not be handled in phase2. This is useful for internal commands.\par\par aaID is an unique ID identifying the auto assembler script script currently being executed. This can come in handy when an auto assembler script launches another auto assembler script\hich\f0\dbch\f0\loch\f0\ltrch\par\par\par Pointer to structure of init you have to pass:\par\pard\s0\tx720\li720\ql\plain\f1\fs20\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs16 typedef\cf0 \cf3 struct\cf0 _PLUGINTYPE8_INIT\par \{\par CEP_PLUGINTYPE8 callbackroutine; \cf4 //pointer to a callback routine of the type 8 plugin\par\cf0 \} PLUGINTYPE8_INIT, AUTOASSEMBLERPLUGIN_INIT, *PPLUGINTYPE8_INIT, *PAUTOASSEMBLERPLUGIN_INIT; \plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Times New Roman;}{\f3 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 ptAutoAssembler\par} N10REGISTERMODIFICATIONINFO0registermodificationinfo0registermodificationinfo&HelpMacro=1034 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2008 DateModified=30/12/2008 DateReview=30/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=21 Y1=0 X2=0 Y2=24 sChange=Under Construction sBook="FEG>30/12/2008 23:22 sBookPage=29/12/2009 16:10 sIcon=10 exp=0 sel=0S{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fmodern \fcharset0 Courier New;}{\f3 \fmodern \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue255 ;\red0\green0\blue0 ;\red0\green128\blue0 ;\red128\green0\blue0 ;} {\stylesheet{\f1\fs20\cf3\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20 The REGISTERMODIFICATIONINFO structure is used by the ChangeegistersAtAddress function.\par\par\pard\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs20 typedef\cf3 \cf2 struct\cf3 _REGISTERMODIFICATIONINFO\par \{\par ULONG address; \cf4 //addres to break on\par\cf3 BOOL change_eax;\par BOOL change_ebx;\par BOOL change_ecx;\par BOOL change_edx;\par BOOL change_esi;\par BOOL change_edi;\par BOOL change_ebp;\par BOOL change_esp;\par BOOL change_eip;\par BOOL change_cf;\par BOOL change_pf;\par BOOL change_af;\par BOOL change_zf;\par BOOL change_sf;\par BOOL change_of;\par ULONG new_eax;\par ULONG new_ebx;\par ULONG new_ecx;\par ULONG new_edx;\par ULONG new_esi;\par ULONG new_edi;\par ULONG new_ebp;\par ULONG new_esp;\par ULONG new_eip;\par BOOL new_cf;\par BOOL new_pf;\par BOOL new_af;\par BOOL new_zf;\par BOOL new_sf;\par BOOL new_of;\par\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf3\fs20 \} REGISTERMODIFICATIONINFO, *PREGISTERMODIFICATIONINFO;\hich\f1\dbch\f1\loch\f1\cf0\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b REGISTERMODIFICATIONINFO\cf0\fs20\b0\par} N1SettingsSettingsSettingsDateCreated=16/01/2009 DateModified=16/01/2009 DateReview=16/01/2009 CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=7 Y1=39 X2=0 Y2=7 sIcon=13 exp=1 sel=0 sBook=28/12/2009 17:01 sBookPage=30/12/2009 19:43 HW=Main sBookPage2=1{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs24\par\lang1033\hich\f1\dbch\f1\loch\f1\fs18 The settings window allows you to change several aspects of Cheat Engine ranging from how it looks to how it scans.\lang2057\hich\f2\dbch\f2\loch\f2 These options will be explored in greater detail in this section.\lang1033\hich\f1\dbch\f1\loch\f1\line\lang2057\hich\f2\dbch\f2\loch\f2\par On any page of the settings interface you can click to view the CE about box in the bottom-right of the window. Once you have made any changes you should click on the 'OK' button at the bottom. Clicking on the 'Cancel' button will disregard any changes you have made in the settings window. All CE settings are committed to the windows registry for the current user account.\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs24\b Settings\b0\par} N1 General settings general-settings general-settings$HelpMacro=1039 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=37 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 16:25 sBookPage=31/12/2010 23:38 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs20\par\fs18\b\ul\i General/GUI options:\b0\ul0\i0\par\par\b Show undo button\b0 : This will present you with an undo button on the main interface to use for stepping-back after a memory scan. Useful if you accidentely clicked twice on next sc"GFH?an for example.\par\par\b Update the list of found addresses even after scanning\b0 : This will cause the found address list to periodically update regardless of whether or not the user actually initiated a scan. Good for seeing which addresses are changing for filtering purposes. Eats into CPU-cycles, but nothing major at all. You can change the update interval at the bottom of this settings window.\par\lang1033\hich\f2\dbch\f2\loch\f2\par\b Ask to run lua scripts from tables\b0 : If a cheat table is containing a lua script, you will be prompted to choose if you wish to execute the script or not when you open the table. You can also select to always enable the execution of lua scripts. \par\lang2057\hich\f2\dbch\f2\loch\f2\par\b Center Cheat Engine when bringing to front\b0 : This will cause Cheat Engine to snap into the center of the screen when you forceably bring it to the front of view.\par\par\b Hide some/all windows instead of trying to bring Cheat Engine to front\b0 : With this option you can elect to hide certain windows to maximize your view as opposed to trying to force the main GUI to the front. You can customize which windows are involved in this process by clicking on the 'More...' button.\par\par\b Pointer adding: Append pointerline instead of inser\b0 t: This can be very useful, but is disabled by default. This is only relevent if using multi-level pointer paths. This will cause new entries to drop below the existing entry, thus retaining the previous offset. If left disabled you will need to re-enter your pointer offsets starting from the first, and it is easy to lose track.\par\lang1033\hich\f2\dbch\f2\loch\f2\b\par\lang2057\hich\f2\dbch\f2\loch\f2 Save window positions\b0 : This will cause the current positions of windows in CE to be saved to the registry. When you next open it, they will be where you left them. Good for strategically placing your windows while hacking a windowed-game for example, or using some messenger software on the side.\par\par\b Show main menu\b0 : Unchecking this will cause the standard tooltip menu to disappear. Not recommended.\par\par\b Get process icons for processlist\b0 : This will attempt to extract icons from the processes enumerated in the processlist, which overall makes the list nicer to look at, and easier to locate specific processes. If a process doesn't have an icon, it will still be displayed, just in standard text form. You can elect to hide processes that don't have an icon by checking the sub-option below this one.\par\par\par\b\ul\i Address list specific options:\b0\par\par\b\ul0\i0 Show values as if they are signed\b0 : This will display unsigned values as signed in the cheat list. Not needed unless you have a specific reason to do so, such as wanting to work with negatives.\par\par\b Simple paste\b0 : \lang1033\hich\f2\dbch\f2\loch\f2 Instead of showing a window when copy/pasting it will just copy/paste without asking\lang2057\hich\f2\dbch\f2\loch\f2\par\par\par\b\ul\i Process attaching & address-list updating:\b0\par\par\b\ul0\i0 Automatically attach to processes named \b0 : This will cause CE to scan for an automatically attach to processes in this field so long as it is running. This can save a lot of tedious clicking if you are working on a gamehacking project and keep crashing the game (thus having to reattach each time this happens).\par\par\b Even autoattach when another process has been selected\b0 : Use this to make CE attach to a process designated in this list even if the user has already picked another process before this has happened.\par\par\b Update interval \b0 : Allows you to change the time (in ms) that elapses before CE updates the values etc in the address/cheat list.\par\par\b Found address list update interval \b0 : Allows you to change the delay between updates of the found address list (when memory scanning). This list can be quite large, so keeping this delay fairly high is wise, otherwise you may find that your CPU is getting thrashed unnecessarily.\par\par\b Freeze interval \b0 : The delay used between updates of a frozen memory address. This can be set lower than the above option, but again, set it too low and you'll find that your CPU take a bit of a hit.\par\par\par Finally, there is a \b Tools\b0 sub-section under general. This screen will allow you to enable the tools menu (which will appear next to the File, Edit, Process, Help text in the main interface), and assign various custom applications to this menu. You can also set shortcut keys to entries in this menu after adding them, for fast access at any time while using CE. You may want to assign windows calculator to this menu, or notepad, or maybe even a hex editor or web browser. Your choice! Make it your own.\par\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs24\b General settings\plain\f2\fs20\par} N1Hotkeyshotkeyshotkeys$HelpMacro=1040 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=10 Y1=0 X2=0 Y2=7 sChange=Under Construction sBook=29/12/2009 17:02 sBookPage=30/12/2009 20:04 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs20\par\fs18 The hotkeys window will allow you to assign custom keypresses to various Cheat Engine functions. For example you could assign a hotkey of CTRL+0 to toggle on and off the speedhack feature. You can clear an assigned hotkey at any time by clicking on the 'clear' button.\par\par This is especially useful for scanning in games that make alt-tabbing in and out very difficult, or have some other strange effect when you are trying to move in and out of it's focus for memory scans.\par\par Make certain that any hotkey sequence you choose will not have unwanted effects in-game though. You wouldn't want to load your previous save for example with F7 while simply wanting to do a 'next scan' :-)\par\fs20\par} {\rtf1\ansi\def"HGI@lang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Hotkeys\cf0\fs20\b0\par} N1Unrandomizer&unrandomizersetting&unrandomizersetting"HelpMacro=1041 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=4 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 17:05 sBookPage=29/12/2009 17:13 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 Here you can change the default return value for the \cf3\ul{\field{\*\fldinst HYPERLINK unrandomizeroption}{\fldrslt Unrandomizer}}\cf0\ul0 feature, which can be accessed from the main interface while attached to a process. You can also check to use an incremental value here. (Advanced users)\fs24\par\plain\f2\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs24\b Unrandomizer\plain\f2\fs20\par} N1Scan settingsscan-settingsscan-settings(HelpMacro=1043 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=25 Y1=34 X2=0 Y2=13 sChange=Under Construction sBook=29/12/2009 17:13 sBookPage=31/12/2010 23:43 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\i\par For a lot of users, this will be the config screen that they are most accustomed to seeing and using, as it relates directly to the memory-searching process. Let's take a look..\i0\par\par\par\b Size of scanbuffer (KB)\b0 : : This allows you to override the default buffer value used when scanning memory. Raising this to 1024 or perhaps even 2048 is good for most modern systems, and will speed up your scanning process a bit. Raising it too high though will yield a negative effect (which is why it's low in the first place to accommodate for most users).\par\par\b Fast scan on as default\b0 : You can check this box to make all of your memory searches aligned, unless you state otherwise in the main interface. This will cause all memory scans to only return addresses aligned to a 32-bit boundary (or ending in 0,4,8,C / divisible by 4). This will dramatically speed up memory scans, and is good for 99% of cases. Rarely though, you may miss key addresses with this turned on.\par\par\b Don't scan memory that is protected with the No Cache option\b0 : Mainly a useful consideration if you are experience strange crashes/lockups while scanning memory. Checking this will prevent Cheat Engine from scanning memory regions which are protected with 'no cache'. Usually these areas are used by graphics and other hardware drivers, and I have never seen a case where games store variables here. Basically leave it off unless you have an issue, in which case give this a whirl.\par\par\lang1033\hich\f2\dbch\f2\loch\f2\b Custom types will be included in the ALL scan variabletype\b0 : Custom scan scripts will be used along with other default variable types when you are using ALL as a variable type for scanning.\par\par\b Don't store the temporary scanfiles in the windows tempdir\b0 : Specify a new location where cheat engine should store the temporary files. \lang2057\hich\f2\dbch\f2\loch\f2\par\lang1033\hich\f2\dbch\f2\loch\f2\par\lang2057\hich\f2\dbch\f2\loch\f2\par\b MEM_PRIVATE\b0 : Will allow CE to scan 'private' memory. Leave it on in most cases.\par\b MEM_IMAGE\b0 : ...scan memory that is mapped into the view of an image section. Leave it on also.\par\b MEM_MAPPED\b0 : ...scan memory that is mapped into view of a section (file-mapping). Off by default. Slow!\par\par\par\b Thread priority \b0 : Here you can assign a priority to the scan thread used by CE when searching through memory. It is best left on it's default of Higher or one-down on Normal. Setting it too low can cause scans to become very slow, and too high can cause the system to become unre"IHJAsponsive.\par\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b Scan settings\fs20\b0\par} N1Pluginspluginssettingpluginssetting"HelpMacro=1044 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=5 Y1=0 X2=0 Y2=5 sChange=Under Construction sBook=29/12/2009 17:47 sBookPage=29/12/2009 17:48 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f2\fs24\par\fs18 Here you can load new plugins to use with CE. Plugins you select will be added to the list. You can then selectively delete these plugins should you wish.\par\par See here for a description of the \cf2\ul{\field{\*\fldinst HYPERLINK Pluginsystem}{\fldrslt Plugin System}}\cf3\ul0 .\par\hich\f1\dbch\f1\loch\f1\cf0\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b Plugins\fs20\b0\par} N1 Debugger options"assembler-options"assembler-options$HelpMacro=1046 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=38 Y1=0 X2=0 Y2=9 sChange=Under Construction sBook=29/12/2009 17:57 sBookPage=31/12/2010 23:50 sIcon=10 exp=0 sel=0.{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}{\f3 \fswiss \fcharset2 Symbol;}{\f4 \fswiss \fcharset2 Wingdings;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} {\*\listtable {\list\listtemplateid1 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293835675_1;}\listid1293835675 } {\list\listtemplateid2 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293835680_1;}\listid1293835680 } {\list\listtemplateid3 {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} {\listname List1293835698_1;}\listid1293835698 } } {\*\listoverridetable {\listoverride\listid1293835675\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listle"JIKBvel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } \ls1} {\listoverride\listid1293835680\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } \ls2} {\listoverride\listid1293835698\listoverridecount9 {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } {\lfolevel\listoverrideformat\listoverridestartat {\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f3} } \ls3} } \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f2\fs24\par\fs18\i This page will give you access to some options relating to how the handling of instructions works in disassembly view.\i0\par\lang1033\hich\f2\dbch\f2\loch\f2\par\lang2057\hich\f2\dbch\f2\loch\f2\par\b Use Hardware breakpoints (Max 3)\b0 : Opts to use debug registers as the method of breakpointing. This is the default choice, and is the most compatible, although you can only set a max of \lang1033\hich\f2\dbch\f2\loch\f2 4\lang2057\hich\f2\dbch\f2\loch\f2 breakpoints this way. Leave it as this unless you have a specific reason to do so.\par\par\b Use int3 instructions for breakpoints (Unlimited)\b0 : This is the other options available for breakpointing. int3 bytes are used extensively by standalone debuggers such as OllyDBG for breaking on code. There is no limit to how many of these BP's you can set. Although some targets may detected a debugger this way.\par\par\b Replace incomplete opcodes with nops\b0 : NOP stands for No-Operation, and is an assembly command which simply does nothing. When program flow reaches a NOP it simply passes over it as if it wasn't there. NOP's are used to remove code which may, for example, reduce player health in a game. If you modify an instruction and it has a smaller/larger length than the one you replaced, then CE can replace the leftover/broken bytes with these NOP's. Should always be on just for safety purposes.\par\par\b Ask for replace with nop\b0 : Also on by default. This will cause CE to ask you if you want it to replace the leftover bytes with NOP's or whether to leave the broken instruction for you to deal with. You can uncheck this option, which will cause CE to automatically clean-up leftover bytes itself, without prompt.\par\par\lang1033\hich\f2\dbch\f2\loch\f2\b\par Debugger methods:\par\par Use VEHdebugger\b0 : Use this debugger option to avoid debugger detection in some games that are otherwise closing/crashing if you attach the standard windows debugger to them.\par\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \pard\s0\ls1\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Poll for threads: The only implemented option so far.\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\b\par Use windows debugger\b0 : Use the default windows debugger.\par\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \pard\s0\ls2\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Try to prevent detection of the debugger will cause CE to hook the IsDebuggerPresent API, which is commonly used as an anti-debug technique. It will cause the function to always return zero, as so as far as the debugged program is concerned, it;s not been debugged. This will take place once you have attached the debugger for the first time (attaching to a process and clicking yes). It does not guarantee success though, as there are many, many ways to detect a debugger!\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\par\b Use kernelmode debugger\b0 : This will use CE kernel routines for debugging as opposed to the standard windows ones. This is good for hacking a particularly stubborn game which detects a debugger when using conventional means\par\par {\listtext\pard\plain\f3\fs18 \'b7\tab} \pard\s0\ls3\ilvl0\fi-360\li360\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18 Use Global Debug routines: This will cloak the debug registers (DRs), and is therefore good if you are sure that a target is detecting a change in these debug registers.\par {\listtext\pard\plain\f3\fs18 \'b7\tab} Ability to step through kernel code: When stepping and entering kernel code the single stepping will usually get disabled so it continues till you're back in usermode. With this option enabled the stepping will continue. It currently doesn't seem possib"KJLCle to continue from stepping through kernelcode so se it like a one try only option\par\pard\s0\ql\plain\f1\fs24\lang1033\hich\f2\dbch\f2\loch\f2\cf2\fs18\par If you use kernelmode debugger options, you need to run the kernelmoduleunloader before you can use other type of debuggers (windows or VEHdebugger). Or you can simply restart your computer. If you use Global Debug routines, you have to restart your computer before you could use other debuggers. \lang2057\hich\f1\dbch\f1\loch\f1\cf0\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f2\dbch\f2\loch\f2\cf2\b Debugger \lang2057\hich\f2\dbch\f2\loch\f2 options\cf0\fs20\b0\par} N1 Extra (Advanced) extra extra&HelpMacro=1047 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=21 Y1=0 X2=0 Y2=16 sChange=Under Construction sBook=29/12/2009 18:12 sBookPage=01/01/2011 01:34 sIcon=10 exp=0 sel=0g{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs20\par\fs18\i This page is an advanced settings page, and care should be taken before altering anything here. This is the page of most interest to those using CE againt online targets and thus anti-cheat systems, due to the kernelmode and stealth features available here.\par\par\par\b\i0 Query memory region routines\b0 : This will have CE try and 'work out' how memory is allocated in the game. This is needed on some unorthodox targets, particularly online games, or games protected with an anti-cheat system.\par\par\b Read/Write Process Memory\b0 : Forces read and write access to the target processes memory space. This is needed on some targets that are protected as above. It's also a special point of note with some emulators such as PCSX2 for PS2 games running on a Vista/Win7 host machine. You'll need this on to come up with any results at all.\par\par\b Open Process\b0 : This will open a handle to the current process. This is needed for the process watcher and kernelmode debug routines to work (and will get enabled along with those if not already on).\lang1033\hich\f2\dbch\f2\loch\f2\par\lang2057\hich\f2\dbch\f2\loch\f2\par\b Enable the use of the Process Watcher\b0 : Enable this if you can't find a target process in the list. Enable this and then start the game. Choose the process when you see it appear. It uses kernelmode to do this, so requires the below option. It's handy therefore, for cheat-protected titles.\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b Extra (Advanced)\cf0\fs20\b0\par} N1TutorialsTutorialsTutorialsDateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=3 Y1=109 X2=0 Y2=7 HW=Main sBookPage2=1 sBookPage=30/12/2009 19:45 sIcon=13 exp=1 sel=0 sBook=28/12/2008 13:31{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs18\par\lang1033\hich\f1\dbch\f1\loch\f1 This section contains a collection of all useful\lang2057\hich\f2\dbch\f2\loch\f2 , mainly user-submitted,\lang1033\hich\f1\dbch\f1\loch\f1 tutorials originally posted on the cheat engine forum\lang2057\hich\f2\dbch\f2\loch\f2 . This is only a small selection of what is available. There are many more, graphic-rich tutorials on the website on on the rest of the web, that are just not appropriate for this help file. Please search :-)\lang1033\hich\f1\dbch\f1\loch\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn144"LKMD0\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Tutorials\fs20\b0\par} N1*ASM and Hexing Theory$ASMandHexingTheory$ASMandHexingTheoryDateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 HelpMacro=1073 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=0 X2=0 Y2=18 sBookPage2=1 sIcon=13 exp=1 sel=0 sBookPage=30/12/2009 20:29 sBook=03/01/2010 10:54s{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\plain\f2\fs18\par These tutorials cover assembly and gamehacking basics, and theoretical knowledge that is needed to better reverse games. They are generic and don't apply to any specific tool or game.\par\plain\f1\fs18\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b ASM and Hexing Theory\plain\f2\fs24\par} N1Basic assemblerBasicassemblerBasicassemblerHelpMacro=27 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=30/12/2009 20:23 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0Xassembler Basic assembler Auto Assemble ,{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\plain\f1\fs18 Originally posted by Dark Byte + addition by Smidge204\line\line Most people think assembler is very difficult, but in fact it's very easy. \line In this tutorial i'll try to explain how some basic assembler works \line\line The processor works with memory and registers. The registers are like memory but a lot faster than memory. Registers are EAX,EBX,ECX,EDX,ESP,EBP,ESI,EDI, and the segment registers. (There's also EIP, wich is the Instruction Pointer. It points to the instruction that is about to be executed) \line\line Some examples: \line\line\ul sub ebx,eax\plain\f1\fs18 (ebx=00000005,eax=00000002) \line Lets take it apart in it's most basic elements: \line opcode param1,param2 \line\line The opcode is the instruction telling the processor what to do, in this case decrease the value stored in register ebx with the value stored in register eax. \line\line In this case ebx=5 and eax=2 so ebx would be after this instruction 3. (5-3) \line\line Also note that whever you see a opcode with 2 parameters: The first parameter is the target of the instruction. The 2nd is the source \line\line\ul sub [esi+13],ebx\plain\f1\fs18 (ebx=00000003,esi=008AB100) \line In this case you see the first parameter is between brackets. This indicates that instead of registers a memorylocation is being used. \line The memorylocation is pointed at by whats in between the brackets, in this case esi+13 (Note that the 13 is in hexadecimal) \line\line ESI=008AB100 so the address pointed at is 008AB113. \line This instruction would decrease the value stored at location 008AB113 with the value stored in ebx(wich is 3). \line\line If the value at location 008AB113 was 100 then the value stored at 008AB113 after this instruction would be 97. \line\line\ul sub [esi+13],63\plain\f1\fs18 (esi=008AB100) \line This is almost the same as above but instead of using a register it uses a direct value. \line\line Note that 63 is actually 99 because the instruction is always written using hexadecimal. \line\line Lets say the value at 008ab113 is 100 (wich is 64 in hexadecimal) then the value at 008ab113 after execution would be 1 (100-99) \line\line\ul sub ebx,[esi+13]\plain\f1\fs18 (ebx=00000064 esi=008ab100) \line This instruction decreases the value stored in ebx with the value stored at location 008ab113. (esi+13=008ab100+13=008ab113, in case you forgot) \line\line\line Up until now i've only used SUB as instruction, but there are lots and lots of other instructions the procesor knows. \line\line Lets take a look at MOV, one of the most often used instructions \line although it's name sugests that it moves data, it just COPYs data from one spot to another. \line\line MOV works exactly the same as sub. first parameter is the destination, and second parameter is the source. \line\line examples: \line\ul MOV eax,ebx\plain\f1\fs18 eax=5,ebx=12 \line Copies the value stored in ebx into eax \line\line So, if this instruction would be executed eax would be 12. (and ebx would stay 12) \line\line\ul MOV [edi+16],eax\plain\f1\fs18 eax=00000064, edi=008cd200) \line This instruction will place the value of eax(64hex=100 decimal) at the location of edi+16 (008cd200+16=008cd216). \line So after instruction the value stored at 008cd216 will be 100 (64 hex) \line\li"MLNEne As you see, it works just like the SUB instruction. \line\line Then there are also those instructions that only have 1 parameter like inc and dec. \line example: \line inc eax :increase the value at eax with 1 \line dec ecx: decrease the value of ecx with 1 \line dec [ebp]: Decrease the value stored at the address pointed to by ebp with 1. \line\line Right now i've only shown the 32-bit registers (eax, ebx ecx....) but there are also 16-bit register and 8-bit registers that can be used. \line the 16 bit registers are: AX,BX,CX,DX,SP,BP,SI,DI \line the 8 bit register are: AH,AL,BH,BL,CH,CL,DH,DL \line\line Note that when changing ah or al you'll also change AX, and if you change AX you'll also change EAX, same goes for bl+bh+bx+ebx,ch+cl+cx+ecx,dh+dl+dx+edx \line\line You can use them almost the same with the instructions for 32 bit but they will only change 1 (8 bit) or 2(16-bit) bytes, instead of 4 (32-bit) bytes. \line\line example: \line dec al :decreases the 8 bit register al \line sub [esi+12],al :decreases the 1-byte value stored at the location esi+12 points at with the value of al \line mov al,[esi+13]:places the 1-byte value stored at the location esi+13 points in the al register. \line\line Note that it is IMPOSSIBLE to use a 16 or 8 bit register for instructions that point to an address. eg: mov [al+12],0 will NOT work. \line\line There are also 64 and 128 bit registers, but I wont discuss them since they are hardly ever used, and cant be used with the other instructions that also work with 32 bit) \line\line\line Then there are the JUMPS, LOOPS, and CALLS: \line JMP: \line The JMP instruction is the easiest it changes the Instruction Pointer (EIP) to the location the JMP instruction points at and continues from there. \line\line There are also conditional jumps that will only change the instruction pointer if a special condition has met. (for example set using the compare instruncion (CMP)) \line\line JA=Jump if Above \line JNA=Ju,p if not above \line JB=Jump if below \line JE=Jump if equal \line JC=Jump if carry \line and LOTS of other conditional jump \line\line LOOP: \line The loop instruction also points just like the JMP to a memory location, but only jumps to that location if the ECX register is not 0. \line\line and of course, there are also special contitional loops: \line LOOPE:Loop while ecx is not 0 AND the zero flag is not set \line LOOPZ:same as LOOPE. \line LOOPNE:Loop while ECX is not 0 AND the zero flag is set. \line LOOPNZ:Same as LOOPNE \line\line I gues I should also explain what flags are, they are bits in the processor that can be used to check the condition of a previous instruction like 'cmp al,12' if al=12 then the zero flag (ZF) will be set to true, else the Zero flag(ZF) will be set to false. \line\line CALL: \line Call is the same as JMP except it uses the stack to go back. \line\line Explenation of the stack: \line The stack is a location on memory pointed at by the ESP register. \line You can put values in it using the PUSH command, and take out it using the POP command. If you use PUSH it will decrease the ESP register and place the value at the location of ESP. If you use POP it will place the value pointed at by pop into the location pointed at by the parameter of POP and increase the value of ESP. In short: The last thing you push in the stack will be the first thing you pop from the stack, the 2nd last item in will be the 2nd item out. \line\line RET: \line After CALL has pushed the location of the next instruction onto the stack it jumps to that location. (sets the instruction pointer to that location) \line\line After a while it will encounter a RET instruction, and will then jump to the location that is stored in the stack. (Call pushed the location in the stack, ret pops it out again and jumps to that location) \line\line And thats the tutorial on the basics of assembler, if you have questions about assembler and stuff just ask and I'll try to answer. \line\line Nice file to check out if you want more info: \line http://podgoretsky.com/ftp/Docs/Hardware/Processors/Intel/24547111.pdf \line\line note: It's really usefull to understand how those values between brackets work, because then you can make the most use of the pointer stuff in CE 4.1 (It will remove for most games the Dynamic Memory Allocation problem for most games, if you know how how to look at the assembler code that accesses the values you found)\line\line ------------------------------------------------------------------\line\line The "flags" are a set of bits stored in a special register. If the bit is "1" the flag is said to be set, and if it's "0" then the flag said to be "clear". Collectively, the flags tell you all about the processor's internal status and gives more information about the results of previous instructions. \line\line There are three types of flags: Status flags that tell you about the results of the last instruction, Control flags that tell you how the processor will behave, and System flags that tell you about the environment your program is executing it. \line\line The flag register is 32 bits: (S=Status flag, C=Control flag, X=System flag) \line\line\line Code: \line 0 S Carry \line 1 (Reserved) \line 2 S Parity \line 3 (Reserved) \line 4 S Auxiliary Carry \line 5 (Reserved) \line 6 S Zero \line 7 S Sign \line 8 X Trap \line 9 X Interrupt Enable \line 10 C Direction \line 11 S Overflow \line 12 X I/O Privilage (bits 12&13) \line 13 X \line 14 X Nested Task \line 15 (Reserved) \line 16 X Resume \line 17 X Virtual 8086 \line 18 X Alignment Check \line 19 X Virtual Interrupt \line 20 X Virtual Interrupt Pending \line 21 X Identification \line 22 \line 23 | \line 24 | \line 25 | \line 26 |_ (Reserved) \line 27 | \line 28 | \line 29 | \line 30 | \line 31 / \line\line\line Let's go over the status flags, since those are used most often. \line\line Overflow: \line When an operation (Addition, subtraction, multiplication, etc) produces a result that is too big to fit in the register (or memory location) used, the Carry flag is set. (If not, it's cleared automatically) For example, if you're using a 16 bit register and your operation produces a value that won't fit in 16 bits, the carry flag is set. \line\line Sign: \line Set if the result is negative, cleared if positive. This is typically a mirror of MSB (most significant bit) of a value. \line\line Zero: \line Set if result is 0. \line\line Auxiliary Carry: \line Similar to Carry, but it will treat the register/memory location as 3-bits instead of 8, 16 or 32. This is used for BCD (Binary coded decimal) stuff and it generally pretty useless otherwise. \line\line Carry: \line The carry flag is set if the bit one past the lmit of the register/memory location would have been set. For example, mov al, 0xFF then add al, 1 will cause a carry because the 9th bit would have been set. Also note that the overflow and zero flags would be set and sign flag cleared, too! \line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\cf3\fs24\par\cf0\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\b Basic assembler\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} "NMOFN1DWhat is the difference in bytetype:Whatisthedifferenceinbytetype:WhatisthedifferenceinbytetypeHelpMacro=23 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=31/08/2011 23:43 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0valuetype What is the difference in bytetype 3D pinball for windows (pointer+code) {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by emperor:\line\line 2 Byte means: 00 00 to FF FF this allows only up to 65535, obviously. \line 4 byte means: 00 00 00 00 to FF FF FF FF (allows up to 4294967295). \line Now for example you can miss 2 byte values with 4 byte scans: \line example: value in game is 300 stored in game's memory as 012C \line If you search for 12C as 2 Byte it will be in your results. \line If you search for 12C as 4 byte the 2 Bytes before the 012C matter as well. \line For example the 012C would be after an FF FF. \line Meaning: FF FF 01 2C is in the memory 01 2C being what you are searching for. However seen as 4 Byte this is not 01 2C (300) but it's FF FF 01 2 C (4294902060) . \line To my mind for exact value scans you should use the smallest appopirate byte type (for ex if it doesn't rise over 65000 use 2 byte). However since most games multiply it with a certain factor exact value scans are hardly any useful...when doing an unknown value scan it's up to you to chose the correct bytesize...most commonly used is 4 byte after all. It's nothing new to me seeing games showing a stat up to like 2000-3000 as 4 Byte in a huge number over serveral hundret thousands..however how much a certain game multiplies,adds or substracts, or tries to hide it depends on the game, is therefore sort of unknown therefore i think in many cases the bytesize is also sort of unknown although 4 Byte is always likely. Note doing increase/decrease value scans wouldn't fail even if there were some other bytes before it: for ex \line FF FF 01 2C is increased by one... \line ---> FF FF 01 2D increased would still be okay as unknown initial. \line But if the FF FF also changes \line to like FE FE then it would screw up the scan.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b What is the difference in bytetype\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1ASM Basics 1asm-basics-1asm-basics-1$HelpMacro=1074 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=7 Y1=0 X2=0 Y2=11 sChange=Under Construction sBook=30/12/2009 20:30 sBookPage=30/12/2009 20:31 sIcon=10 exp=0 sel=0U{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\ul\i\par Authored by DABhand\ul0\par\plain\f2\fs18\par\fs24\par\plain\f2\fs18 The Basics\par\par\par\par Opcodes\par =====\par\par Ok whats opcodes? An opcode is an instruction the processor can understand. For example\par\par SUB and ADD and DIV\par\par The sub instructions subtracts two numbers together. Most opcodes have operands\par\par SUB destination,source like the following\par\par SUB eax, ecx\par\par SUB has 2 operands. In the case of a subtraction, a source and a destination. It subtracts the source value to the\par destination value and then stores the result in the destination. Operands can be of different types: registers, \par memory locations, immediate values.\par\par So basically that instruction is this, say for example eax contained 20 and ecx contained 10\par\par eax = eax - ecx\par eax = 20 - 10\par eax = 10\par\par Easy that bit huh \par\par\par Registers\par ====== \par\par Ahhh here is the main force of asm, Registers contain values and information which is used in a program to keep \par track of things, and when new to ASM it does look messy but the system is practically efficient. It is honestly \par\par Lets take a look at the main Register used, its eax. Say it contains the value FFEEDDCCh (the h means hexidecimal) \par when working later with softice u will see hex values alot so get used to it now \par\par Ok Ill show how the registers are constructed\par\par EAX FFEEDDCC\par AX DDCC\par AH DD\par AL CC\par\par ax, ah, al are part of eax. EAX is a 32-bit register (available only on 386+), ax contains the lower 16 bits (2 bytes)\par of eax, ah contains the high byte of ax, and al contains the low byte of ax. So ax is 16 bit, al and ah are 8 bit. \par So, in the example above, these are the value"ONPGs of the registers:\par\par eax = FFEEDDCC (32-bit)\par ax = DDCC (16-bit)\par ah = DD (8-bit)\par al = CC (8-bit)\par\par Understand? I know its alot to take in, but thats how registers work Heres some more examples of opcodes and the \par registers used...\par\par mov eax, 002130DF mov loads a value into a register \par mov cl, ah move the high byte of ax (30h) into cl \par sub cl, 10 substract 10 (dec.) from the value in cl \par mov al, cl and store it in the lowest byte of eax.\par\par So at start..\par\par eax = 002130DF\par\par at end\par\par eax = 00213026\par\par Did you follow what happened? I hope so, cause im trying to make this as easy as I can \par\par Ok lets discuss the types of registers, there is 4 types used mainly (there is others but will tell about them later)\par\par\par General Purpose Registers\par ================= \par\par These 32-bit (and their 16bit and 8bit sub registers) registers can be used for anything, but their main purpose is \par shown after them.\par\par eax (ax/ah/al) Accumulator \par ebx (bx/bh/bl) Base \par ecx (cx/ch/cl) Counter \par edx (dx/dh/dl) Data \par\par As said these are hardly used nowadays for their main purpose and is used to ferry arround information within programs \par and games (such as scores, health value etc)\par\par\par Segment Registers\par ============\par\par Segment registers define the segment of memory that is used. You'll probably won't need them with win32asm, because \par windows has a flat memory system. In dos, memory is divided into segments of 64kb, so if you want to define a memory \par address, you specify a segment, and an offset (like 0172:0500 (segment:offset)). In windows, segments have sizes \par of 4gig, so you won't need segments in win. Segments are always 16-bit registers.\par\par CS code segment \par DS data segment \par SS stack segment \par ES extra segment \par FS (only 286+) general purpose segment \par GS (only 386+) general purpose segment \par\par\par Pointer Registers\par ===========\par\par Actually, you can use pointer registers as general purpose registers (except for eip), as long as you preserve their \par original values. Pointer registers are called pointer registers because their often used for storing memory addresses. \par Some opcodes (and also movb,scasb,etc.) use them.\par\par esi (si) Source index \par edi (di) Destination index \par eip (ip) Instruction pointer \par\par EIP (or IP in 16-bit programs) contains a pointer to the instruction the processor is about to execute. So you can't \par use eip as general purpose registers.\par\par\par Stack Registers\par ==========\par\par There are 2 stack registers: esp & ebp. ESP holds the current stack position in memory (more about this in one of the \par next tutorials). EBP is used in functions as pointer to the local variables.\par\par esp (sp) Stack pointer \par ebp (bp) Base pointer \par\par\par MEMORY\par =====\par\par How is the memory used within ASM and the layout of it? Well hopefully this will answer some questions. Bear in mind \par there is more advanced things than what is explained here, but hell you lot arent advanced, so start from the basics \par\par Lets look at the different types..\par\par\par DOS\par ===\par\par In 16-bit programs like for DOS (and Win 3.1), memory was divided in segments. These segments have sizes of 64kb. \par To access memory, a segment pointer and an offset pointer are needed. The segment pointer indicates which segment \par (section of 64kb) to use, the offset pointer indicates the place in the segment itself.\par\par Take a look at this\par\par\par ----------------------------MEMORY-------------------------------- \par |SEGMENT 1 (64kb)|SEGMENT 2 (64kb)|SEGMENT 3 (64kb)|etc...........| \par\par\par Hope that shows well \par\par Note that the following explanation is for 16-bit programs, more on 32-bit later (but don't skip this part, it is \par important to understand 32-bits).\par\par The table above is the total memory, divided in segments of 64kb. There's a maximum of 65536 segments. Now take one \par of the segments:\par\par\par -------------------SEGMENT 1(64kb)---------------------- \par |Offset 1|Offset 2|Offset 3|Offset 4|Offset 5|etc.......|\par\par\par To point to a location in a segment, offsets are used. An offset is a location inside the segment. There's a maximum of \par 65536 offsets per segment. The notation of an address in memory is:\par\par SEGMENT:OFFSET\par\par For example:\par\par 0145:42A2 (all hex numbers remember )\par\par This means: segment 145, offset 42A2. To see what is at that address, you first go to segment 145, and then to offset \par 42A2 in that segment.\par\par Hopefully you remembered to read about those Segment Registers a while ago on this thread.\par\par CS - Code segment\par DS - Data Segment\par SS - Stack Segment\par ES - Extra Segment\par FS - General Purpose\par GS - General Purpose <<< Them remember \par\par The names explain their function: code segment (CS) contains the number of the section where the current code that is \par being executed is. Data segment for the current segment to get data from. Stack indicates the stack segment \par (more on the stacks later), ES, FS, GS are general purpose registers and can be used for any segment (not in win32 though).\par\par Pointer registers most of the time hold an offset, but general purpose registers (ax, bx, cx, dx etc.) can also be \par used for this. IP (Pointer register) indicates the offset (in the CS (code segment)) of the instruction that is \par currently executed. SP (Stack register) holds the offset (in the SS (stack segment)) of the current stack position.\par\par Phew and you thought 16bit memory was hard huh \par\par Sorry if thats all confusing, but its the easiest way to explain it. Reread it a few times it will eventually sink \par into your brain on how memory works and how it is accessed to be read and written too \par\par Now we move to\par\par\par 32-bit Windows\par ==========\par\par You have probably noticed that all this about segments really isn't fun. In 16-bit programming, segments are essential. \par Fortunately, this problem is solved in 32-bit Windows (9x and NT). \par\par You still have segments, but don't care about them because they aren't 64kb, but 4 GIG. Windows will probably even crash \par if you try to change one of the segment registers. \par\par This is called the flat memory model. There are only offsets, and they now are 32-bit, so in a range from 0 to 4,294,967,295. \par Every location in memory is indicated only by an offset. \par\par This is really one of the best advantages of 32-bit over 16-bit. So you can forget the segment registers now and focus \par on the other registers.\par\par Oh the madness of it all, wow 4 gig bits to work with\par\par\par The Fun Part begins!!!\par\par Its\par\par THE OPCODES\par =========\par\par Here is a list of a few opcodes you will notice alot of when making trainers or cracking etc.\par\par 1. MOV\par\par\par This instruction is used to move (or actually copy) a value from one place to another. This 'place' can be a register, \par a memory location or an immediate value (only as source value of course). The syntax of the mov instruction is:\par\par mov destination, source\par\par You can move a value from one register to another (note that the instruction copies the value, in spite of its name \par 'move', to the destination).\par\par mov edx, ecx\par\par The instruction above copies the contents of ecx to edx. The size of source and destination should be the same, this \par instruction for example is NOT valid:\par\par mov al, ecx ; NOT VALID\par\par This opcode tries to put a DWORD (32-bit) value into a byte (8-bit). This can't be done by the mov instruction \par (there are other instructions to do this). But these instructions are allowed because source and destination don't \par differ in size, like for example...\par\par mov al, bl\par mov cl, dl\par mov cx, dx\par mov ecx, ebx\par\par Memory locations are "POQH indicated with an offset (in win32, for more info see the previous page). You can also get a \par value from a certain memory location and put it in a register. Take the following table as example:\par\par offset 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42 \par data 0D 0A 50 32 44 57 25 7A 5E 72 EF 7D FF AD C7 \par\par (each block represents a byte)\par\par The offset value is indicated as a byte here, but it is a 32-bit value. Take for example 3A \par (which isn't a common value for an offset, but otherwise the table won't fit...), this also is a \par 32-bit value: 0000003Ah. Just to save space, some unusual and low offsets are used. All values are hexcodes.\par\par Look at offset 3A in the table above. The data at that offset is 25, 7A, 5E, 72, EF, etc. To put the value at \par offset 3A in, for example, a register you use the mov instruction, too:\par\par mov eax, dword ptr [0000003Ah] ... but.......\par\par You will see this more commonly in programs as\par\par mov eax, dword ptr [ecx+45h]\par\par This means ecx+45 will point to the memory location to take the 32 bit data from, we know its 32bit because of \par the dword in the instruction. To take say 16bit of data we use WORD PTR or 8bit BYTE PTR, like the following examples..\par\par mov cl, byte ptr [34h] cl will get the value 0Dh (see table above)\par mov dx, word ptr [3Eh] dx will get the value 7DEFh (see table above, remember that the bytes are reversed)\par\par The size sometimes isn't necessary:\par\par mov eax, [00403045h]\par\par because eax is a 32-bit register, the assembler assumes (and this is the only way to do it, too) it should take \par a 32-bit value from memory location 403045.\par\par Immediate numbers are also allowed:\par\par mov edx, 5006\par\par This will just make the register edx contain the value 5006. The brackets, [ and ], are used to get a value from \par the memory location between the brackets, without brackets it is just a value. A register as memory location is \par allowed to (it should be a 32-bit register in 32-bit programs):\par\par mov eax, 403045h ; make eax have the value 403045 hex.\par mov cx, [eax] ; put the word size value at the memory location EAX (403045) into register CX.\par\par In mov cx, [eax], the processor first looks what value (=memory location) eax holds, then what value is at that \par location in memory, and put this word (16 bits because the destination, cx, is a 16-bit register) into CX.\par\par Phew \par\par\par 2. ADD,SUB,MUL and DIV\par\par These are easy to understand Good old maths, im sure everyone can add and subtract and multiply and divide \par\par Anyways on with the info \par\par The add-opcode has the following syntax:\par\par add destination, source\par\par The calculation performed is destination = destination + source. The following forms are allowed:\par\par Destination\tab\tab Source\tab\tab\tab Example \par Register\tab\tab Register\tab\tab add ecx, edx \par Register \tab\tab Memory\tab\tab\tab add ecx, dword ptr [104h] / add ecx, [edx] \par Register\tab\tab Immediate value\tab\tab add eax, 102 \par Memory \tab\tab\tab Immediate value\tab\tab add dword ptr [401231h], 80 \par Memory \tab\tab\tab Register\tab\tab add dword ptr [401231h], edx \par\par This instruction is very simple. It just takes the source value, adds the destination value to it and then puts \par the result in the destination. Other mathematical instructions are:\par\par SUB destination, source (destination = destination - source)\par MUL destination, source (destination = destiantion * source)\par DIV source (eax = eax / source, edx = remainer)\par\par Its easy peasy aint it Or is it \par\par Substraction works the same as add, multiplication is just dest = dest * source. Division is a little different. \par Because registers are integer values (i.e. round numbers, not floating point numbers) , the result of a division \par is split in a quotient and a remainder. For example:\par\par 28 / 6 --> quotient = 4, remainder = 4\par 30 / 9 --> quotient = 3, remainder = 3\par 97 / 10 --> quotient = 9, remainder = 7\par 18 / 6 --> quotient = 3, remainder = 0\par\par Now, depending on the size of the source, the quotient is stored in (a part of) eax, the remainder in (a part of) edx:\par\par Source\tab\tab size\tab\tab Division\tab\tab Quotient stored in\tab Remainder Stored in... \par BYTE\tab\tab (8-bits)\tab ax / source\tab\tab\tab AL\tab\tab\tab AH \par WORD\tab\tab (16-bits)\tab dx:ax* / source\tab\tab\tab AX\tab\tab\tab DX \par DWORD\tab\tab (32-bits)\tab edx:eax* / source\tab\tab EAX\tab\tab\tab EDX \par\par * = For example: if dx = 2030h, and ax = 0040h, dx: ax = 20300040h. dx:ax is a dword value where dx represents the \par higher word and ax the lower. Edx:eax is a quadword value (64-bits) where the higher dword is edx and the lower eax. \par\par The source of the div-opcode can be:\par\par an 8-bit register (al, ah, cl,...) \par a 16-bit register (ax, dx, ...) \par a 32-bit register (eax, edx, ecx...) \par an 8-bit memory value (byte ptr [xxxx]) \par a 16-bit memory value (word ptr [xxxx]) \par a 32-bit memory value (dword ptr [xxxx]) \par\par The source can not be an immediate value because then the processor cannot determine the size of the source operand. \par\par\par 3. BITWISE OPS\par\par These instructions all take a destination and a source, exept the 'NOT' instruction. Each bit in the destination is \par compared to the same bit in the source, and depending on the instruction, a 0 or a 1 is placed in the destination bit:\par\par Instruction\tab AND OR XOR NOT \par Source Bit \tab |0 0 1 1|0 0 1 1|0 0 1 1|0 1| \par Destination Bit |0 1 0 1|0 1 0 1|0 1 0 1|X X| \par Output Bit \tab |0 0 0 1|0 1 1 1|0 1 1 0|1 0| \par\par AND sets the output bit to 1 if both the source and destination bit is 1.\par OR sets the output bit if either the source or destination bit is 1\par XOR sets the output bit if the source bit is different from the destination bit.\par NOT inverts the source bit.\par\par An example:\par\par mov ax, 3406\par mov dx, 13EAh\par xor ax, dx\par\par ax = 3406 (decimal), which is 0000110101001110 in binary.\par dx = 13EA (hex), which is 0001001111101010 in binary. \par Perform the XOR operation on these bits:\par\par\par Source \tab\tab 0001001111101010 (dx) \par Destination\tab 0000110101001110 (ax) \par Output \tab\tab 0001111010100100 (new dx) \par\par The new dx is 0001111010100100 (7845 decimal, 1EA5 in hex) after the instruction.\par\par Another example:\par\par mov ecx, FFFF0000h\par not ecx\par\par FFFF0000 is in binary 11111111111111110000000000000000 (16 1's, 16 0's)\par\par If you take the inverse of every bit, you get:\par 00000000000000001111111111111111 (16 0's, 16 1's), which is 0000FFFF in hex.\par\par So ecx is after the NOT operation 0000FFFFh.\par\par The last one is handy for serial generating, as is XOR. Infact XOR is used more for serials than any other instruction, \par widely used for serial checking in Winzip, Winrar, EA Games, Vivendi Universalis\par\par I WONT TELL YOU HOW TO MAKE KEYGENS SO DONT ASK :)\par\par 4. INC/DEC(REMENTS) \par\par There are 2 very simple instructions, DEC and INC. These instructions increase or decrease a memory location or \par register with one. Simply put:\par\par inc reg -> reg = reg + 1\par dec reg -> reg = reg - 1\par inc dword ptr [103405] -> value at [103405] will increase by one.\par dec dword ptr [103405] -> value at [103405] will decrease by one.\par\par Ahh easy one to understand So is the next one \par\par\par 5. NOP\par\par This instruction does absolutely nothing. This instruction just occupies space and time. It is used for filling purposes \par and patching codes.\par\par\par 6. BIT rotation and shifting\par\par Note: Most of the examples below use 8-bit numbers, but this is just to make the picture clear.\par\par Shifting functions\par\par SHL destination, count\par SHR destination, count\par\par SHL and SHR shift a count number of bits in a register/memlocation left or right.\par\par Example:\par\par ; al = 01011011 (binary) h"QPRIere\par shr al, 3\par\par This means: shift all the bits of the al register 3 places to the right. So al will become 00001011. The bits on the left \par are filled up with zeroes and the bits on the right are shifted out. The last bit that is shifted out is saved in the \par carry-flag. The carry-bit is a bit in the processor's Flags register. This is not a register like eax or ecx that you \par can directly access (although there are opcodes to do this), but it's contents depend on the result of the instruction. \par This will be explained later, the only thing you'll have to remember now is that the carry is a bit in the flag register \par and that it can be on or off. This bit equals the last bit shifted out.\par\par shl is the same as shr, but shifts to the left.\par\par ; bl = 11100101 (binary) here\par shl bl, 2 \par\par bl is 10010100 (binary) after the instruction. The last two bits are filled up with zeroes, the carry bit is 1, because \par the bit that was last shifted out is a 1. \par\par\par Then there are two other opcodes:\par\par SAL destination, count (Shift Arithmetic Left)\par SAR destination, count (Shift Arithmetic Right)\par\par SAL is the same as SHL, but SAR is not quite the same as SHR. SAR does not shift in zeroes but copies the MSB \par (most significant bit - The first bit if 1 it moves 1 in from the left, if 0 then 0's will be placed from left). Example:\par\par al = 10100110\par sar al, 3\par al = 11110100\par sar al, 2\par al = 11111101\par\par bl = 00100110\par sar bl, 3\par bl = 00000100\par\par This one you may have problems to get to grips with \par\par Rotation functions\par\par rol destination, count ; rotate left\par ror destination, count ; rotate right\par rcl destination, count ; rotate through carry left\par rcr destination, count ; rotate through carry right\par\par Rotation looks like shifting, with the difference that the bits that are shifted out are shifted in again on the other side:\par\par Example: ror (rotate right)\par\par\par\tab\tab Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 \par Before\tab\tab\tab 1 0\tab 0\tab 1 1 0 1 1 \par Rotate count 3\tab\tab 1 0 0 1 1 0 1 1 (Shift out) \par Result \tab\tab\tab 0 1 1 1 0 0 1 1 \par\par As you can see in the figure above, the bits are rotated, i.e. every bit that is pushed out is shift in again on the \par other side. Like shifting, the carry bit holds the last bit that's shifted out. RCL and RCR are actually the same as \par ROL and ROR. Their names suggest that they use the carry bit to indicate the last shift-out bit, which is true, \par but as ROL and ROR do the same, they do not differ from them.\par\par\par 7. Exchange\par\par Quite Straightforward this, I wont go into major details, it just swaps the values of two registers about \par (values, addresses). Like example..\par\par eax = 237h\par ecx = 978h\par xchg eax, ecx\par eax = 978h \par ecx = 237h \par\par Anyways end of day 1, if you learn this into your head the following days will get easier than harder. This is the basics \par ive taught you. Learn em well.\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b ASM Basics 1\plain\f2\fs24\par} N1ASM Basics 2asm-basics-2asm-basics-2$HelpMacro=1075 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=0 X2=0 Y2=12 sChange=Under Construction sBook=30/12/2009 20:30 sBookPage=30/12/2009 20:31 sIcon=10 exp=0 sel=0-{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\lang2057\hich\f2\dbch\f2\loch\f2\ul\i\par Authored by DABhand\par\plain\f2\fs18\par\par\par FLOATS\par ======\par\par\par\par Ok whats a Float all about, well its simple, a float uses REAL values, what is a REAL value?\par\par\par A REAL value is a number which is not an integer, i.e. it contains numbers after a decimal\par point, like for example a float opcode can work out 5 divided by 4 and give the answer 1.25,\par also a REAL value can contain NEGATIVE numbers also like -3.567\par\par\par An integer with the same math problem will report 1 as the quotient with a remainder of 1. So \par you can see Floats are very usefull indeed :)\par\par\par Why are we talking about floats? Some games and indeed applications will use float values to\par either work out monetary values or even in a game like percentage values and so forth.\par\par\par Both my latest trainers for Act of War and Settlers 5 (Die Siedler 5) use float values.\par\par\par\par FLOAT OPCODES\par =============\par\par\par Here is a list of opcodes and what they do :)\par\par\par FLD [source] Pushes a Float Number from the source onto the top of\par the FPU Stack.\par\par FST [destination] Copies a Float Number from the top of the FPU Stack\par into the destination.\par\par FSTP [destination] Pops a Float Number from the top of the FPU Stack\par into the destination.\par\par FLDZ Pushes +0.0 on top of FPU Stack\par\par FLD1 Pushes +1.0 on top of FPU Stack\par\par FLDPI Pushes PI on the top of FPU Stack\par\par FILD [source] Pushes an integer from the source to the top of the\par FPU Stack.\par\par FIST [destination] Copies an integer from the top of the FPU Stack to\par the destination.\par\par FISTP [destination] Pops an integer from the top of FPU Stack into the\par destination.\par\par FCHS Compliments the sign-bit of a float value located on\par the top of the FPU Stack or ST(0) Register.\par\par FNOP Performs no FPU Operation.[It's a 2 byte instruction\par unlike that of NOP which is a 1 byte instruction"RQSJ.]\par\par FABS Replaces the float value on the top of the stack with\par it's absolute value.\par\par FADD [operand] Adds the value of the operand with the value located\par on the top of the FPU Stack and store the result on\par the top of the FPU Stack.\par\par FCOS/FSIN Replaces the value on the top of the FPU Stack with\par it's cosine/sine value.\par\par FDIV [operand] Divide the value on the top of the FPU Stack with the\par operand and store the result on the top of FPU Stack.\par\par FMUL [operand] Multiply the value on the top of the FPU Stack with\par the operand and store the result on top of FPU Stack.\par\par FSUB [operand] Subtract operand value from the value on top of FPU\par Stack and store the result on top of FPU Stack.\par\par FXCHST (index) Exchanges values between top of FPU Stack and the\par ST(index) register.\par\par FCOM Compares the float value located on top if FPU Stack\par with the operand located in memory or the FPU Stack.\par\par FCOMP Same as FCOM but pops the float value from the top of\par the FPU Stack.\par\par FNSTSW AX Store FPU Status Word in AX. (Used for Conditions)\par\par\par Hope thats explanatory enough :)\par\par\par Before I show an example or two, lets talk about Stacks. What are they?\par\par\par\par STACKS\par ======\par\par\par Well a stack is used for a temporary location for values, a game or application may\par want to use a register for something else but want to keep the previous value for\par future reference, so the program will PUSH a value onto the stack for later\par retrieval.\par\par\par The stack is 8 small stacks in the 1, so look at it as a small filing\par cabinet in a way. Any of these values can be retrieved by calling for the stack and\par its position, like the following\par\par\par st(0) - always the top of the stack\par st(1) - next after top\par st(2) - 2nd from the top\par ..\par st(7) - Bottom of the stack\par\par\par So when you want to get a value you can if you know where it is stored, it does\par become a little complicated if you keep PUSH'ing values to the top of the stack as\par the previous value is moved down 1. So to take a value we just POP it back.\par\par\par So remember\par\par PUSH - Places a value on a stack\par POP - Removes a value from the stack\par\par\par But those opcodes are handy for integer values, what about floats?\par\par\par The next section will show you.\par\par\par\par FLOAT EXAMPLES\par ==============\par\par\par\par OK how to PUSH and POP values from the stack, its not difficult, heres a few\par examples :)\par\par\par Example 1\par\par Say we have a value in a known address which is a REAL value (so float) and want\par to add a value to it? For arguments sake lets say the register EAX contains the\par address 450000h which contains money in a game and we want to add a value from\par revenue which resides in an address contained in register EBX at 450008h and\par then send back to the original address?\par\par\par Here is how\par\par\par FLD [eax] - This opcode PUSH's the value at the address 450000h contained in \par EAX and pushes it to the top of the stack\par\par FADD [ebx] - This then adds the value at the address 450008h contained in EBX \par with the value at the top of the stack, then replaces the value \par at the top of the stack with the new value from the FADD opcode.\par\par FSTP [eax] - This then POP's the value on top of the stack to the address 450000h\par contained in the register EAX, where your old money value was and\par replaces with new one.\par\par\par\par Example 2\par\par Say now we want to calculate a Health Points value after taking damage, but wait!\par The damage is a float value but health is integer :o So how does this work out??\par Its not difficult ill show you how :) Again we will use the last registers for\par this example, EAX (450000h) contains our Health integer value and and EBX (450008h)\par contains our damage float value.\par\par\par Here it is\par\par\par FILD (EAX) - This opcode PUSH's an integer value to the top of the stack from the\par address 450000h contained in EAX.\par\par FSUB (EBX) - This subtracts the value at address 450008h (float) contained in EBX \par from the value at the top of the stack.\par\par FISTP (EAX) - This opcode POP's an integer value from the the top of the stack to\par the address 450000h contained in EAX. If the REAL value was 1.50 or \par higher it will send as an integer of 2, if 1.49 or lower then it will \par send as 1.\par\par\par Great huh :) See its not that difficult to understand :)\par\par\par\par Example 3\par\par This one is a toughy, we have a game but one of the addresses in the EAX register is\par needed for later on, but we also need the EAX register to work out a new ammo value,\par and no other register is free to send the address to, omg what to do what to do!!\par\par Dont worry, believe in the stacks :) The following will contain POP and PUSH command :)\par\par So for this example, EAX contains the value 800000h, the ammo value is contained\par at the address 450000h and the EBX contains the address 450008h which contains the\par either positive or negative number to be added to the ammo amount, if negative a shot\par was fired, if positive then a reload of the weapon or ammo picked up.\par\par\par PUSH EAX - This opcode PUSH's the value of EAX (notice without the [ ] it moves\par the value in EAX to the stack but if it had the [ ] it would move\par the value contained at the address of the value in EAX). In this\par case 800000h is PUSH'd on top of the stack.\par\par MOV EAX, 450000h - This opcode moves the value 450000h into the register EAX, which\par replaces the old 800000h value.\par\par FILD [EAX] - This opcode as you know will PUSH the value at the address contained\par in the register EAX, see the difference its using the [ ] so the\par game will look at the address 450000h and take the value there, and\par the PUSH to the top of the stack.\par\par FADD [EBX] - This again is self explanatory now, it adds the value at address\par 450008h with the value on the stack, if it was a negative number it\par will decrease the value, if positive increase it, just basic maths :)\par\par FISTP [EAX] - Again this POP's an integer value from top of stack to the memory\par location contained in EAX, which is 450000h.\par\par CALL 46AEFF - What the hell is this??? I hear you say, wait a bit ill tell you\par just after :)\par\par POP EAX - This opcode POP's the original 800000h back into the register EAX, so\par the game hasnt lost that value.\par\par\par OK, the CALL opcode, its a handy opcode for the fact that if your program or game uses\par a routine to work out something but is always used it would be messy code if we were to\par keep manually typing it out not to mention a much bigger file.\par\par\par The CALL opcode, calls the opcodes at a certain address to work out the same function\par it does later on, so you only need to have that 1 set of opcodes for the entire program\par or game, you just CALL it, saves time and space.\par\par\par At the end of these opcodes from a CALL will be an opcode call RET (return) it will make\par the program or game go back to where it left off, in this case to the POP EAX opcode"SRTK.\par\par\par\par Thats end of day 2 :)\par\par\par Hope you understood and it helped you see how things work.\par\par\par Any questions just post and ill answer when available :)\par\par\par Next time I will talk about different Jumps and Compares :)\par\par\par After that Ill show you how to code inject to make a trainer :D But as I said learn these\par well and you will understand what im talking about when code injecting ;)\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\b ASM Basics 2\plain\f2\fs24\par} N1ASM Basics 3asm-basics-3asm-basics-3(HelpMacro=1076 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=10 Y1=26 X2=0 Y2=12 sChange=Under Construction sBook=30/12/2009 20:31 sBookPage=30/12/2009 20:33 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\lang2057\hich\f2\dbch\f2\loch\f2\ul\i\par Authored by DABhand\fs24\ul0\i0\par\par\par\plain\f2\fs18 CONDITIONALS AND JUMPS\par ======================\par\par\par Ok this will be the last one for a while to show you, as they get more and more advanced.\par\par Learning the 3 days very well, should well be enough to do easy and simple trainers and\par how to find the values.\par\par First I want to talk about Flags, what the hell are flags???\par\par Well its not that difficult to understand.\par\par\par Flag registers\par ==============\par\par\par The flag register has a set of flags which are set/unset depending on calculations or \par other events. Here is the more important ones.\par\par\par ZF (Zero flag)\par This flag is set when the result of a calculation is zero (compare is actually a substraction \par without saving the results, but setting the flags only).\par\par SF (Sign flag)\par If set, the resulting number of a calculation is negative.\par\par CF (Carry flag)\par The carry flag contains the left-most bit after calculations.\par\par OF (Overflow flag)\par Indicates an overflow of a calculation, i.e. the result does not fit in the destination.\par\par\par There is other flags some which you will never use so I wont talk about them.\par\par\par Jumps\par =====\par\par\par\par Heres a list of the Opcodes for Jumps\par\par\par Opcode \tab\tab Meaning \tab\tab\tab\tab Condition \par JA \tab\tab Jump if above \tab\tab\tab\tab CF=0 & ZF=0 \par JAE \tab\tab Jump if above or equal \tab\tab\tab CF=0 \par JB \tab\tab Jump if below \tab\tab\tab\tab CF=1 \par JBE \tab\tab Jump if below or equal \tab\tab\tab CF=1 or ZF=1 \par JC \tab\tab Jump if carry \tab\tab\tab\tab CF=1 \par JCXZ \tab\tab Jump if CX=0 \tab\tab\tab\tab register CX=0 \par JE \tab\tab (is the same as JZ) Jump if equal \tab ZF=1 \par JG \tab\tab Jump if greater (signed) \tab\tab ZF=0 & SF=OF \par JGE \tab\tab Jump if greater or equal (signed) \tab SF=OF \par JL \tab\tab Jump if less (signed) \tab\tab\tab SF!=OF \par JLE \tab\tab Jump if less or equal (signed) \tab\tab ZF=1 or SF!=OF \par JMP \tab\tab Unconditional Jump \tab\tab\tab - \par JNA \tab\tab Jump if not above \tab\tab\tab CF=1 or ZF=1 \par JNAE \tab\tab Jump if not above or equal \tab\tab CF=1 \par JNB \tab\tab Jump if not below \tab\tab\tab CF=0 \par JNBE \tab\tab Jump if not below or equal \tab\tab CF=1 & ZF=0 \par JNC \tab\tab Jump if not carry \tab\tab\tab CF=0 \par JNE \tab\tab Jump if not equal \tab\tab\tab ZF=0 \par JNG \tab\tab Jump if not greater (signed) \tab\tab ZF=1 or SF!=OF \par JNGE \tab\tab Jump if not greater or equal (signed) \tab SF!=OF \par JNL \tab\tab Jump if not less (signed) \tab\tab SF=OF \par JNLE \tab\tab Jump if not less or equal (signed) \tab ZF=0 & SF=OF \par JNO \tab\tab Jump if not overflow (signed) \tab\tab OF=0 \par JNP \tab\tab Jump if no parity \tab\tab\tab PF=0 \par JNS \tab\tab Jump if not signed (signed) \tab\tab SF=0 \par JNZ \tab\tab Jump if not zero \tab\tab\tab ZF=0 \par JO \tab\tab Jump if overflow (signed) \tab\tab OF=1 \par JP \tab\tab Jump if parity \tab\tab\tab\tab PF=1 \par JPE \tab\tab Jump if parity even \tab\tab\tab PF=1 \par JPO \tab\tab Jump if paity odd \tab\tab\tab PF=0 \par JS \tab\tab Jump if signed (signed) \tab\tab SF=1 \par JZ \tab\tab Jump if zero \tab\tab\tab\tab ZF=1 \par\par\par As you can see, jumps have conditions set to them from a previous calculation, test or compare.\par\par\par Look at this example\par\par\par TEST EAX,EBX\par JE 004822FFh\par MOV EAX,EBX\par JMP 004822FFh\par\par\par This little example basically tests two values to see if they are equal, if so the program\par will move the value 1 into the Zero Flag (ZF), thus allowing the conditional jump (JE) to\par goto a memory location to execute opcodes there.\par\par Now if it wasnt equal, the program will move 0 into ZF, and will skip the JE instruction, then\par move the value in the EBX register to the EAX register, forcing to be equal then doing an\par unconditional jump (JMP) to the same memory location.\par\par Games can use this, some games have a real address for values and a (what I like to call)\par ghost address, the ghost address is where the value to be shown on the game is used, but\par if a check like above exists, no matter what you force into that address will revert back\par to the real one.\par\par Im sure anyone trying to scan memory addresses for a game may have came up against this at\par one point.\par\par Other opcode that can be used is\par\par\par CMP register, register/value\tab\tab - Compare two values and move 0 or 1 into appropriate\par Flags.\par\par\par\par Ok thats enough for now, ive taught you basic ASM opcodes, floats and Conditional Jumps.\par\par\par This should be all you need to train a game :)\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 D"TSULefault Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\b ASM Basics 3\plain\f2\fs24\par} N1*Cheat Engine specific&CheatEnginespecific&CheatEnginespecificDateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 HelpMacro=1071 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=4 Y1=0 X2=0 Y2=21 sBookPage2=1 sIcon=13 exp=1 sel=0 sBookPage=30/12/2009 20:29 sBook=03/01/2010 10:54{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs18\par These are tutorials that are specific to Cheat Engine. That is, they all tell you how to go about doing something within Cheat Engine. These are good for finding tips about how to better use the software, and good for first-timers learning their way around it.\par\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs24\b Cheat Engine specific\b0\par} N1RRemote desktop instead of network versionHRemotedesktopinsteadofnetworkversionHRemotedesktopinsteadofnetworkversionHelpMacro=30 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=28/12/2008 11:48 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0Remote desktop instead of network version client network remote desktop server {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf0\fs18 Originally posted by Zhoul:\line\line *Pre-Req!!! Windows XP Professional - (Not Home) - Upgraded to SP2. Worry not, hacked TCPIP DLL's are talked about below.* \line\line When I first started using cheat engine, I thought it was fantastic! I hated to have to alt+tab, and am usually using 2 PC's anyhow, so I loved the fact that it came with a network client. \line\line The problem(s)? The network client didn't do as good a job, because when I tried to do things like 'See what writes to this value', It would usually end up crashing my game, mostly the very first time I tried doing it. The network client also had more bugs and lacked the newer features. \line\line I fiddled with the settings *a lot*, trying to see if it was something I was doing wrong, or a config option that wasn't set properly. To no avail. \line\line I then launched a massive search for another software/debugger that had a network client, but stumbled upon something I think is a lot better. \line\line Basically, Microsoft messed around with giving us concurrent remote desktop + console sessions. Meaning: The ability to be logged into the console, and still connect remotely, without logging the console session out. They scrapped the idea later, because of licensing. They had released termserv.dll in a beta version of SP2, and of course, it was preserved by techies everywhere. \line\line I quickly installed the new termserv.dll, grinning from ear to ear, rebooted my PC, then tried to login remotely. \line\line Ack! Console session was logged out! Ahh!!! I get it... the same user cannot login twice. So I created a 2nd admin account, and that solved *that* problem. \line\line I then loaded up a game on my main PC and remote desktop'd to it, and loaded up cheat engine on the other. \line\line ACK!! User wasn't allowed to debug?! \line\line I quickly loaded up gpedit.msc and navigated its non-logical tree structure and finally found an option that lets you specify who has rights to debug programs (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Access > Debug programs). Gave my new user rights to debug then tried again. \line\line ACK! I still wasn't allowed to 'connect' to my game, as microsoft does not allow us to 'peek' into a process that was run by another user. \line\line Yet another hurdle I soon passed over, by using a command known as "RunAs". I had to run Cheat Engine.exe AS the console user. I figured this out quite quickly, because I already use it to run internet explorer as a 'guest' account (I'll tell ya, doing that beats out any spyware/virus scanner I've ever used.) \line\line ---------------------------------------"UTVM------------------------------ \line To sum up what is needed: \line\line - Windows XP PROFESSIONAL with SP2 installed (this is a must. I didn't want to go to SP2, but had to. This termserv.dll will *NOT* work with XPSP1). \line - Install the termserv.dll which is linked at the bottom of this post, or find an installer version of it via google. \line - Make sure the service "Fast User Switching" is enabled. Usually is by default, but some of us like to slim down XP to essential processes, and this is notoriously disabled by folks like us (and notoriously the reason people can't get concurrent terminal services working). \line - Create a 2nd administrator account and MAKE SURE to login as that user locally, before you try to do it via remote desktop. New users aren't entirely 'created' until their first login. \line - Load gpedit.msc (from start>run), and give your new user access to debug programs. (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Access > Debug programs). \line - Login via remote desktop, as your new user. \line - Create an icon for cheat engine, that does something like this... \line runas.exe /savecred /profile /user:"MyConsoleSession" "J:EngineEngine.exe" \line --------------------------------------------------------------------- \line\line Of course, replace "MyConsoleSession" with the username that you use to login to the console with. In my case, Zoultan was the console/original username, Zoultan2 was the remote desktop session, so I would put Zoultan where MyConsoleSession is. \line\line Also, change the path to cheat engine.exe \line\line The good thing about runas, is the /savecred switch. The first time you run it, you will be prompted for the password. This will be saved and not asked for again. \line\line\line I run things as other users a lot, so I created a batch file to do so, then placed it in C:. You don't need this to use cheat engine, but I'll pass it out for those who are interested in it. \line\line ------------ START - Cut below this line but not the line itself ------------ \line @echo off \line set Uname=Zoultan \line\line set Arg=%1 \line SHIFT \line\line :parseArgs \line if "%1" == "" goto RunAz \line set Arg=%Arg% %1 \line SHIFT \line goto parseArgs \line\line\line :RunAz \line If NOT DEFINED Arg ( \line echo. \line echo No program or paramaters were specified. \line echo. \line goto End \line ) \line\line rem The following 2 lines were placed here, to handle .msc's as if they were EXE's. I was tired of having to run mmc.exe . \line set ArgPart=%Arg:"=% \line set ArgPart=%ArgPart:~-3% \line if "%ArgPart%" == "msc" set Arg=%windir%.exe %Arg% \line\line echo. \line echo. \line echo. \line echo Running [ %Arg% ] As [ %Uname% ] \line echo Command: runas.exe /savecred /profile /user:"%Uname%" "%Arg%" \line runas.exe /savecred /profile /user:"%Uname%" "%Arg%"|rem \line echo. \line echo. \line if NOT "%errorlevel%" == "0" echo There has been an error while trying to run %Arg% as %UName% \line goto End \line\line\line :END \line set Arg= \line set ArgPart= \line set Uname= \line ping -n 5 127.0.0.1|rem \line ------------ END - Cut above this line but not the line itself ------------ \line\line Of course, you would change the set Uname=Zoultan line to match the user you want to runas. It could even be changed to accept the username via command line, but this was written specifically to launch as 1 user (and I created 2 other batch files for my other users). \line\line All my CE icons are setup like so... \line Z.bat "J:Engine 1engine.exe" \line Z.bat "J:Engine 2engine.exe" \line etc... etc... etc... \line\line Another reason I setup this .bat is so I could run things like task manager from my remote desktop session. Even though a remote admin can kill another admins processes, they can't do things like "Set Affinity", etc. So when I'm disallowed the ability to do something, I just use z to launch the program, and voila' \line\line You can also run things like regedit.exe , from console, as your remote desktop user, if you're g33ky enough to want to change other users settings without having to login as that user. \line\line Lastly: If you're curious why the .bat file pings 127.0.0.1 (local host)... XP didn't come with a wait or sleep command. Therefore, in my batch files, I use ping and re-direct its output to rem (null essentially). What this does, is leaves the dos window up for 5 seconds, so I can catch the success/error messages, without having to use pause. \line\line Remote Desktop Terminal Services Hack: \line http://sig9.com/articles/concurrent-remote-desktop \line\line If this link doesn't work in the future, then use google, and search for... \line xp sp2 terminal services hack \line There is hella-documentation on this ... undocumented feature =) \line\line - Zhoul\line\cf3\fs24\par\cf2\par} '{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\b Remote desktop instead of network version\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1Searching TipSearchingTipSearchingTipHelpMacro=29 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0vSearching Tip Remote desktop instead of network version {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf0\fs18 Originally posted by Smidge204\line\line When searching for a value in memory using the scan, here are a few pointers to find the value quickly: \line\line 1) If the value is known, but the format is not (ie: Byte, 2 Bytes, 4 Bytes...) search for the smallest type that will hold the data. \line\line For example, if the value you want is 60, search for bytes. If the value is 1224, search for 2 Byte values, etc. The idea being that if the actual format is larger (You searched for 2 by"VUWNte values but it's actually a 4 byte values) then the other bytes would be 0 anyway and the value would still be found. \line\line But if you search for a 4 byte value when it's really less, you might never find it because you're reading nearby bytes as well that might screw up your search! \line\line\line 2) If the value is unknown, use the "Unknown initial value" scan along with method 1 (ie: always use bytes unless you happen to know it's size). Then do something that changes it's value. \line\line Once the value has changed, repeat the scan using "Changed values". This will filter out all the crap. \line\line Now go back into the game and do a bunch of stuff that DOESN'T change the value, if possible. Now repeat the scan for "Unchanged values". This will filter out stuff like position values, timers and counters. \line\line Keep repeating until you've widdled down the searches to a managable amount, then add all the results to your list and keep an eye on them as the game runs. Remove anything that changes when it logically shouldn't. Anything that's left, try plugging in random values and see if something happens! \line\line\line 3) If you've found a bunch of good values, and youre looking for information that is somewhat related (Such as Lives and money, or whatever) , try restricting your search range to within a few kilobytes of the known value either way. This is especially powerful when looking for values in tables (High score list, for example) since they tend to be right next to eachother. \line\line\line 4) Use "Bigger than" and "Smaller than" as often as possible, especially after scans for changed or unchanged values. This can generally wittle down the results pretty fast. \line\line\line 5) Use arrays to peek at multiple byte values at once. Useful for detecing patterns! \line\line\line\line 6) Sometimes string values are not stored as ASCII strings, so the "Text" search doesn't work. For example, "A" might be stored as 0x01 instead of 41. If that's the case, and you have control over the value in-game (character name?) then try these steps: \line\line -Set the character name \line -Search for "Unknown initial value" \line -Change name \line -Search for "Changed values" \line (Repeat above two steps to eliminate as much junk as possible. See also tip #2) \line -Change name to all the same characters. ie: "AAAAAAA". Try to max out the space you're given. \line -Search one more time for changed values. If you've increased the number of displayed results enough to get a list, scroll down and see if you have a bunch of consecutive memory locations that have the same value. (Should be the same as the length of the string!) \line -Add the first address to your list as an array equal to the length of the string you entered. \line -Change name to an easily identifiable pattern. ie: "ABCDEFG" \line -See if the bytes in your array changed to a similar pattern. If so, start mapping the characters to their values and you're done! \line\line Once you have the character map, you can use it to "translate" other text you couldn't find before. Simply search for an array of bytes and enter in the expected values of each letter in order. \line\line\line Hope that helps! \line =SMidge=\line\cf3\fs24\par\cf2\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\fs24\b Searching Tip\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1JCode Injection and the auto assembler@CodeInjectionandtheautoassembler@CodeInjectionandtheautoassemblerHelpMacro=28 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=30/12/2009 20:23 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=108 Y1=0 X2=0 Y2=0Auto Assemble Code Injection and the auto assembler assembler code injection Searching Tip D9{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf0\fs18 Originally posted by scribly:\line\line Lets say you've found the code that decreases your health \line Problem is that it seems to also affect the health of your opponents, and somehow you can't seem to find the basepointer. \line In those cases doing some code injection using CE's auto assembler is the easiest solution \line\line There are several ways code injection can help solve this problem. \line One method is finding another code that accesses your health, but does it only for your own health. (e.g the code that is used to display your current health) \line There inject some code that stores the address of your health to a address you can find back again (more on that later) \line Then in the code that decreases your health inject some code that checks if the address changes is the address stored by the other routine, if it is, skip the code, otherwhise, just decrease the health, or even create a instant kill cheat by decreasing the health of opponents by a really big value. \line\line Now for the auto assemble script part: \line lets say that at 00405000 is the code that reads your health: mov eax,[esi+ecx*4] \line and at 00421000 is the code that decreases the health of enemies: mov [esi+ecx*4],edx \line\line First allocate some memory to place your code in, and to allocate space for variables, use alloc(name,size) for that. \line Alloc allocates a region of memory with read,write and execute access. (be aware, this wont work in windows me, 98 or 95 so please upgrade if you are using those ancient os's) \line So: \line Code: \line\line alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024 bytes \line alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management \line alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have to be 8 byt"WVXOes) \line \line\line\line\line Now, write your injecthealthreader routine to store the address, and place a jump to your original code as well. dont forget that when placing a jump to your code cave keep in mind that if the instruction was larger than a jump to nop the remaining bytes, and in case of the jump being bigger than the instruction also save the other instruction, AND nop incomplete bytes. Jumps are 5 bytes. \line So in the case of "mov eax,[esi+ecx*4]" the bytecode is 8b 04 8e (3 bytes) so you'll also need to save the instruction after it. Let's say it's followed by a "mov ecx,[esi+edx*4+4]" , bytecode=8b 4c 8e 04 (4 bytes), so now we have 7 bytes to place our jump, thats more than enough. So we'll have to place 2 nops after the jump (7-5=2) \line\line\line Code: \line\line 00405000: \line jmp InjectHealthAddress //jump to the codecave \line nop //nops for the lost space \line nop \line returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down 00405007 when jumping back, just to make it easy....) \line\line\line injectHealthReader: \line push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save and restore registers \line lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax \line mov [playerhealthaddress],eax \line pop eax //restore the register, again, not needed here, but good habbit to do \line\line originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed here \line mov eax,[esi+ecx*4] //read health \line mov ecx,[esi+edx*4+4] //read something else, my gues, armor \line\line jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash... \line \line\line\line As you see to specify a exact address just type it in ended with a ':' . Everything you type in after that will get assembled on and after that address (the jump and nops in this case, and the definition of the returnHealthReader:, which is in it's own turn also a address specifier, but doesn't change the current address) \line\line This code introduces labels, they are basicly identifiers specifying a address where thay have been placed. \line you can't just use a label though, you'll first have to declare it using the label(labelname) function. I usually declare labels right after the part where I alloc memory. \line\line so, right after the alloc I have this code to get the code above working: \line Code: \line\line label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out \line label(originalhealthreadercode) //same as above \line \line\line\line now when you run the game the address of your health will get stored into the location of playerhealthaddress. \line You can already use this with cheat engine, because the auto assembler will tell you the address, but the allocation will change each time, so making a table for other people won't work, they'd have to fill in the address each time themselves. (I dont find that a problem but somehow some people do....) \line\line\line\line So, let's automate it a little further and use the knowledge of your healthaddress to make yourself invulnerable, but not your oponents. \line Just like the injection for the code that reads your health you can do the same for that that decreases health. \line And you can put it in the same script as the injection for the reader, as you saw in the alloc part where I already allocated space for the injection for the health decreaser (so you dont have to edit the address the other script allocated) \line\line so, write scriptcode that places a jump over the code that decreases your health, in this case "mov [esi+ecx*4],edx" which has bytecode 89 14 8e (3 bytes), too small, so find a instruction before or after thats also suitable, in this case there's a sub edx,eax just before this instruction, its bytecode is 29 c2 (2 bytes) so a perfect fit (5 bytes, so no need to nop), and even easier to make a code injection for (else I'd have to use a label between the 2 instructions to just skip the original line, but this sub edx,eax line is used to decrease as well, and doesn't change any of the locator addresses, and useless for the rest, so it doesn't hurt to skip it as well) \line\line so to inject your routine that checks if this is your health or not and if so, dont decrease do: \line Code: \line\line 00421000: \line jmp injectHealthWriter \line returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005 \line\line\line injectHealthWriter: \line //do a check if esi+ecx*4 matches the address stored in playerhealthaddress \line //if it matches, skip the original code, if it doesn't just execute it \line\line //save the registers we use, and before I forget, do not touch esp between saving and restoring the registers unless \line //it's to read something(like parameters), in which case you'll have to adjust the offset \line //also, dont change the registers that you use to find the address \line push eax \line push ebx \line mov eax,[playerhealthaddress] \line lea ebx,[esi+ecx*4] \line cmp eax,ebx \line\line je itstheplayer \line\line //not the player \line pop ebx //I think I could have doen this before the je, but better safe than sorry \line pop eax \line jmp originaldecreasehealthcode \line\line\line itstheplayer: \line pop ebx //restore the registers, keep in mind to restore the registers in reverse order \line pop eax \line jmp returnHealthWriter //dont execute the original code, return imeadiatly \line\line originaldecreasehealthcode: \line sub edx,eax \line mov [esi+ecx*4],edx \line jmp returnHealthWriter \line \line\line\line again, I used a few labels to make it easier for me \line but, that also means I'd have to declare them, else the assembler will complain it doesn't recognize them \line so: \line Code: \line\line label(returnHealthWriter) \line label(itstheplayer) \line label(originaldecreasehealthcode) \line \line\line\line and I prefer adding declarations at the top. \line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line So, the complete auto assembler script would look like: \line Code: \line\line alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024 bytes \line alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management \line alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have to be 8 bytes) \line label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out \line label(originalhealthreadercode) //same as above \line label(returnHealthWriter) \line label(itstheplayer) \line label(originaldecreasehealthcode) \line\line\line //---------------------------------------- \line // Healthreader \line //---------------------------------------- \line 00405000: \line jmp InjectHealthAddress //jump to the codecave \line nop //nops for the lost space \line nop \line returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down 00405007 when jumping back, just to make it easy....) \line\line\line injectHealthReader: \line push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save and restore registers \line lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax \line mov [playerhealthaddress],eax \line pop eax //restore the register, again, not needed here, but good habbit to do \line\line originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed here \line mov eax,[esi+ecx*4] //read health \line mov ecx,[esi+edx*4+4] //read something else, my gues, armor \line\line jmp returnHealthReader //jump back to the orig"XWYPinal game code, when done successfull, it wont crash... \line\line\line\line //---------------------------------------- \line // Health decreaser \line //---------------------------------------- \line\line\line\line 00421000: \line jmp injectHealthWriter //overwrite the original code with a jump. \line returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005 \line\line\line injectHealthWriter: \line //do a check if esi+ecx*4 matches the address stored in playerhealthaddress \line //if it matches, skip the original code, if it doesn't just execute it \line\line //save the registers we use, and before I forget, do not touch esp between saving and restoring the registers unless \line //it's to read something(like parameters), in which case you'll have to adjust the offset \line //also, dont change the registers that you use to find the address \line push eax \line push ebx \line mov eax,[playerhealthaddress] \line lea ebx,[esi+ecx*4] \line cmp eax,ebx \line\line je itstheplayer \line\line //not the player \line pop ebx //I think I could have doen this before the je, but better safe than sorry \line pop eax \line jmp originaldecreasehealthcode \line\line\line itstheplayer: \line pop ebx //restore the registers, keep in mind to restore the registers in reverse order \line pop eax \line jmp returnHealthWriter //dont execute the original code, return imeadiatly \line\line originaldecreasehealthcode: \line sub edx,eax \line mov [esi+ecx*4],edx \line jmp returnHealthWriter \line\line\line \line\line\line Please be aware that I havn't tested this in ce yet, I've been writing this in notepad on a pc that doesnt have ce installed, so there may be a few syntax errors, and some of the code I've written can surely be optimised, but I hope you get the general idea. \line\line Also, there's a bug in ce 5.0 where you can't use small identiers that can apear in the name of another identifier. (e.g weirdmemlocxxx and memloc can't be used at the same time, because memloc fits in weirdmemlocxxx) \line But if you use normal names for identifiers this wont couse a problem, and I recommend identifiers of more than 4 characters, else it may happen you get the name of a assembler instruction and accidentally overwrite that when used. \line\line _____________________\line \line The other method of using code injection is finding if there are differences between the player data and opponent data. \line Lets say that if it's the player [esi+ecx*4+14] contains a 1 otherwhise a 0. you can then do a check if that is set or not, if so, skip, otherwhise, decrease health \line\line Code: \line\line alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management \line label(returnHealthWriter) \line label(itstheplayer) \line label(originaldecreasehealthcode) \line\line\line //---------------------------------------- \line // Health decreaser \line //---------------------------------------- \line\line\line\line 00421000: \line jmp injectHealthWriter //overwrite the original code with a jump. \line returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005 \line\line\line injectHealthWriter: \line push eax \line mov eax,[esi+ecx*4+14] \line cmp eax,1 \line je itstheplayer \line\line //not the player \line pop eax \line jmp originaldecreasehealthcode \line\line\line itstheplayer: \line pop eax //restore the register \line jmp returnHealthWriter //dont execute the original code, return imeadiatly \line\line originaldecreasehealthcode: \line sub edx,eax \line mov [esi+ecx*4],edx \line jmp returnHealthWriter \line \line \line \line\cf3\fs24\par\cf0\par} #{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\b Code Injection and the auto assembler\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1nFind out what addresses are accessed by a piece of codeZFindoutwhataddressesareaccessedbyapieceofcodeZFindoutwhataddressesareaccessedbyapieceofcodeHelpMacro=26 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0Find out what addresses are accessed by a piece of code code assembler u{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf2\fs18 Originally posted by Dark Byte\line\line Sometimes when you've found a address and the code to change that address is also used to change other addresses (like that of the enemy) the following function will be usefull: \line\line When you've found the code that accesses the address you've found you can save that and use it to find the address you are looking for, so you don't have to go through the slow scanning routine again. (unless of course scanning for it is a lot faster than this, like finding a piece of text and then recalculating the rest) \line\line Go to the advanced window, rightclick the code and choose "Find out what addresses this code writes to" (or reads from depending on what kind of code it is, and can sometimes be a write instead of a read but that doesn't matter) and play the game. after a while the list will be filled up with all the addresses that that code used. (enemy's energy including if it is also used to handle the enemy) \line\line Only downside is that this (currently) only works for instructions that have a [...] part. So instructions like "rep movsb" won't work, but that is a instruction thats useless to cheating anyhow)\line\cf3\fs24\par\cf0\par} 5{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red25"YXZQ5\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\b Find out what addresses are accessed by a piece of code\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1J3D pinball for windows (pointer+code)<3Dpinballforwindowspointercode<3DpinballforwindowspointercodeHelpMacro=24 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=03D pinball for windows (pointer+code) pinball code pointers directx {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf0\fs18 Originally posted by me. (no not me, but the user called me)\line\line this is to try answer the most common questions from people new to cheat engine \line\line using 3d pinball for windows space cadet as an example,,, \line it might be an idea to print this and other tuts so its easier to work through them,,, \line\line ( this game gives you some free balls so be on the look out for that during this tut ) \line\line start 3D PINBALL FOR WINDOWS ,, and wait for the first ball to deploy \line start cheat engine \line click on the flashing icon in the top left of cheat engine \line in the bottom of process list window \line double click on PINBALL.EXE to attache the game to cheat engine \line in the value box type in 3 \line go into the pinball game and lose a ball \line wait for the next ball to be deployed \line go back into cheat engine \line type 2 into the value box \line click on the next scan button \line I got the address A9FEE6 yours may be different \line\line ok \line\line I'll double click on the found address A9FEE6 to add it to the bottom pane \line click on the checkbox to freeze this address \line go back into the PINBALL GAME \line lose some balls to see if its the right address \line if you have got it right you'll have infinite balls \line\line ------------------------------------------------------------------------------- \line now to find the code that changes the number of balls \line ------------------------------------------------------------------------------- \line\line go back into cheat engine \line (if you want you can double click on the value part of the address in the bottom pane and change it back to 3 or 4 balls) \line In the bottom pane again right click on the address A9FEE6 and choose \line FIND OUT WHAT WRITES TO THIS ADDRESS \line\line you will then get the debugger window \line go back into pinball and lose another ball \line in the debugger window you should see the address of the code that changes the number of balls \line\line I got 01015f02 - 89 86 46 01 00 00 - mov [esi+00000146],eax \line click on this to highlight the code,, and click on the ADD TO CODELIST button \line a box called CHEAT ENGINE CODE will pop up \line name balls \line and hit the OK button \line\line a window called ADVANCED OPTIONS WILL pop up with balls in it \line you can right click it and choose REPLACE WITH CODE THAT DOES NOTHING \line to show that the code has been nopped out the name will turn red \line you can hit the ok button to close the advanced options window then the stop and close button to exit the debugger \line then save your table,,,, but for now \line just hit the ok button to close the advanced options window \line\line in the debugger window look at the code 01015f02 - 89 86 46 01 00 00 - mov [esi+00000146],eax \line now with the code highlighted click on the MORE INFORMATION button \line the EXTRA INFO box will pop up \line in this box under copy memory you will see the sentance \line\line THE VALUE OF THE POINTER NEEDED TO FIND THIS ADDRESS IS PROBABLY 00A9FDA0 \line\line this is the address held in the ESI register below this you can see all the values that the registers held at the instant you lost a ball,, \line as you can see ESI=00A9FDA0 \line and highlighted in red you can see \line\line 01015F02 - mov [ esi + 00000146 ],eax \line\line this is all in hexadecimal \line so the ESI register holds 00A9FDA0 therefore \line [esi + 00000146] = [ 00A9FDA0 + 00000146 ] \line 00A9FDA0 + 146 = 00A9EEF6 \line\line the first address I found when I started scanning at the start of the game \line\line so note down the address 00A9FDA0 \line and the offset 146 \line\line close the EXTRA INFO window \line in the main cheat engine window ,,,hit the new scan button \line next to the value box theres a hex checkbox ,, check it so you can enter a hex value \line put in our address without the zeros in front of it A9FDAO \line and hit the first scan button \line\line you will get a couple of hundred results \line i'll try the first address on the list 009A4356 \line\line click on the add address manually button \line click on the poiter checkbox and you will see the ADD ADDRESS window change \line\line where it says ADDRESS OF POINTER type in our address 9A4356 \line and in the OFFSET [HEX] box type in 146 ,,,,,,,,, remember [esi + 00000146] \line and hit the ok button \line\line hopefully a new address with should look like this in the bottom pane \line No description P->00A9FEE6 4 bytes 0x00000003 \line or how ever many balls you got left \line you can freeze the number of balls from this pointer now,,,,, \line in games that use Dynamic Memory Allocation ,,, DMA \line and use the same code to change things for you and the enemies,, \line pointers are usfull \line\line ------------------------------------ \line ok a couple of things \line\line 1) this game don't use dma ,, but its an easy game to practice on \line 2) Its free and most people have it \line 3) so for newcomers it gives an idea of how to use the basic search / pointer / and advanced options \line\line well as they say thats my two cents \line\cf3\fs24\par\cf2\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chc"ZY[Rbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\fs24\b 3D pinball for windows (pointer+code)\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1(Basic packet editing(basic-packet-editing(basic-packet-editingHelpMacro=1000 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=20 sChange=Complete sBook=28/12/2008 11:49 sBookPage=20/01/2010 15:41 sIcon=10 exp=1 sel=0>packet packet editor packetsu{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss Courier New;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red0\green128\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Basic Packet editing with Cheat Engine\par\par This is just an example tutorial describing how to do basic packet editing with Cheat Engine. It's main purpose is to show that you don't have to use other tools when packet editing. (Sure, it helps and is easier, but CE can do it as well)\par\par Let's say you want to change in outgoing packet data the word "hello" with the word "idiot".\par First gather all needed information and discuss some basic api calling mechanics:\par Packet data is sent using ws2_32.dll's send api . To target this api's location you have to use ws2_32!send as name, else ce will pick winsock32's send export, which is not what you want\par Next you have to know that the 2nd parameter contains the pointer to the buffer that is being sent.\par Let's first get into windows api calling mechanics. Parameter passing is done by pushing the parameters in reverse order on the stack, followed by a call to the send api., which pushes the next instruction's address on the stack as well.\par Because each push decreases esp with 4 bytes, the parameters will actually appear in the correct order, making it [esp] point to the return address, [esp+4] holds the first parameter (socket), [esp+8] holds the 2nd parameter (pointer to buffer containing data), [esp+c] holds the length of that buffer, etc...\par\par To packet edit you'll have to hook the send api and inspect and manipulate the parameters and buffers sent.\par In short, code injection at ws2_32!send, get the address of the send buffer, get the length, scan that buffer for the word hello, and if found, replace that with the word idiot\par\par The following code snipet is an example of basic packet editing. (Nothing fancy, but does the job)\par\hich\f2\dbch\f2\loch\f2 alloc(newmem,2048) //2kb should be enough\par label(returnhere)\par label(originalcode)\par label(exit)\par label(repeat)\par label(repeat2)\par label(nomatch)\par label(nomatch2)\par label(endofroutine)\par alloc(texttoscan,5) \cf3 //non 5.4.4\cf0\par alloc(texttoreplacewith,5)\par\par define(stringlength,5)\par texttoscan:\par db 'hello'\par\par texttoreplacewith:\par db 'idiot'\par\par ws2_32!send:\par jmp newmem\par returnhere:\par\par newmem: \cf3 //this is allocated memory, you have read,write,execute access\par //place your code here\cf0\par\par //start off with a stackframe\par push ebp\par mov ebp,esp\par\par //lets save the used registers\par push eax\par push ecx\par push esi\par push edi\par\par\par mov esi,[ebp+0c] \cf3 //buffer (I might have said esp+8 in the post, but due to the added stackframe(push ebp), it's all shifted 4 bytes)\cf0\par mov edi,texttoscan\par mov ecx,[ebp+10] \cf3 //length of buffer\cf0\par cmp ecx,stringlength\par jl endofroutine\par\par sub ecx,stringlength-1\par\par\par repeat:\par\cf3 //edit: because 5.4 doesn't support cmp byte [esi],'t' I have to do it different than in 5.4.4\cf0\par push ecx\par mov ecx,stringlength-1\par repeat2:\par\cf3 /*\par sure, it compares from the back to front, but as long as it checks it's a match\par I don't care\par */\cf0\par mov al,[esi+ecx]\par cmp al,[edi+ecx]\par jne nomatch2\par loop repeat2\par\par\par\cf3 //still here, so a match\cf0\par push esi\par push edi\par mov edi,esi \cf3 //I want the found buffer to be the destination, not source\cf0\par mov esi,texttoreplacewith\par mov ecx,stringlength\par rep movsb \cf3 //move the byte stored at [esi] into [edi] ecx times (so move texttoreplacewith to the found string\cf0\par pop edi\par pop esi\par\par nomatch2:\par pop ecx\par\par nomatch:\par inc esi\par loop repeat\par\par endofroutine:\par\par\cf3 //undo any register change\cf0\par pop edi\par pop esi\par pop ecx\par pop eax\par\par\cf3 /*\par undo stackframe. Ok, in this situation the stackframe of the original function\par could have been used, but I try to keep it understandable to readers.\par */\cf0\par mov esp,ebp\par pop ebp\par\par originalcode:\par mov edi,edi\par push ebp\par mov ebp,esp\par\par exit:\par jmp returnhere\par\plain\f1\fs20\par Note: Instead of editing the actual buffer you might want to create a new buffer and pass that on to the send api. That'll allow for longer texts, and won't mess up if the program actually uses read-only buffers for the send api\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs24\b Basic packet editing\plain\f1\fs20\par} N1ZPercentage scans and compare to saved resultsZpercentage-scans-and-compare-to-saved-resultsZpercentage-scans-and-compare-to-saved-results$HelpMacro=1099 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 "[Z\SCT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=02/01/2011 DateModified=02/01/2011 DateReview=02/01/2011 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=25 X2=0 Y2=0 sChange=Under Construction sBook=02/01/2011 20:24 sBookPage=02/01/2011 21:04 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Originally posted by Geri\par\par Open the CE tutorial and proceed to Step 2.\par Open CE and attach it to the tutorial.\par\par Now You have 100 health. We will find this value by using the percentage scan in CE.\par\par Start an unknown initial value scan.\par Now click on the hit me button and you loose some health. I have 96 health now.\par\par Click on the Scan type dropdown menu and choose the last option, "Compare to first scan". This means that in the next searches, the values will not be compared to the last search result, but always to the first scan result, which is in our case 100 for our value.\par\par The next step is to choose "Value between..." search and click on the between % checkbox. What will this option do exactly? It will check all values which are x-y% of the value that we use for comparing. At the moment, this means it will scan for values which are x-y% of the first scan result.\par Why is this good for us?\par We have made the first scan when our value was 100. This value is the 100%. Our value at the moment is 96. It isn't hard to calculate that our value is the 96% of the first scan result.\par\par To find our value, we type in 95 and 97 in the fields so CE will find all values that are 95-97% of the first scan result. Hit next scan and You can see that we have only a few results. Probably You can see that the value is in the list, but just for fun, repeat the process again. Click on "Hit me" a few times.\par\par Now I have 78 health. I need to find the value. 78 is obviously 78% of the first scan result which was 100. So I make a scan with "Value between...", between% and I type in 77 and 79.\par\par Awesome I have found my value already. This example was easy because we have seen the value and we knew that it is not multiplied with any number. You may think this was a stupid example. But wait a minute. What happens if the value is stored in some tricky way, like when it is multiplied with 8 for flash games? Well of course since we have searched for x-y% of the value, it doesn't matter if the values are multiplied, you will find them easily using this method.\par With a flash game, it would have worked this way (not in all flash games, but in some of them).\par You have 100 health and it is stored like 800 in the memory.\par You do a first scan.\par Then your health is decreasing to 96 (which is in fact 768 in the memory).\par You search for 96% (95-97%).\par Then you loose some health again and you see you have 78 health (which is in fact 624 in the memory).\par You search for 78% (77-79%) and bingo. You have found your value. Did you know it is multiplied? No. Did you find it just by searching for x percentage of the first scan result which was 100%? Yes, you have found it easily and it would have worked even if the value is multiplied with 200, 1000 or even 4748 in the memory.\par\par I hope you realize that this feature is VERY useful when you don't know if a value is multiplied or not and you have no idea what is the multiplier value. In many cases, this will help to find timers and other tricky values which are usually multiplied.\par\par\par And now, we will check what happens if we don't see the exact value that we are looking for.\par Proceed to Step 3 in the Tutorial.\par You can see a health bar only, but you don't know the exact number. What you see however, is that the health bar is full. This means that the health bar is filled to 100% at the moment.\par\par Now start an unknown initial value search.\par Click on Hit me a few times and You loose some health.\par Now choose Compare to first scan again, then choose "Value between..." and between %.\par Look at your health bar. You have lost some health, try to guess how much % health do you have from the full bar. My bar is filled to about 85-95% so I have about 85-95% of the full health.\par Ok, I search for 85-95%.\par Click on Hit me again a few times to loose health.\par Ok now my health bar is somewhere between 60 and 80%.\par I search for 60-80%.\par Bingo.\par\par I have found my value already, but if you don't have it yet, continue searching until you find it.\par\par Why is this useful when you could just simply use increased/decreased search? If you have ever tried to find a graphically displayed timer or a progress bar in some game, where you did not have the option to stop the value and all you could do is to keep searching for decreased value all the time, then think about how easy would have been to just search for the progress bar this way.\par\par\par As a final word, I need to mention that a decreasing health bar or progress bar doesn't mean that the value is decreasing. It may happen that it is constantly increasing until it will reach a certain value. But even in this case, you can still use the % scan, just be a bit clever. Utilize this feature when you are stuck with increased/decreased changed/unchanged value searches, because this will save you many times.\par Probably this feature is one of the most useful options in CE 6 for beginners and advanced users alike.\par\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Percentage scans and compare to saved results\par} N1Misc TopicsDateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 CT1=0 CT2=0 CT3=0 CT4=0 CT5=0 CT6=0 CT7=0 CT8=0 CT9=0 CX1=0 CX2=0 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=29/12/2009 20:55 sBookPage=29/12/2009 20:55"\[]Tx{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\fs20\par} N1$About the debugger Aboutthedebugger AboutthedebuggerHelpMacro=13 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=29/12/2009 16:23 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=14 Y1=0 X2=1 Y2=0LAbout the debugger Settings Window ?{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\cf0\fs18 You will sometimes read about the debugger of cheat engine, this is a thread that has access to the opened process, and handles all debugging events, like creating threads, handling exceptions, etc...\line\lang2057\hich\f2\dbch\f2\loch\f2 A\lang1033\hich\f1\dbch\f1\loch\f1 thread is a part of the program that runs separately from the rest of the program, but still has access to the memory of the main program\lang2057\hich\f2\dbch\f2\loch\f2 .\par\par You will be prompted to attach the debugger to the current process if you try and use debugging options (such as 'find what accesses/writes to this address') unless you are already attached or using kernelmode debug routines.\par\par The standard debugger may be detected\cf3\fs24 \fs18 by certain targets. One way around this is to hook the IsDebuggerPresent API currently used in such detections. CE has a feature which automatically perform this step after attaching to a process. It is called 'Try to prevent detection of the debugger' and you can find it in the options. It's not a guarantee though!\par\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\b About the debugger\cf0\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1 Network versionsNetworkversionsNetworkversionsHelpMacro=15 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=29/12/2009 16:08 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=13 Y1=50 X2=0 Y2=0:Network versions designer {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf0\fs18 Older versions of \lang2057\hich\f2\dbch\f2\loch\f2 C\lang1033\hich\f1\dbch\f1\loch\f1 heat \lang2057\hich\f2\dbch\f2\loch\f2 E\lang1033\hich\f1\dbch\f1\loch\f1 ngine\lang2057\hich\f2\dbch\f2\loch\f2 (pre-5.4)\lang1033\hich\f1\dbch\f1\loch\f1 come with a separate Client and Server \lang2057\hich\f2\dbch\f2\loch\f2 version.\lang1033\hich\f1\dbch\f1\loch\f1\line\line There are a few games that give no possibility to switch between programs (It either closes, crashes, or takes down your whole pc when you switch to something else)\lang2057\hich\f2\dbch\f2\loch\f2 . \lang1033\hich\f1\dbch\f1\loch\f1 In those cases the Network versions of Cheat Engine come in handy\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 (Assuming you have 2 computers or a friend over internet willing to help)\lang2057\hich\f2\dbch\f2\loch\f2 .\lang1033\hich\f1\dbch\f1\loch\f1\line\line Load the server program on the computer that will run the game and start the server.\line Then run the game on that computer and start the client part of"]\^U Cheat Engine on another computer.\line Make a connection with the client to the computer that runs the server. When a connection is established the Cheat Engine user\lang2057\hich\f2\dbch\f2\loch\f2 \lang1033\hich\f1\dbch\f1\loch\f1 interface will show up on the client side. With that you can open the process of the game on the server and scan the memory as if you're local.\line\line To get them, download Cheat Engine 5.3 or earlier\lang2057\hich\f2\dbch\f2\loch\f2 .\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Network versions\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1(Contact and feedbackOtherstuffOtherstuffHelpMacro=20 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=29/12/2009 21:32 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=5 Y1=0 X2=0 Y2=112Other stuff Tutorials {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\lang2057\hich\f2\dbch\f2\loch\f2\fs18 Cheat Engine contains a lot of features and has many uses. A large amount of these simply cannot be covered in this help document, and there are limited examples. If think you have anything to contribute (such as explanations, examples, tutorials, etc) then please feel free to send them along. Suggestions and useful feedback is always welcome to! Throw them my way:\par\par\b dark_byte@hotmail.com\par\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\b0\par} R{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang2057\hich\f2\dbch\f2\loch\f2\fs24\b Contact and feedback\lang1033\hich\f1\dbch\f1\loch\f1\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par} N1 Popups Popups,sIcon=6 exp=0 sel=0N1processprocess_popupprocess_popupHelpMacro=0 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=1 sel=0 sBook=13/09/2008 03:13 sBookPage=29/12/2009 19:03 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=2 Y1=36 X2=0 Y2=0{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par\cf0\fs18 A process is a program or game running in window\lang2057\hich\f2\dbch\f2\loch\f2 s. These processes are what CE targets in memory in order to be able to cheat with them.\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\par} N1cheat engine$cheat-engine_popup$cheat-engine_popup$HelpMacro=1048 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/20"^]_V09 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 18:57 sBookPage=29/12/2009 19:03 sIcon=10 exp=0 sel=0D{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\pard\s0\tx3870\ql\plain\f1\fs20\lang2057\hich\f2\dbch\f2\loch\f2\fs18 Cheat Engine is the popular memory hacking tool you are reading about.\plain\f2\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 cheat engine\par} N1gamehackinggamehackinggamehacking&HelpMacro=1049 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=4 Y1=89 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 18:59 sBookPage=29/12/2009 19:01 sIcon=10 exp=0 sel=0R{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 Gamehacking is the art of cheating or in some way modifying a game to achieve a desired effect. This can be anything from memory editing with the aim of making a trainer (with options such as God mode, Infinite Ammo and Super Speed), through to creating graphics hooks (for wallhacks, chams etc) and even resource extraction. It's a growing scene, and is closely linked to general application reversing.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 gamehacking\par} N1trainertrainertrainer&HelpMacro=1050 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=53 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 19:01 sBookPage=29/12/2009 19:02 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A trainer is a program written to modify certain memory locations in order to achieve certain hacks. They usually come with instructions on how/when to use it, and they tend to have hotkeys to activate the hacks in-game. Cheat Engine has a built-in trainer maker tool.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 trainer\par} N1addressaddressaddress&HelpMacro=1051"_^`W HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=80 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:55 sBookPage=29/12/2009 20:55 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A memory address is a specific spot in memory which holds something of interest.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 address\par} N1variablevariablevariable&HelpMacro=1052 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=1 Y1=37 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:55 sBookPage=29/12/2009 20:57 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A variable is something that changes which is hackable. An example is player health or ammo.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 variable\par} N1debuggingdebuggingdebugging$HelpMacro=1053 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:57 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 In gamehacking, debugging is basically the process of finding interesting gamecode.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 debugging\par} N1scannerscannerscanner$HelpMacro=1054 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2"`_aX009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=1 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:57 sIcon=10 exp=0 sel=0'{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A memory scanner/searcher is a tool, such as Cheat Engine, used to trawl game memory for useful addresses.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 scanner\par} N1 opcode opcode opcode&HelpMacro=1055 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=18 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:58 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 An opcode is really just another name for an assembly instruction, such as\par 'MOV [ESI+4D8],EAX'. These are what gamehackers will attempt to locate and manipulate to change the way the game runs.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 opcode\par} N1 hexer hexer hexer$HelpMacro=1056 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=1 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:58 sIcon=10 exp=0 sel=0H{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A hexer is another name for a gamehacker. Despite how it sounds, a hexer is not just someone who hex-edits files (that is just too simple).\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 hexer\par} N1interceptinterceptintercept$HelpMacro=1057 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 Wo"a`bYrdSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:58 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs18\par In gamehacking intercepting is the process of locating specific areas of code in order to change them. Usually it refers to the act of code-injection and redirecting program flow to this code.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 intercept\par} N1injectioninjectioninjection&HelpMacro=1058 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=4 Y1=30 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:58 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 Code-injection is a technique whereby the gamehacker formulates their own code and routes program execution through to this spot before returning back to normal. Code-injection is necessary for more advanced hacks that need to create special compares and execute more code which there simply isn't room for in the original code spot.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 injection\par} N1registerregisterregister&HelpMacro=1059 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=2 Y1=10 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:58 sIcon=10 exp=0 sel=0.{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A register is a temporary location held by the CPU used to store various values throughout a program's execution.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 register\par} N1 stack stack stack&HelpMacro=1060 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 Sho"bacZwTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=14 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:59 sIcon=10 exp=0 sel=04{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 The stack is a temporary memory location held by the CPU which is extremely quick to access, and is done so frequently.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 stack\par} N1darkbytedarkbytedarkbyte&HelpMacro=1061 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=67 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:59 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 Darkbyte is the developer of Cheat Engine. Contact: dark_byte@hotmail.com\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 darkbyte\par} N1cavecavecave&HelpMacro=1062 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=28 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:56 sBookPage=29/12/2009 20:59 sIcon=10 exp=0 sel=0C{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 A code cave is an empty or unused area of memory (usually filled with blank 00 bytes) that a reverser can use to place their own code.\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 cave\par} N1kernelmodekernelmodekernelmode$HelpMacro=1063 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=0 X2=0 Y2=0 sChange=Under Construction "cbd[ sBook=29/12/2009 20:57 sBookPage=29/12/2009 20:59 sIcon=10 exp=0 sel=0]{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 The processor mode in which system services and device drivers run. All interfaces and CPU instructions are available, and all memory is accessible. (From MSDN)\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 kernelmode\par} N1usermodeusermodeusermode&HelpMacro=1064 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=2 Y1=45 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:57 sBookPage=29/12/2009 20:59 sIcon=10 exp=0 sel=0T{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 The processor mode in which applications run. A limited set of interfaces are available in this mode, and access to system data is limited. (From MSDN)\plain\f2\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 usermode\par} N1assemblyassemblyassembly&HelpMacro=1065 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=88 X2=0 Y2=0 sChange=Under Construction sBook=29/12/2009 20:57 sBookPage=29/12/2009 20:59 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 Assembly (or ASM) is a low-level language. At the lowest level is binary, which is what the processor ultimately interprets. However, one level up we have assembly which the numeric representation of this binary code. This is what a reverser is presented with when reversing a game (or application).\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 assembly\par} N1websitewebsitewebsite&HelpMacro=1066 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=29/12/2009 DateModified=29/12/2009 DateReview=29/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=3 Y1=27 X2=0 Y2=0 sCh"dce\ange=Under Construction sBook=29/12/2009 20:59 sBookPage=29/12/2009 21:00 sIcon=10 exp=0 sel=0 {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20\par\fs18 The Cheat Engine website can be found at:\par\par\b http://www.cheatengine.org/\plain\f1\fs20\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f2\fs20 website\par} N1Window ListWindow List,sIcon=5 exp=1 sel=0N1Main MainBC01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 sIcon=8 exp=0 sel=0 X01=500 X02=-1 X03=-1 X04=780N1 Popup Popup>C01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 sIcon=8 exp=0 sel=0 X01=591 X02=9 X03=9 X04=557N1Log LogVMsIcon=2 exp=0 sel=0 29/12/2009 21:26:59 File Saved. 29/12/2009 21:29:58 File Saved. 29/12/2009 21:32:56 File Saved. 29/12/2009 21:33:18 File Saved. 29/12/2009 21:35:17 File Opened 29/12/2009 21:37:39 File Saved. 30/12/2009 19:38:47 File Opened 30/12/2009 19:42:40 File Saved. 30/12/2009 19:45:18 File Saved. 30/12/2009 19:46:54 File Saved. 30/12/2009 19:49:24 File Saved. 30/12/2009 20:03:39 File Saved. 30/12/2009 20:04:35 File Saved. 30/12/2009 20:08:46 File Saved. 30/12/2009 20:10:57 File Saved. 30/12/2009 20:14:48 File Saved. 30/12/2009 20:18:36 File Saved. 30/12/2009 20:22:34 File Saved. 30/12/2009 20:26:16 File Saved. 30/12/2009 20:29:08 File Saved. 30/12/2009 20:31:53 File Saved. 30/12/2009 20:33:34 File Saved. 03/01/2010 10:54:27 File Opened 03/01/2010 10:55:19 File Saved. 03/01/2010 10:55:22 File Saved. 14/01/2010 19:22:32 File Opened 14/01/2010 19:23:03 File Saved. 14/01/2010 19:23:05 File Saved. 14/01/2010 19:23:06 File Saved. 14/01/2010 19:23:06 File Saved. 14/01/2010 19:23:40 File Saved. 20/01/2010 5:23:31 AM File Opened 20/01/2010 5:41:35 AM File Saved. 20/01/2010 5:41:38 AM File Saved. 20/01/2010 5:41:47 AM File Saved. 20/01/2010 5:42:51 AM File Saved. 20/01/2010 5:45:59 AM File Saved. 20/01/2010 5:48:24 AM File Saved. 20/01/2010 5:53:31 AM File Saved. 20/01/2010 5:53:53 AM File Saved. 20/01/2010 5:54:34 AM File Saved. 20/01/2010 5:54:39 AM File Saved. 20/01/2010 6:01:46 AM File Saved. 20/01/2010 1:08:54 PM File Saved. 20/01/2010 1:38:53 PM File Saved. 20/01/2010 2:08:53 PM File Saved. 20/01/2010 2:38:58 PM File Saved. 20/01/2010 2:46:12 PM File Saved. 20/01/2010 3:05:21 PM File Saved. 20/01/2010 3:08:53 PM File Saved. 20/01/2010 3:14:00 PM File Saved. 20/01/2010 3:19:46 PM File Saved. 20/01/2010 3:28:27 PM File Saved. 20/01/2010 3:30:12 PM File Saved. 20/01/2010 3:31:13 PM File Saved. 20/01/2010 3:37:18 PM File Saved. 20/01/2010 3:38:53 PM File Saved. 20/01/2010 3:39:41 PM File Saved. 20/01/2010 3:39:52 PM File Saved."edf] 20/01/2010 3:39:54 PM File Saved. 20/01/2010 3:42:12 PM File Saved. 20/01/2010 3:46:44 PM File Saved. 20/01/2010 3:46:48 PM File Saved. 20/01/2010 3:51:56 PM File Saved. 20/01/2010 3:57:48 PM File Saved. 20/01/2010 4:01:18 PM File Saved. 20/01/2010 4:02:02 PM File Saved. 20/01/2010 4:02:14 PM File Saved. 20/01/2010 4:06:53 PM File Saved. 20/01/2010 4:08:53 PM File Saved. 20/01/2010 4:11:12 PM File Saved. 20/01/2010 4:11:41 PM File Saved. 20/01/2010 4:12:32 PM File Saved. 20/01/2010 4:12:47 PM File Saved. 20/01/2010 4:25:45 PM File Saved. 26/01/2010 6:07:06 PM File Opened 26/01/2010 6:08:19 PM File Saved. 26/01/2010 6:10:49 PM File Saved. 28/01/2010 9:54:58 PM File Opened 28/01/2010 10:24:57 PM File Saved. 28/01/2010 10:54:57 PM File Saved. 28/01/2010 11:24:57 PM File Saved. 28/01/2010 11:54:57 PM File Saved. 29/01/2010 12:24:57 AM File Saved. 29/01/2010 12:54:57 AM File Saved. 29/01/2010 1:24:57 AM File Saved. 29/01/2010 1:54:57 AM File Saved. 29/01/2010 2:24:57 AM File Saved. 29/01/2010 2:54:57 AM File Saved. 29/01/2010 3:24:57 AM File Saved. 29/01/2010 3:54:57 AM File Saved. 29/01/2010 4:24:57 AM File Saved. 29/01/2010 4:54:57 AM File Saved. 29/01/2010 5:24:57 AM File Saved. 29/01/2010 5:54:57 AM File Saved. 29/01/2010 6:24:57 AM File Saved. 29/01/2010 6:54:57 AM File Saved. 29/01/2010 7:24:57 AM File Saved. 29/01/2010 7:54:57 AM File Saved. 29/01/2010 8:24:57 AM File Saved. 29/01/2010 8:54:57 AM File Saved. 29/01/2010 9:24:57 AM File Saved. 29/01/2010 9:54:57 AM File Saved. 29/01/2010 10:24:57 AM File Saved. 29/01/2010 10:55:02 AM File Saved. 29/01/2010 11:24:57 AM File Saved. 29/01/2010 11:54:57 AM File Saved. 29/01/2010 12:24:57 PM File Saved. 29/01/2010 12:54:57 PM File Saved. 29/01/2010 1:24:57 PM File Saved. 29/01/2010 1:54:57 PM File Saved. 29/01/2010 2:24:57 PM File Saved. 29/01/2010 2:54:57 PM File Saved. 29/01/2010 3:24:57 PM File Saved. 29/01/2010 3:54:57 PM File Saved. 29/01/2010 4:24:57 PM File Saved. 29/01/2010 4:54:57 PM File Saved. 29/01/2010 5:24:57 PM File Saved. 29/01/2010 5:54:57 PM File Saved. 29/01/2010 6:24:57 PM File Saved. 29/01/2010 6:54:57 PM File Saved. 29/01/2010 7:24:57 PM File Saved. 29/01/2010 7:54:57 PM File Saved. 29/01/2010 8:24:57 PM File Saved. 29/01/2010 8:54:57 PM File Saved. 29/01/2010 9:24:57 PM File Saved. 29/01/2010 9:54:57 PM File Saved. 29/01/2010 10:24:57 PM File Saved. 29/01/2010 10:54:57 PM File Saved. 29/01/2010 11:24:57 PM File Saved. 29/01/2010 11:54:57 PM File Saved. 30/01/2010 12:24:57 AM File Saved. 30/01/2010 12:54:57 AM File Saved. 30/01/2010 1:24:57 AM File Saved. 30/01/2010 1:54:57 AM File Saved. 30/01/2010 2:24:57 AM File Saved. 30/01/2010 2:54:57 AM File Saved. 30/01/2010 3:24:57 AM File Saved. 30/01/2010 3:54:57 AM File Saved. 30/01/2010 4:24:57 AM File Saved. 30/01/2010 4:54:57 AM File Saved. 30/01/2010 5:24:57 AM File Saved. 30/01/2010 5:54:57 AM File Saved. 30/01/2010 7:24:32 PM File Saved. 30/01/2010 7:54:31 PM File Saved. 30/01/2010 8:24:31 PM File Saved. 30/01/2010 8:54:31 PM File Saved. 30/01/2010 9:24:31 PM File Saved. 30/01/2010 9:54:31 PM File Saved. 30/01/2010 10:24:31 PM File Saved. 30/01/2010 10:54:31 PM File Saved. 30/01/2010 11:24:31 PM File Saved. 30/01/2010 11:54:31 PM File Saved. 31/01/2010 12:24:31 AM File Saved. 31/01/2010 12:54:31 AM File Saved. 31/01/2010 1:24:31 AM File Saved. 31/01/2010 1:54:31 AM File Saved. 31/01/2010 2:24:31 AM File Saved. 31/01/2010 2:54:31 AM File Saved. 31/01/2010 3:24:31 AM File Saved. 31/01/2010 3:54:31 AM File Saved. 31/01/2010 4:24:36 AM File Saved. 31/01/2010 4:54:31 AM File Saved. 31/01/2010 2:53:02 PM File Saved. 31/01/2010 3:23:02 PM File Saved. 31/01/2010 3:53:02 PM File Saved. 31/01/2010 4:10:26 PM File Saved. 31/01/2010 4:10:51 PM File Saved. 03/02/2010 7:52:56 PM File Opened 03/02/2010 7:53:59 PM File Saved. 03/02/2010 7:54:31 PM File Saved. 03/02/2010 8:22:55 PM File Saved. 03/02/2010 8:52:55 PM File Saved. 03/02/2010 9:06:55 PM File Saved. 31/12/2010 12:11:53 AM File O"feg^pened 31/12/2010 12:14:03 AM File Saved. 31/12/2010 12:41:52 AM File Saved. 31/12/2010 1:11:52 AM File Saved. 31/12/2010 1:41:52 AM File Saved. 31/12/2010 2:11:52 AM File Saved. 31/12/2010 2:29:10 AM File Saved. 31/12/2010 2:29:34 AM File Saved. 31/12/2010 2:32:19 AM File Saved. 31/12/2010 2:32:20 AM File Saved. 31/12/2010 2:37:07 AM File Saved. 31/12/2010 2:38:22 AM File Saved. 31/12/2010 2:41:52 AM File Saved. 31/12/2010 3:11:52 AM File Saved. 31/12/2010 3:14:55 AM File Saved. 31/12/2010 3:15:20 AM File Saved. 31/12/2010 3:41:52 AM File Saved. 31/12/2010 4:11:52 AM File Saved. 31/12/2010 4:41:52 AM File Saved. 31/12/2010 5:11:52 AM File Saved. 31/12/2010 5:41:52 AM File Saved. 31/12/2010 1:05:10 PM File Saved. 31/12/2010 1:35:04 PM File Saved. 31/12/2010 2:05:04 PM File Saved. 31/12/2010 2:35:04 PM File Saved. 31/12/2010 3:05:04 PM File Saved. 31/12/2010 3:29:58 PM File Saved. 31/12/2010 3:34:44 PM File Saved. 31/12/2010 3:35:04 PM File Saved. 31/12/2010 3:41:35 PM File Saved. 31/12/2010 3:43:24 PM File Saved. 31/12/2010 4:05:04 PM File Saved. 31/12/2010 4:35:04 PM File Saved. 31/12/2010 5:05:04 PM File Saved. 31/12/2010 5:35:04 PM File Saved. 31/12/2010 5:37:28 PM File Saved. 31/12/2010 5:37:58 PM File Saved. 31/12/2010 6:05:04 PM File Saved. 31/12/2010 6:35:09 PM File Saved. 31/12/2010 7:05:04 PM File Saved. 31/12/2010 7:35:04 PM File Saved. 31/12/2010 8:05:04 PM File Saved. 31/12/2010 8:35:04 PM File Saved. 31/12/2010 8:47:51 PM File Saved. 31/12/2010 8:47:59 PM File Saved. 31/12/2010 8:51:46 PM File Saved. 31/12/2010 8:52:01 PM File Saved. 31/12/2010 8:56:38 PM File Saved. 31/12/2010 9:05:04 PM File Saved. 31/12/2010 9:35:04 PM File Saved. 31/12/2010 10:05:04 PM File Saved. 31/12/2010 10:35:04 PM File Saved. 31/12/2010 10:46:20 PM File Saved. 31/12/2010 10:54:55 PM File Saved. 31/12/2010 11:05:04 PM File Saved. 31/12/2010 11:11:00 PM File Saved. 31/12/2010 11:13:28 PM File Saved. 31/12/2010 11:18:55 PM File Saved. 31/12/2010 11:20:52 PM File Saved. 31/12/2010 11:21:59 PM File Saved. 31/12/2010 11:24:44 PM File Saved. 31/12/2010 11:29:52 PM File Saved. 31/12/2010 11:35:04 PM File Saved. 31/12/2010 11:37:53 PM File Saved. 31/12/2010 11:41:35 PM File Saved. 31/12/2010 11:42:30 PM File Saved. 31/12/2010 11:45:39 PM File Saved. 31/12/2010 11:50:24 PM File Saved. 31/12/2010 11:50:58 PM File Saved. 01/01/2011 12:05:04 AM File Saved. 01/01/2011 12:35:04 AM File Saved. 01/01/2011 1:05:09 AM File Saved. 01/01/2011 1:35:04 AM File Saved. 01/01/2011 1:36:42 AM File Saved. 01/01/2011 1:36:55 AM File Saved. 01/01/2011 1:36:56 AM File Saved. 01/01/2011 1:37:14 AM File Saved. 01/01/2011 1:39:18 AM File Saved. 01/01/2011 1:39:21 AM File Saved. 01/01/2011 1:40:07 AM File Saved. 01/01/2011 1:40:53 AM File Saved. 01/01/2011 1:41:19 AM File Saved. 01/01/2011 1:41:24 AM File Saved. 01/01/2011 2:05:04 AM File Saved. 01/01/2011 2:35:04 AM File Saved. 01/01/2011 3:05:04 AM File Saved. 01/01/2011 3:35:04 AM File Saved. 01/01/2011 1:38:25 PM File Saved. 01/01/2011 2:08:25 PM File Saved. 01/01/2011 2:38:25 PM File Saved. 01/01/2011 3:08:25 PM File Saved. 01/01/2011 3:38:25 PM File Saved. 01/01/2011 4:08:25 PM File Saved. 01/01/2011 4:38:25 PM File Saved. 01/01/2011 5:08:25 PM File Saved. 01/01/2011 5:38:25 PM File Saved. 01/01/2011 6:08:25 PM File Saved. 01/01/2011 6:38:25 PM File Saved. 01/01/2011 6:52:03 PM File Saved. 01/01/2011 6:54:32 PM File Saved. 01/01/2011 6:56:27 PM File Saved. 01/01/2011 6:56:55 PM File Saved. 01/01/2011 6:57:07 PM File Saved. 01/01/2011 7:08:25 PM File Saved. 01/01/2011 7:38:25 PM File Saved. 01/01/2011 8:08:25 PM File Saved. 01/01/2011 8:38:25 PM File Saved. 01/01/2011 9:08:25 PM File Saved. 01/01/2011 9:38:25 PM File Saved. 01/01/2011 10:08:25 PM File Saved. 01/01/2011 10:38:25 PM File Saved. 01/01/2011 11:08:25 PM File Saved. 01/01/2011 11:15:13 PM File Saved. 01/01/2011 11:15:52 PM File Saved. 01/01/2011 11:15:54 PM File Saved. 01/01/2011 11:38:25 PM File Saved. 02/01/2011 12:08:3"gfh_0 AM File Saved. 02/01/2011 12:38:25 AM File Saved. 02/01/2011 1:08:25 AM File Saved. 02/01/2011 1:38:25 AM File Saved. 02/01/2011 2:08:25 AM File Saved. 02/01/2011 2:38:25 AM File Saved. 02/01/2011 3:08:25 AM File Saved. 02/01/2011 1:54:04 PM File Saved. 02/01/2011 2:24:04 PM File Saved. 02/01/2011 2:54:04 PM File Saved. 02/01/2011 3:24:04 PM File Saved. 02/01/2011 3:54:04 PM File Saved. 02/01/2011 4:24:04 PM File Saved. 02/01/2011 4:54:04 PM File Saved. 02/01/2011 5:24:04 PM File Saved. 02/01/2011 5:54:04 PM File Saved. 02/01/2011 6:24:04 PM File Saved. 02/01/2011 6:54:04 PM File Saved. 02/01/2011 7:24:04 PM File Saved. 02/01/2011 7:54:04 PM File Saved. 02/01/2011 8:20:54 PM File Saved. 02/01/2011 8:24:04 PM File Saved. 02/01/2011 8:29:22 PM File Saved. 02/01/2011 8:54:04 PM File Saved. 02/01/2011 9:05:22 PM File Saved. 02/01/2011 9:08:51 PM File Saved. 02/01/2011 9:09:04 PM File Saved. 02/01/2011 9:09:11 PM File Saved. 11/05/2011 7:39:18 PM File Opened 11/05/2011 8:09:18 PM File Saved. 11/05/2011 8:31:43 PM File Saved. 11/05/2011 8:32:29 PM File Saved. 11/05/2011 8:33:23 PM File Saved. 11/05/2011 8:33:30 PM File Saved. 11/05/2011 8:39:18 PM File Saved. 11/05/2011 9:05:16 PM File Saved. 11/05/2011 9:09:18 PM File Saved. 11/05/2011 9:20:20 PM File Saved. 11/05/2011 9:22:26 PM File Saved. 11/05/2011 9:27:28 PM File Saved. 11/05/2011 9:31:16 PM File Saved. 11/05/2011 9:39:18 PM File Saved. 11/05/2011 9:39:54 PM File Saved. 11/05/2011 9:40:19 PM File Saved. 11/05/2011 9:42:17 PM File Saved. 11/05/2011 9:42:39 PM File Saved. 11/05/2011 9:42:51 PM File Saved. 11/05/2011 9:43:22 PM File Saved. 11/05/2011 9:44:05 PM File Saved. 11/05/2011 9:44:59 PM File Saved. 11/05/2011 9:45:54 PM File Saved. 11/05/2011 9:46:14 PM File Saved. 11/05/2011 9:46:53 PM File Saved. 11/05/2011 9:50:44 PM File Saved. 11/05/2011 9:53:20 PM File Saved. 11/05/2011 10:01:29 PM File Saved. 11/05/2011 10:01:44 PM File Saved. 11/05/2011 10:02:21 PM File Saved. 11/05/2011 10:06:51 PM File Saved. 11/05/2011 10:09:18 PM File Saved. 11/05/2011 10:09:37 PM File Saved. 11/05/2011 10:20:07 PM File Saved. 11/05/2011 10:28:16 PM File Saved. 11/05/2011 10:30:03 PM File Saved. 11/05/2011 10:30:08 PM File Saved. 11/05/2011 10:30:09 PM File Saved. 11/05/2011 10:30:25 PM File Saved. 11/05/2011 10:36:27 PM File Saved. 11/05/2011 10:37:29 PM File Saved. 11/05/2011 10:37:44 PM File Saved. 11/05/2011 10:38:45 PM File Saved. 11/05/2011 10:39:18 PM File Saved. 11/05/2011 10:44:29 PM File Saved. 11/05/2011 10:44:57 PM File Saved. 11/05/2011 10:46:46 PM File Saved. 11/05/2011 10:46:56 PM File Saved. 11/05/2011 10:49:28 PM File Saved. 11/05/2011 10:52:29 PM File Saved. 11/05/2011 10:54:28 PM File Saved. 11/05/2011 10:57:39 PM File Saved. 11/05/2011 10:59:03 PM File Saved. 11/05/2011 10:59:27 PM File Saved. 11/05/2011 11:04:33 PM File Saved. 11/05/2011 11:05:18 PM File Saved. 11/05/2011 11:08:03 PM File Saved. 11/05/2011 11:08:24 PM File Saved. 11/05/2011 11:09:18 PM File Saved. 11/05/2011 11:10:51 PM File Saved. 11/05/2011 11:12:07 PM File Saved. 11/05/2011 11:12:53 PM File Saved. 11/05/2011 11:13:07 PM File Saved. 11/05/2011 11:13:10 PM File Saved. 11/05/2011 11:16:28 PM File Saved. 11/05/2011 11:17:06 PM File Saved. 11/05/2011 11:20:25 PM File Saved. 11/05/2011 11:22:36 PM File Saved. 11/05/2011 11:22:52 PM File Saved. 11/05/2011 11:30:54 PM File Saved. 11/05/2011 11:31:39 PM File Saved. 11/05/2011 11:33:53 PM File Saved. 11/05/2011 11:34:50 PM File Saved. 11/05/2011 11:36:12 PM File Saved. 11/05/2011 11:37:19 PM File Saved. 11/05/2011 11:37:26 PM File Saved. 11/05/2011 11:38:52 PM File Saved. 11/05/2011 11:39:18 PM File Saved. 11/05/2011 11:40:59 PM File Saved. 11/05/2011 11:41:05 PM File Saved. 11/05/2011 11:41:14 PM File Saved. 11/05/2011 11:41:15 PM File Saved. 11/05/2011 11:41:20 PM File Saved. 12/05/2011 12:09:18 AM File Saved. 12/05/2011 12:39:18 AM File Saved. 12/05/2011 1:09:18 AM File Saved. 12/05/2011 1:39:18 AM File Saved. 12/05/2011 2:"hgi`03:47 AM File Saved. 15/05/2011 3:19:20 AM File Opened 15/05/2011 3:19:48 AM File Saved. 15/05/2011 3:19:59 AM File Saved. 15/05/2011 3:20:03 AM File Saved. 15/05/2011 3:20:12 AM File Saved. 15/05/2011 3:20:28 AM File Saved. 15/05/2011 6:43:21 AM File Opened 15/05/2011 6:44:37 AM File Saved. 15/05/2011 6:50:25 AM File Saved. 15/05/2011 6:50:28 AM File Saved. 16/05/2011 3:01:32 PM File Opened 16/05/2011 3:02:54 PM File Saved. 16/05/2011 3:03:46 PM File Saved. 16/05/2011 3:03:54 PM File Saved. 16/05/2011 3:31:32 PM File Saved. 16/05/2011 4:01:32 PM File Saved. 16/05/2011 4:31:32 PM File Saved. 16/05/2011 5:01:32 PM File Saved. 16/05/2011 5:31:32 PM File Saved. 16/05/2011 6:01:32 PM File Saved. 16/05/2011 6:31:32 PM File Saved. 16/05/2011 7:01:32 PM File Saved. 16/05/2011 7:31:32 PM File Saved. 16/05/2011 8:01:32 PM File Saved. 16/05/2011 8:31:32 PM File Saved. 16/05/2011 9:01:32 PM File Saved. 16/05/2011 9:31:32 PM File Saved. 16/05/2011 10:01:32 PM File Saved. 16/05/2011 10:31:32 PM File Saved. 16/05/2011 11:01:32 PM File Saved. 16/05/2011 11:31:32 PM File Saved. 17/05/2011 12:01:32 AM File Saved. 17/05/2011 12:31:32 AM File Saved. 17/05/2011 1:01:32 AM File Saved. 17/05/2011 1:31:32 AM File Saved. 17/05/2011 2:01:32 AM File Saved. 17/05/2011 2:31:32 AM File Saved. 17/05/2011 3:01:32 AM File Saved. 17/05/2011 3:31:32 AM File Saved. 17/05/2011 4:01:32 AM File Saved. 17/05/2011 4:28:22 AM File Saved. 17/05/2011 4:28:42 AM File Saved. 17/05/2011 4:31:32 AM File Saved. 17/05/2011 11:56:33 AM File Saved. 17/05/2011 12:26:24 PM File Saved. 17/05/2011 12:56:24 PM File Saved. 17/05/2011 1:26:24 PM File Saved. 17/05/2011 1:56:24 PM File Saved. 17/05/2011 2:26:24 PM File Saved. 17/05/2011 2:56:24 PM File Saved. 17/05/2011 3:26:24 PM File Saved. 17/05/2011 3:56:24 PM File Saved. 17/05/2011 4:26:24 PM File Saved. 17/05/2011 4:56:24 PM File Saved. 17/05/2011 5:26:24 PM File Saved. 17/05/2011 5:56:24 PM File Saved. 17/05/2011 6:26:24 PM File Saved. 17/05/2011 6:56:24 PM File Saved. 17/05/2011 7:26:24 PM File Saved. 5/17/2011 7:56:24 PM File Saved. 5/17/2011 8:19:25 PM File Saved. 21/05/2011 4:03:12 PM File Opened 21/05/2011 4:03:56 PM File Saved. 21/05/2011 4:33:11 PM File Saved. 21/05/2011 5:03:11 PM File Saved. 21/05/2011 5:33:11 PM File Saved. 21/05/2011 6:03:11 PM File Saved. 21/05/2011 6:33:11 PM File Saved. 21/05/2011 7:03:11 PM File Saved. 21/05/2011 7:33:11 PM File Saved. 21/05/2011 8:03:11 PM File Saved. 21/05/2011 8:08:12 PM File Saved. 21/05/2011 8:08:22 PM File Saved. 21/05/2011 8:08:40 PM File Saved. 21/05/2011 8:33:11 PM File Saved. 21/05/2011 9:03:11 PM File Saved. 21/05/2011 9:33:11 PM File Saved. 21/05/2011 10:03:11 PM File Saved. 21/05/2011 10:33:11 PM File Saved. 21/05/2011 11:03:11 PM File Saved. 21/05/2011 11:33:11 PM File Saved. 22/05/2011 12:03:11 AM File Saved. 22/05/2011 12:33:11 AM File Saved. 22/05/2011 1:03:11 AM File Saved. 22/05/2011 1:33:11 AM File Saved. 22/05/2011 2:03:11 AM File Saved. 22/05/2011 2:33:11 AM File Saved. 22/05/2011 3:03:11 AM File Saved. 22/05/2011 11:34:12 AM File Saved. 22/05/2011 12:04:11 PM File Saved. 22/05/2011 12:34:11 PM File Saved. 22/05/2011 1:04:11 PM File Saved. 22/05/2011 1:34:11 PM File Saved. 22/05/2011 2:04:11 PM File Saved. 22/05/2011 2:34:11 PM File Saved. 22/05/2011 3:04:11 PM File Saved. 22/05/2011 3:34:11 PM File Saved. 22/05/2011 4:04:11 PM File Saved. 22/05/2011 4:34:11 PM File Saved. 22/05/2011 5:04:11 PM File Saved. 22/05/2011 5:34:11 PM File Saved. 22/05/2011 6:04:11 PM File Saved. 22/05/2011 6:34:11 PM File Saved. 22/05/2011 7:04:11 PM File Saved. 22/05/2011 7:34:11 PM File Saved. 22/05/2011 8:04:11 PM File Saved. 22/05/2011 8:34:11 PM File Saved. 22/05/2011 9:04:11 PM File Saved. 22/05/2011 9:34:11 PM File Saved. 22/05/2011 10:04:11 PM File Saved. 22/05/2011 10:34:11 PM File Saved. 22/05/2011 11:04:11 PM File Saved. 22/05/2011 11:34:11 PM File Saved. 23/05/2011 12:04:11 AM File Saved. 23/05/2011 12:34:11 AM File Saved. 23/05/2011 "ihja1:04:11 AM File Saved. 23/05/2011 1:34:11 AM File Saved. 23/05/2011 2:04:11 AM File Saved. 23/05/2011 2:34:11 AM File Saved. 23/05/2011 3:04:11 AM File Saved. 23/05/2011 3:34:11 AM File Saved. 23/05/2011 4:04:11 AM File Saved. 23/05/2011 4:34:11 AM File Saved. 23/05/2011 5:04:11 AM File Saved. 23/05/2011 11:31:20 AM File Saved. 23/05/2011 12:01:26 PM File Saved. 23/05/2011 12:31:26 PM File Saved. 23/05/2011 1:01:26 PM File Saved. 23/05/2011 1:31:26 PM File Saved. 23/05/2011 2:01:26 PM File Saved. 23/05/2011 2:31:26 PM File Saved. 23/05/2011 3:01:26 PM File Saved. 23/05/2011 3:31:26 PM File Saved. 23/05/2011 3:56:15 PM File Saved. 23/05/2011 3:56:20 PM File Saved. 23/05/2011 3:56:37 PM File Saved. 27/05/2011 1:10:17 AM File Opened 27/05/2011 1:11:25 AM File Saved. 27/05/2011 1:14:37 AM File Saved. 27/05/2011 1:18:55 AM File Saved. 27/05/2011 1:19:32 AM File Saved. 27/05/2011 1:19:38 AM File Saved. 27/05/2011 1:29:42 AM File Saved. 27/05/2011 3:10:50 PM File Opened 27/05/2011 3:12:02 PM File Saved. 27/05/2011 3:12:09 PM File Saved. 27/05/2011 3:14:17 PM File Saved. 27/05/2011 3:14:22 PM File Saved. 27/05/2011 3:40:50 PM File Saved. 27/05/2011 4:10:50 PM File Saved. 27/05/2011 4:40:50 PM File Saved. 27/05/2011 5:10:50 PM File Saved. 27/05/2011 5:40:50 PM File Saved. 27/05/2011 6:10:50 PM File Saved. 27/05/2011 6:40:50 PM File Saved. 27/05/2011 7:25:16 PM File Saved. 27/05/2011 7:55:07 PM File Saved. 27/05/2011 8:25:07 PM File Saved. 27/05/2011 8:55:07 PM File Saved. 27/05/2011 9:25:07 PM File Saved. 27/05/2011 9:55:07 PM File Saved. 27/05/2011 10:25:07 PM File Saved. 27/05/2011 10:55:07 PM File Saved. 27/05/2011 11:25:07 PM File Saved. 27/05/2011 11:55:07 PM File Saved. 28/05/2011 12:25:07 AM File Saved. 28/05/2011 12:55:07 AM File Saved. 28/05/2011 1:25:07 AM File Saved. 28/05/2011 1:55:07 AM File Saved. 28/05/2011 2:25:07 AM File Saved. 28/05/2011 2:55:07 AM File Saved. 28/05/2011 3:25:07 AM File Saved. 28/05/2011 3:55:07 AM File Saved. 28/05/2011 4:25:07 AM File Saved. 28/05/2011 4:55:07 AM File Saved. 28/05/2011 5:25:07 AM File Saved. 28/05/2011 5:55:07 AM File Saved. 28/05/2011 1:46:30 PM File Saved. 28/05/2011 2:16:30 PM File Saved. 28/05/2011 2:46:30 PM File Saved. 28/05/2011 3:16:30 PM File Saved. 28/05/2011 3:46:30 PM File Saved. 28/05/2011 4:16:30 PM File Saved. 28/05/2011 4:46:30 PM File Saved. 28/05/2011 5:16:30 PM File Saved. 28/05/2011 5:46:30 PM File Saved. 28/05/2011 6:16:30 PM File Saved. 28/05/2011 6:46:30 PM File Saved. 28/05/2011 7:16:30 PM File Saved. 28/05/2011 7:46:30 PM File Saved. 28/05/2011 8:16:30 PM File Saved. 28/05/2011 8:46:30 PM File Saved. 28/05/2011 9:16:30 PM File Saved. 28/05/2011 9:46:30 PM File Saved. 28/05/2011 10:16:30 PM File Saved. 28/05/2011 10:46:30 PM File Saved. 28/05/2011 11:16:30 PM File Saved. 28/05/2011 11:46:30 PM File Saved. 29/05/2011 12:16:30 AM File Saved. 29/05/2011 12:46:30 AM File Saved. 29/05/2011 1:16:33 AM File Saved. 29/05/2011 1:46:33 AM File Saved. 29/05/2011 2:16:33 AM File Saved. 29/05/2011 2:46:33 AM File Saved. 29/05/2011 3:16:33 AM File Saved. 29/05/2011 3:46:33 AM File Saved. 29/05/2011 4:16:33 AM File Saved. 29/05/2011 4:46:33 AM File Saved. 29/05/2011 5:16:33 AM File Saved. 29/05/2011 3:04:48 PM File Saved. 29/05/2011 3:34:48 PM File Saved. 29/05/2011 4:04:48 PM File Saved. 29/05/2011 4:34:48 PM File Saved. 29/05/2011 5:04:48 PM File Saved. 29/05/2011 5:34:48 PM File Saved. 29/05/2011 6:04:48 PM File Saved. 29/05/2011 6:34:48 PM File Saved. 29/05/2011 7:04:48 PM File Saved. 29/05/2011 7:34:48 PM File Saved. 29/05/2011 8:04:48 PM File Saved. 29/05/2011 8:34:48 PM File Saved. 29/05/2011 9:04:48 PM File Saved. 29/05/2011 9:34:48 PM File Saved. 29/05/2011 10:04:48 PM File Saved. 29/05/2011 10:34:48 PM File Saved. 29/05/2011 11:04:48 PM File Saved. 29/05/2011 11:34:48 PM File Saved. 30/05/2011 12:04:48 AM File Saved. 30/05/2011 12:34:48 AM File Saved. 30/05/2011 1:04:48 AM File Saved. 30/05/2011 1:34:48 AM File Saved. 30/05/2011"jikb 2:04:48 AM File Saved. 30/05/2011 2:34:48 AM File Saved. 30/05/2011 3:04:48 AM File Saved. 30/05/2011 3:34:48 AM File Saved. 30/05/2011 4:04:48 AM File Saved. 30/05/2011 4:34:48 AM File Saved. 30/05/2011 5:04:48 AM File Saved. 30/05/2011 5:34:48 AM File Saved. 30/05/2011 6:04:48 AM File Saved. 30/05/2011 6:34:48 AM File Saved. 30/05/2011 7:04:48 AM File Saved. 30/05/2011 2:10:17 PM File Saved. 30/05/2011 2:40:08 PM File Saved. 30/05/2011 3:10:08 PM File Saved. 30/05/2011 3:40:08 PM File Saved. 30/05/2011 4:10:08 PM File Saved. 30/05/2011 4:40:08 PM File Saved. 30/05/2011 5:10:08 PM File Saved. 30/05/2011 5:40:08 PM File Saved. 30/05/2011 6:10:08 PM File Saved. 30/05/2011 6:40:08 PM File Saved. 30/05/2011 7:10:08 PM File Saved. 30/05/2011 7:40:08 PM File Saved. 30/05/2011 8:10:08 PM File Saved. 30/05/2011 8:40:08 PM File Saved. 30/05/2011 9:10:08 PM File Saved. 30/05/2011 9:40:08 PM File Saved. 30/05/2011 10:10:08 PM File Saved. 30/05/2011 10:40:08 PM File Saved. 30/05/2011 11:10:08 PM File Saved. 30/05/2011 11:40:08 PM File Saved. 31/05/2011 12:10:08 AM File Saved. 31/05/2011 12:40:08 AM File Saved. 31/05/2011 1:10:08 AM File Saved. 31/05/2011 1:40:08 AM File Saved. 31/05/2011 2:10:08 AM File Saved. 31/05/2011 2:40:08 AM File Saved. 31/05/2011 3:10:08 AM File Saved. 31/05/2011 3:40:08 AM File Saved. 31/05/2011 1:40:14 PM File Saved. 31/05/2011 2:10:13 PM File Saved. 31/05/2011 2:40:13 PM File Saved. 31/05/2011 3:10:13 PM File Saved. 31/05/2011 3:40:13 PM File Saved. 31/05/2011 4:10:13 PM File Saved. 31/05/2011 4:40:13 PM File Saved. 31/05/2011 5:10:13 PM File Saved. 31/05/2011 5:40:13 PM File Saved. 31/05/2011 6:10:13 PM File Saved. 31/05/2011 6:40:13 PM File Saved. 31/05/2011 7:10:13 PM File Saved. 31/05/2011 7:40:13 PM File Saved. 31/05/2011 8:10:13 PM File Saved. 31/05/2011 8:40:13 PM File Saved. 31/05/2011 9:10:13 PM File Saved. 31/05/2011 9:40:13 PM File Saved. 31/05/2011 10:10:13 PM File Saved. 31/05/2011 10:40:13 PM File Saved. 31/05/2011 11:10:13 PM File Saved. 31/05/2011 11:40:13 PM File Saved. 01/06/2011 12:10:13 AM File Saved. 01/06/2011 12:40:13 AM File Saved. 01/06/2011 1:10:13 AM File Saved. 01/06/2011 1:40:13 AM File Saved. 01/06/2011 2:10:13 AM File Saved. 01/06/2011 2:40:13 AM File Saved. 01/06/2011 3:10:13 AM File Saved. 01/06/2011 3:40:13 AM File Saved. 01/06/2011 1:07:32 PM File Saved. 01/06/2011 1:37:32 PM File Saved. 01/06/2011 2:07:32 PM File Saved. 01/06/2011 2:37:32 PM File Saved. 01/06/2011 3:07:32 PM File Saved. 01/06/2011 3:37:32 PM File Saved. 01/06/2011 4:07:32 PM File Saved. 01/06/2011 4:37:32 PM File Saved. 01/06/2011 5:07:32 PM File Saved. 01/06/2011 5:37:32 PM File Saved. 01/06/2011 5:46:56 PM File Saved. 01/06/2011 5:47:00 PM File Saved. 04/06/2011 4:59:48 AM File Opened 04/06/2011 5:00:18 AM File Saved. 04/06/2011 5:00:23 AM File Saved. 04/06/2011 5:02:12 AM File Saved. 31/08/2011 11:42:46 PM File Opened 31/08/2011 11:43:08 PM File Saved. 31/08/2011 11:43:15 PM File Saved. 28/04/2012 8:11:23 PM File Opened 28/04/2012 8:15:59 PM File Saved. 28/04/2012 8:16:02 PM File Saved. 28/04/2012 8:16:45 PM File Saved. 28/04/2012 8:18:36 PM File Saved. 28/04/2012 8:20:18 PM File Saved. 28/04/2012 8:21:23 PM File Saved. 28/04/2012 8:21:25 PM File Saved. 28/04/2012 8:21:50 PM File Saved. 28/04/2012 8:21:54 PM File Saved. 28/04/2012 8:23:37 PM File Saved. 28/04/2012 8:26:03 PM File Saved. 28/04/2012 8:27:31 PM File Saved. 28/04/2012 8:33:25 PM File Saved. 28/04/2012 8:36:26 PM File Saved. 28/04/2012 8:36:45 PM File Saved. 28/04/2012 8:38:07 PM File Saved. 28/04/2012 8:38:09 PM File Saved. 28/04/2012 8:39:47 PM File Saved. 28/04/2012 8:41:01 PM File Saved. 28/04/2012 8:41:23 PM File Saved. 28/04/2012 8:56:58 PM File Saved. 28/04/2012 8:57:16 PM File Saved. 28/04/2012 9:11:23 PM File Saved. 28/04/2012 9:41:23 PM File Saved. 28/04/2012 9:52:32 PM File Saved. 13/05/2012 1:20:33 AM File Opened 13/05/2012 1:21:18 AM File Saved. 13/05/2012 1:21:58 AM File Saved. 13/05/2012 1:50"kjlc:32 AM File Saved. 13/05/2012 1:57:19 AM File Saved. 13/05/2012 2:20:32 AM File Saved. 13/05/2012 2:50:32 AM File Saved. 13/05/2012 3:20:32 AM File Saved. 13/05/2012 3:50:32 AM File Saved. 13/05/2012 4:20:32 AM File Saved. 13/05/2012 4:50:32 AM File Saved. 13/05/2012 5:20:32 AM File Saved. 13/05/2012 5:50:32 AM File Saved. 13/05/2012 1:20:04 PM File Saved. 13/05/2012 1:50:04 PM File Saved. 13/05/2012 2:20:04 PM File Saved. 13/05/2012 2:50:04 PM File Saved. 13/05/2012 3:20:04 PM File Saved. 13/05/2012 3:50:04 PM File Saved. 13/05/2012 4:03:05 PM File Saved. 13/05/2012 4:20:04 PM File Saved. 13/05/2012 4:50:04 PM File Saved. 13/05/2012 4:56:39 PM File Saved. 13/05/2012 5:20:04 PM File Saved. 13/05/2012 5:50:04 PM File Saved. 13/05/2012 6:20:04 PM File Saved. 13/05/2012 6:50:04 PM File Saved. 13/05/2012 7:20:04 PM File Saved. 13/05/2012 7:50:04 PM File Saved. 13/05/2012 8:20:04 PM File Saved. 13/05/2012 8:50:04 PM File Saved. 13/05/2012 9:20:04 PM File Saved. 13/05/2012 9:50:04 PM File Saved. 13/05/2012 10:20:04 PM File Saved. 13/05/2012 10:50:04 PM File Saved. 13/05/2012 11:20:04 PM File Saved. 13/05/2012 11:50:04 PM File Saved. 14/05/2012 12:20:04 AM File Saved. 14/05/2012 12:50:04 AM File Saved. 14/05/2012 1:20:04 AM File Saved. 14/05/2012 1:50:04 AM File Saved. 14/05/2012 2:20:04 AM File Saved. 14/05/2012 2:50:04 AM File Saved. 14/05/2012 3:20:04 AM File Saved. 14/05/2012 3:50:04 AM File Saved. 14/05/2012 4:20:04 AM File Saved. 14/05/2012 4:50:04 AM File Saved. 14/05/2012 5:20:04 AM File Saved. 14/05/2012 5:50:04 AM File Saved. 14/05/2012 6:20:04 AM File Saved. 14/05/2012 6:50:04 AM File Saved. 14/05/2012 7:20:04 AM File Saved. 14/05/2012 7:50:04 AM File Saved. 14/05/2012 8:20:04 AM File Saved. 14/05/2012 8:50:04 AM File Saved. 14/05/2012 9:20:04 AM File Saved. 14/05/2012 9:50:04 AM File Saved. 14/05/2012 10:20:04 AM File Saved. 14/05/2012 10:50:04 AM File Saved. 14/05/2012 11:20:04 AM File Saved. 14/05/2012 11:50:04 AM File Saved. 14/05/2012 12:20:04 PM File Saved. 14/05/2012 12:50:04 PM File Saved. 14/05/2012 1:20:21 PM File Saved. 14/05/2012 1:50:21 PM File Saved. 14/05/2012 2:20:21 PM File Saved. 14/05/2012 2:50:21 PM File Saved. 14/05/2012 3:20:21 PM File Saved. 14/05/2012 3:50:21 PM File Saved. 14/05/2012 4:20:21 PM File Saved. 14/05/2012 4:50:21 PM File Saved. 14/05/2012 5:20:21 PM File Saved. 14/05/2012 5:50:21 PM File Saved. 14/05/2012 6:20:21 PM File Saved. 14/05/2012 6:50:21 PM File Saved. 14/05/2012 7:20:21 PM File Saved. 14/05/2012 7:50:21 PM File Saved. 14/05/2012 8:20:21 PM File Saved. 14/05/2012 8:50:21 PM File Saved. 14/05/2012 9:20:21 PM File Saved. 14/05/2012 9:50:21 PM File Saved. 14/05/2012 10:20:21 PM File Saved. 14/05/2012 10:50:21 PM File Saved. 14/05/2012 11:20:21 PM File Saved. 14/05/2012 11:50:21 PM File Saved. 15/05/2012 12:20:21 AM File Saved. 15/05/2012 12:50:21 AM File Saved. 15/05/2012 1:20:21 AM File Saved. 15/05/2012 1:50:21 AM File Saved. 15/05/2012 2:20:21 AM File Saved. 15/05/2012 2:50:21 AM File Saved. 15/05/2012 3:20:21 AM File Saved. 15/05/2012 3:50:21 AM File Saved. 15/05/2012 4:20:21 AM File Saved. 15/05/2012 4:50:21 AM File Saved. 15/05/2012 11:58:42 AM File Saved. 15/05/2012 12:28:39 PM File Saved. 15/05/2012 12:58:39 PM File Saved. 15/05/2012 1:28:39 PM File Saved. 15/05/2012 1:58:39 PM File Saved. 15/05/2012 2:28:39 PM File Saved. 15/05/2012 2:58:39 PM File Saved. 15/05/2012 3:28:39 PM File Saved. 15/05/2012 3:58:39 PM File Saved. 15/05/2012 4:28:39 PM File Saved. 15/05/2012 4:58:39 PM File Saved. 15/05/2012 5:28:39 PM File Saved. 15/05/2012 5:58:39 PM File Saved. 15/05/2012 6:28:39 PM File Saved. 15/05/2012 6:58:39 PM File Saved. 15/05/2012 7:28:39 PM File Saved. 15/05/2012 7:58:39 PM File Saved. 15/05/2012 8:28:39 PM File Saved. 15/05/2012 8:58:39 PM File Saved. 15/05/2012 9:28:39 PM File Saved. 15/05/2012 9:58:39 PM File Saved. 15/05/2012 10:28:39 PM File Saved. 15/05/2012 10:58:39 PM File Saved. 15/05/2012 11:28:39 PM File Saved. 15/05/2012 "lkmd11:58:39 PM File Saved. 16/05/2012 12:28:39 AM File Saved. 16/05/2012 12:58:39 AM File Saved. 16/05/2012 1:28:39 AM File Saved. 16/05/2012 1:58:39 AM File Saved. 16/05/2012 2:28:39 AM File Saved. 16/05/2012 11:37:52 AM File Saved. 16/05/2012 12:07:43 PM File Saved. 16/05/2012 12:37:43 PM File Saved. 16/05/2012 1:07:43 PM File Saved. 16/05/2012 1:37:43 PM File Saved. 16/05/2012 2:07:43 PM File Saved. 16/05/2012 2:37:43 PM File Saved. 16/05/2012 3:07:43 PM File Saved. 16/05/2012 3:37:43 PM File Saved. 16/05/2012 4:07:43 PM File Saved. 16/05/2012 4:37:43 PM File Saved. 16/05/2012 5:07:43 PM File Saved. 16/05/2012 5:37:43 PM File Saved. 16/05/2012 6:07:43 PM File Saved. 16/05/2012 6:37:43 PM File Saved. 16/05/2012 7:07:43 PM File Saved. 16/05/2012 7:37:43 PM File Saved. 16/05/2012 8:07:43 PM File Saved. 16/05/2012 8:37:43 PM File Saved. 16/05/2012 9:07:43 PM File Saved. 16/05/2012 9:37:43 PM File Saved. 16/05/2012 10:07:43 PM File Saved. 16/05/2012 10:37:43 PM File Saved. 16/05/2012 11:07:43 PM File Saved. 16/05/2012 11:37:43 PM File Saved. 17/05/2012 12:07:43 AM File Saved. 17/05/2012 12:37:43 AM File Saved. 17/05/2012 1:07:43 AM File Saved. 17/05/2012 1:37:43 AM File Saved. 17/05/2012 2:07:43 AM File Saved. 17/05/2012 2:37:43 AM File Saved. 17/05/2012 3:07:43 AM File Saved. 17/05/2012 3:18:43 AM File Saved. 22/05/2013 12:21:15 AM File Opened 22/05/2013 12:51:14 AM File Saved. 22/05/2013 1:21:14 AM File Saved. 22/05/2013 1:51:14 AM File Saved. 22/05/2013 2:21:14 AM File Saved. 22/05/2013 10:48:48 AM File Saved. 22/05/2013 11:18:48 AM File Saved. 22/05/2013 11:48:48 AM File Saved. 22/05/2013 12:18:48 PM File Saved. 22/05/2013 12:48:48 PM File Saved. 22/05/2013 1:18:48 PM File Saved. 22/05/2013 1:48:48 PM File Saved. 22/05/2013 2:18:48 PM File Saved. 22/05/2013 2:48:48 PM File Saved. 22/05/2013 3:18:48 PM File Saved. 22/05/2013 3:48:48 PM File Saved. 22/05/2013 4:18:48 PM File Saved. 22/05/2013 4:48:48 PM File Saved. 22/05/2013 5:18:48 PM File Saved. 22/05/2013 5:48:48 PM File Saved. 22/05/2013 6:18:48 PM File Saved. 22/05/2013 6:48:48 PM File Saved. 22/05/2013 7:18:48 PM File Saved. 22/05/2013 7:48:48 PM File Saved. 22/05/2013 8:18:48 PM File Saved. 22/05/2013 8:48:48 PM File Saved. 22/05/2013 9:18:48 PM File Saved. 22/05/2013 9:48:48 PM File Saved. 22/05/2013 10:18:48 PM File Saved. 22/05/2013 10:48:48 PM File Saved. 22/05/2013 11:18:48 PM File Saved. 22/05/2013 11:48:48 PM File Saved. 23/05/2013 12:18:48 AM File Saved. 23/05/2013 3:00:24 AM File Saved. 23/05/2013 3:30:13 AM File Saved. 23/05/2013 4:00:13 AM File Saved. 23/05/2013 4:30:13 AM File Saved. 23/05/2013 5:00:13 AM File Saved. 23/05/2013 5:30:13 AM File Saved. 23/05/2013 6:00:13 AM File Saved. 23/05/2013 6:30:13 AM File Saved. 23/05/2013 7:00:13 AM File Saved. 23/05/2013 7:30:13 AM File Saved. 23/05/2013 8:00:13 AM File Saved. 23/05/2013 8:30:13 AM File Saved. 23/05/2013 9:00:13 AM File Saved. 23/05/2013 9:30:13 AM File Saved. 23/05/2013 10:00:13 AM File Saved. 23/05/2013 10:30:13 AM File Saved. 23/05/2013 11:00:13 AM File Saved. 23/05/2013 11:30:13 AM File Saved. 23/05/2013 12:00:13 PM File Saved. 23/05/2013 12:30:13 PM File Saved. 23/05/2013 1:00:13 PM File Saved. 23/05/2013 1:30:13 PM File Saved. 23/05/2013 2:00:13 PM File Saved. 23/05/2013 2:30:13 PM File Saved. 23/05/2013 3:00:13 PM File Saved. 23/05/2013 3:30:13 PM File Saved. 23/05/2013 4:00:13 PM File Saved. 23/05/2013 4:30:13 PM File Saved. 23/05/2013 5:00:13 PM File Saved. 23/05/2013 5:31:14 PM File Saved. 23/05/2013 6:01:14 PM File Saved. 23/05/2013 6:31:14 PM File Saved. 23/05/2013 7:01:14 PM File Saved. 23/05/2013 7:31:14 PM File Saved. 5/23/2013 8:01:14 PM File Saved. 5/23/2013 8:31:14 PM File Saved. 5/23/2013 9:01:14 PM File Saved. 5/23/2013 9:31:14 PM File Saved. 5/23/2013 10:01:14 PM File Saved. 5/23/2013 10:31:14 PM File Saved. 5/23/2013 11:01:14 PM File Saved. 5/23/2013 11:31:14 PM File Saved. 5/24/2013 9:49:05 AM File Saved. 5/24/2013 10:19:05 AM File Saved. 5/24/2"mlne013 10:49:05 AM File Saved. 5/24/2013 11:19:05 AM File Saved. 5/24/2013 11:49:05 AM File Saved. 5/24/2013 12:19:05 PM File Saved. 5/24/2013 12:49:05 PM File Saved. 5/24/2013 1:19:05 PM File Saved. 5/24/2013 1:49:05 PM File Saved. 5/24/2013 2:19:05 PM File Saved. 5/24/2013 2:49:05 PM File Saved. 5/24/2013 3:19:05 PM File Saved. 5/24/2013 3:49:05 PM File Saved. 5/24/2013 4:19:05 PM File Saved. 5/24/2013 4:49:05 PM File Saved. 5/24/2013 5:19:05 PM File Saved. 5/24/2013 5:49:05 PM File Saved. 5/24/2013 6:19:05 PM File Saved. 5/24/2013 6:49:05 PM File Saved. 5/24/2013 7:19:05 PM File Saved. 5/24/2013 7:49:05 PM File Saved. 5/24/2013 8:19:05 PM File Saved. 5/24/2013 8:49:05 PM File Saved. 5/24/2013 9:19:05 PM File Saved. 5/24/2013 9:49:05 PM File Saved. 5/24/2013 10:19:05 PM File Saved. 5/24/2013 10:49:05 PM File Saved. 5/24/2013 11:19:05 PM File Saved. 26/05/2013 3:10:22 PM File Opened 26/05/2013 3:16:40 PM File Saved. 26/05/2013 3:18:47 PM File Saved. 26/05/2013 3:19:33 PM File Saved. 26/05/2013 3:20:28 PM File Saved. 26/05/2013 3:35:35 PM File Saved. 10/06/2013 4:48:08 AM File Opened 10/06/2013 4:53:38 AM File Saved. 10/06/2013 12:13:12 PM File Saved. 10/06/2013 12:43:15 PM File Saved. 10/06/2013 1:13:15 PM File Saved. 10/06/2013 1:43:15 PM File Saved. 10/06/2013 2:13:15 PM File Saved. 10/06/2013 2:43:15 PM File Saved. 10/06/2013 3:13:15 PM File Saved. 10/06/2013 3:43:15 PM File Saved. 10/06/2013 4:13:15 PM File Saved. 10/06/2013 4:43:15 PM File Saved. 10/06/2013 5:13:15 PM File Saved. 10/06/2013 5:43:15 PM File Saved. 10/06/2013 6:13:15 PM File Saved. 10/06/2013 6:43:15 PM File Saved. 10/06/2013 7:13:15 PM File Saved. 10/06/2013 7:43:15 PM File Saved. 10/06/2013 8:13:15 PM File Saved. 10/06/2013 8:43:15 PM File Saved. 10/06/2013 9:13:15 PM File Saved. 10/06/2013 9:43:15 PM File Saved. 10/06/2013 10:13:15 PM File Saved. 10/06/2013 10:43:15 PM File Saved. 10/06/2013 11:13:15 PM File Saved. 10/06/2013 11:43:15 PM File Saved. 11/06/2013 12:13:15 AM File Saved. 11/06/2013 9:43:36 AM File Saved. 11/06/2013 10:13:25 AM File Saved. 11/06/2013 10:43:25 AM File Saved. 11/06/2013 11:13:25 AM File Saved. 11/06/2013 11:43:25 AM File Saved. 11/06/2013 12:13:25 PM File Saved. 11/06/2013 12:43:25 PM File Saved. 11/06/2013 1:13:25 PM File Saved. 11/06/2013 1:43:25 PM File Saved. 11/06/2013 2:13:25 PM File Saved. 11/06/2013 2:43:25 PM File Saved. 11/06/2013 3:13:25 PM File Saved. 11/06/2013 3:43:25 PM File Saved. 11/06/2013 4:13:25 PM File Saved. 11/06/2013 4:43:25 PM File Saved. 11/06/2013 5:13:25 PM File Saved. 11/06/2013 5:43:26 PM File Saved. 11/06/2013 6:13:25 PM File Saved. 11/06/2013 6:43:25 PM File Saved. 11/06/2013 7:13:25 PM File Saved. 11/06/2013 7:43:25 PM File Saved. 11/06/2013 8:13:25 PM File Saved. 11/06/2013 8:43:25 PM File Saved. 11/06/2013 9:13:25 PM File Saved. 11/06/2013 9:43:25 PM File Saved. 11/06/2013 10:13:25 PM File Saved. 11/06/2013 10:43:25 PM File Saved. 11/06/2013 11:13:25 PM File Saved. 11/06/2013 11:43:25 PM File Saved. 12/06/2013 12:13:25 AM File Saved. 12/06/2013 12:43:25 AM File Saved. 12/06/2013 1:13:25 AM File Saved. 12/06/2013 1:43:25 AM File Saved. 12/06/2013 2:13:25 AM File Saved. 12/06/2013 2:43:25 AM File Saved. 12/06/2013 3:13:25 AM File Saved. 12/06/2013 3:43:25 AM File Saved. 12/06/2013 4:13:25 AM File Saved. 12/06/2013 4:43:25 AM File Saved. 12/06/2013 5:13:25 AM File Saved. 12/06/2013 5:43:25 AM File Saved. 12/06/2013 6:13:25 AM File Saved. 12/06/2013 6:43:25 AM File Saved. 12/06/2013 7:13:25 AM File Saved. 12/06/2013 7:43:25 AM File Saved. 12/06/2013 8:13:25 AM File Saved. 12/06/2013 8:43:25 AM File Saved. 12/06/2013 9:13:25 AM File Saved. 12/06/2013 9:43:25 AM File Saved. 12/06/2013 10:13:25 AM File Saved. 12/06/2013 10:43:25 AM File Saved. 12/06/2013 11:13:25 AM File Saved. 12/06/2013 11:43:25 AM File Saved. 12/06/2013 12:13:25 PM File Saved. 12/06/2013 12:43:25 PM File Saved. 12/06/2013 1:13:25 PM File Saved. 12/06/2013 1:43:25 PM File Saved. 12/06/2013 2:13:25 "nmofPM File Saved. 12/06/2013 2:43:25 PM File Saved. 12/06/2013 3:13:25 PM File Saved. 12/06/2013 3:43:25 PM File Saved. 12/06/2013 4:13:25 PM File Saved. 12/06/2013 4:43:25 PM File Saved. 12/06/2013 5:13:25 PM File Saved. 12/06/2013 5:43:25 PM File Saved. 12/06/2013 6:13:25 PM File Saved. 12/06/2013 6:43:25 PM File Saved. 12/06/2013 7:13:25 PM File Saved. 12/06/2013 7:43:25 PM File Saved. 12/06/2013 8:13:25 PM File Saved. 12/06/2013 8:43:25 PM File Saved. 12/06/2013 9:13:25 PM File Saved. 12/06/2013 9:43:25 PM File Saved. 12/06/2013 10:13:25 PM File Saved. 12/06/2013 10:43:25 PM File Saved. 12/06/2013 11:13:25 PM File Saved. 12/06/2013 11:43:25 PM File Saved. 13/06/2013 3:00:13 AM File Saved. 13/06/2013 10:35:16 AM File Saved. 13/06/2013 11:05:01 AM File Saved. 13/06/2013 11:05:13 AM File Opened 13/06/2013 11:08:28 AM File Saved. 04/02/2014 3:18:10 PM File Opened 04/02/2014 3:21:53 PM File Saved. 04/02/2014 3:48:09 PM File Saved. 04/02/2014 4:18:09 PM File Saved. 04/02/2014 4:48:09 PM File Saved. 04/02/2014 5:18:09 PM File Saved. 04/02/2014 5:48:09 PM File Saved. 04/02/2014 6:18:09 PM File Saved. 04/02/2014 6:48:09 PM File Saved. 04/02/2014 7:18:09 PM File Saved. 04/02/2014 7:48:09 PM File Saved. 04/02/2014 8:18:09 PM File Saved. 04/02/2014 8:48:09 PM File Saved. 04/02/2014 9:18:09 PM File Saved. 04/02/2014 9:48:09 PM File Saved. 04/02/2014 10:05:44 PM File Saved. 15/06/2014 11:00:36 PM File Opened 15/06/2014 11:01:26 PM File Saved. 15/06/2014 11:03:27 PM File Saved. 15/06/2014 11:04:25 PM File Saved. 24/12/2015 6:59:08 PM File Opened 24/12/2015 7:02:12 PM File Saved. 24/12/2015 7:03:56 PM File Saved. 24/12/2015 7:04:20 PM File Saved. 24/12/2015 7:05:17 PM File Saved. 24/12/2015 7:06:57 PM File Saved. 24/12/2015 7:08:18 PM File Saved. 24/12/2015 7:08:41 PM File Saved. 24/12/2015 7:10:27 PM File Saved. 24/12/2015 7:11:52 PM File Saved. 24/12/2015 7:12:56 PM File Saved. 14/09/2016 1:04:38 AM File Opened 14/09/2016 1:04:50 AM File Saved. 14/09/2016 1:18:06 AM File Saved. 14/09/2016 1:20:59 AM File Saved. 14/09/2016 1:21:00 AM File Saved. 14/09/2016 1:22:09 AM File Saved. 14/09/2016 1:25:36 AM File Saved. 14/09/2016 1:26:09 AM File Saved. 14/09/2016 1:34:37 AM File Saved. 14/09/2016 2:04:37 AM File Saved. 14/09/2016 2:34:37 AM File Saved. 14/09/2016 3:04:37 AM File Saved. 14/09/2016 3:34:37 AM File Saved. 14/09/2016 4:04:37 AM File Saved. 14/09/2016 4:34:37 AM File Saved. 14/09/2016 5:04:37 AM File Saved. 14/09/2016 5:34:37 AM File Saved. 14/09/2016 4:44:08 PM File Saved. 14/09/2016 5:14:08 PM File Saved. 14/09/2016 5:44:08 PM File Saved. 14/09/2016 6:14:08 PM File Saved. 14/09/2016 6:44:08 PM File Saved. 14/09/2016 7:14:08 PM File Saved. 14/09/2016 7:44:08 PM File Saved. 14/09/2016 8:14:08 PM File Saved. 14/09/2016 8:44:08 PM File Saved. 14/09/2016 9:14:08 PM File Saved. 14/09/2016 9:44:08 PM File Saved. 14/09/2016 10:14:08 PM File Saved. 14/09/2016 10:44:08 PM File Saved. 14/09/2016 11:14:08 PM File Saved. 14/09/2016 11:44:08 PM File Saved. 15/09/2016 12:14:08 AM File Saved. 15/09/2016 12:44:08 AM File Saved. 15/09/2016 1:14:08 AM File Saved. 15/09/2016 1:44:08 AM File Saved. 15/09/2016 2:14:08 AM File Saved. 15/09/2016 2:44:08 AM File Saved. 15/09/2016 3:14:08 AM File Saved. 15/09/2016 3:44:08 AM File Saved. 15/09/2016 4:14:08 AM File Saved. 15/09/2016 4:44:08 AM File Saved. 15/09/2016 11:03:05 AM File Saved. 15/09/2016 11:33:05 AM File Saved. 15/09/2016 12:03:05 PM File Saved. 15/09/2016 12:33:05 PM File Saved. 15/09/2016 1:03:05 PM File Saved. 15/09/2016 1:33:05 PM File Saved. 15/09/2016 2:03:05 PM File Saved. 15/09/2016 2:33:05 PM File Saved. 15/09/2016 3:03:05 PM File Saved. 15/09/2016 3:33:05 PM File Saved. 15/09/2016 4:03:05 PM File Saved. 15/09/2016 4:33:05 PM File Saved. 19/09/2016 6:47:03 PM File Opened 19/09/2016 6:47:44 PM File Saved.N1 Trash Trash,sIc"onpgon=1 exp=1 sel=0N1HelpExtractHelpExtractIsCompile=1 Project Target=0 DisplayHelpWhenCompiled=1 DeleteTemp=0 Win16=0 MissingFont=1 TestCompile=0 HtmlExt=.htm Project Name=HelpExtract Title=Cheat Engine help Copyright=Made with Shalom Help Maker www.danish-shareware.dk/soft/shelpm/ FontSet=ANSI_CHARSET Target5=1 AutoStt=0 AutoInc=10 AutoCur=100 Next=Next Prev=Previous Top=Top NavHtml=1 DefaultTopic=SHM_contents0001 Target4=1 PSFTS=True Project Target1=0 Project Target2=1 Project Target3=0 Project Target4=0 Project Target5=0 Project Target6=0 Project Target7=0 WinHelp65536=1 TopicAsPict=1 Exec=1 AutoNum=1 MSDN=0 BinaryToc=0 Color=0 ICON=0 css=0 cssor=0 csschm=hm.css cssweb=hm.css csswebtoc=hmtoc.css undertopic=0 HtmlStatic=0 HtmlBorder=0 HtmlNum=0 HtmlWidth=35 HtmlIndent=20 NavShow=0 Unicode=0 sIcon=7 exp=1 sel=0 <#TITLE>

<#TOC>
V <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> % <#TITLE> <#AKEYWORD> <#T_TEXT>  <#TITLE>

<#TOC>
< <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT>  <#TITLE> <#AKEYWORD> <#T_TEXT> N1Help ContentsHelp Contents,sIcon=4 exp=0 sel=0N1 Popups Popups,sIcon=6 exp=0 sel=0N1Window ListWindow List,sIcon=5 exp=0 sel=0N1Main MainC01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 sIcon=8 exp=0 sel=0N1 Popup PopupC01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 sIcon=8 exp=0 sel=0N1cheat enginecheat engineIsCompile=1 Project Target=0 DisplayHelpWhenCompiled=1 DeleteTemp=0 Win16=0 MissingFont=1 TestCompile=0 HtmlExt=.htm Project Name=cheat-engine Title=Cheat Engine help Copyright=Made with Shalom Help Maker www.danish-shareware.dk/soft/shelpm/ FontSet=ANSI_CHARSET Target5=1 AutoStt=0 AutoInc=10 AutoCur=100 Next=Next Prev=Previous Top=Top NavHtml=1 DefaultTopic="poqhSHM_contents0001 Target4=1 PSFTS=True Project Target1=0 Project Target2=1 Project Target3=0 Project Target4=0 Project Target5=0 Project Target6=0 Project Target7=0 WinHelp65536=1 TopicAsPict=1 Exec=1 AutoNum=1 MSDN=0 BinaryToc=0 Color=0 ICON=0 css=0 cssor=0 csschm=hm.css cssweb=hm.css csswebtoc=hmtoc.css undertopic=0 HtmlStatic=0 HtmlBorder=0 HtmlNum=0 HtmlWidth=35 HtmlIndent=20 NavShow=0 Unicode=0 sIcon=7 exp=1 sel=0! <#TITLE>

<#TOC>
V <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> % <#TITLE> <#AKEYWORD> <#T_TEXT>  <#TITLE>

<#TOC>
<#TITLE>

<#TOC>
x <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> 2 <#TITLE> <#AKEYWORD> <#T_TEXT> <#TITLE> <#AKEYWORD> <#T_TEXT> N1Help ContentsHelp Contents,sIcon=4 exp=0 sel=0N1 Popups Popups,sIcon=6 exp=0 sel=0N1Window ListWindow List,sIcon=5 exp=1 sel=0N1Main Main>C01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 X01=591 X02=9 X03=9 X04=557 sIcon=8 exp=1 sel=0N1 Popup >C01=16112843 C02=16112843 A00=0 A01=0 A02=0 A03=0 A04=0 A05=0 A06=0 A07=0 A08=0 A09=0 A10=0 A11=0 Z01=0 Z02=0 Z03=0 Z04=0 Z05=0 Z06=0 Z07=0 Z08=0 Z09=0 Z10=0 Z11=0 Z12=0 Z13=0 Z14=0 Z15=0 Z16=0 Z17=0 X01=400 X02=40 X03=20 X04=400 sIcon=8 exp=0 sel=0TntMemo1 N1CEHelpDecompileVIsCompile=1 Project Target=0 DisplayHelpWhenCompiled=1 DeleteTemp=0 Win16=0 MissingFont=1 TestCompile=0 HtmlExt=.htm Project Name=HelpDecompile Title=YourProjectName Copyright=Copyright 2008 by ... DialogFont=MS Sans Serif,8,0 FontSet=ANSI_CHARSET CbLang=0x0409, English (USA) Target5=1 AutoStt=0 AutoInc=10 AutoCur=10"qpri0 Next=Next Prev=Previous Top=Top NavHtml=1 Project Target1=0 Project Target2=1 Project Target3=0 Project Target4=0 Project Target5=0 Project Target6=0 Project Target7=0 WinHelp65536=1 TopicAsPict=1 Target4=1 Exec=1 AutoNum=1 MSDN=0 BinaryToc=0 Color=0 ICON=0 css=0 cssor=0 csschm=hm.css cssweb=hm.css csswebtoc=hmtoc.css undertopic=0 HtmlStatic=0 HtmlBorder=0 HtmlNum=0 HtmlWidth=35 HtmlIndent=20 NavShow=0 Unicode=0 sIcon=7 exp=1 sel=0 <#TITLE>

<#TOC>
V <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> % <#TITLE> <#AKEYWORD> <#T_TEXT>  <#TITLE>

<#TOC>
<#TITLE>

<#TOC>
<#TITLE>

<#TOC>
 <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> <#TITLE> <#AKEYWORD>
<#T_HEADER> <#PREV> <#TOP> <#NEXT>
<#T_TEXT> u <#TITLE> <#AKEYWORD> <#T_TEXT> <#TITLE> <#AKEYWORD> <#T_TEXT> <#TITLE> <#AKEYWORD> <#T_TEXT> N1Help ContentsHelp Contents,sIcon=4 exp=0 sel=0N1&About this helpfile"Aboutthishelpfile"AboutthishelpfileHelpMacro=1 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=6 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBookPage=13/09/2008 03:10 sBook=13/09/2008 03:13errors poor lame About this helpfile mistakes Please kill me now shit I am a lemming crap icq {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 This helpfile is just to help with the basics of Cheat Engine, if you think you can write"rqsj a better helpfile please do so and send it to dark_byte@hotmail.com, thanks! ;-)\line\line DB\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b About this helpfile\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1$About Cheat Engine AboutCheatEngine AboutCheatEngineHelpMacro=2 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13dicq About Cheat Engine Standard scan settings {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Cheat Engine is a program designed to make cheating on games easy for people that are new to cheating in games, and for people who already know a lot about cheating.\line This program came into existance because at the time there where no free easy to use cheat programs, and the ones that where free weren't very easy to use for a beginner. (Or lacked some essential stuff)\line\line Also, I was used to cheat on games using gamehack, and when I moved on to Win2000 I couldn't get it to work, so decided to make something that did work... (And cause I just had to do something, like how to learn to program)\line\line Over time Cheat Engine has had a lot of improvements, more features, and better stability than the very first versions, and that all thanks to the ideas and suggestions of people that sent me some feedback, so, if you want to help make Cheat Engine better, send your ideas and suggestions, to dark_byte@hotmail.com (MSN supported) .\line Or you could download the source code, make changes yourself and send them to me. (CE is written mainly in Delphi, so it helps if you know that language before you try it ;-) )\line\line Also, another way to motivate me to work on Cheat Engine, is to donate. You can donate whatever ammount you prefer to dark_byte@hotmail.com using paypal.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b About Cheat Engine\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1,Standard scan settings(Standardscansettings(StandardscansettingsHelpMacro=3 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Standard scan settings Next scan value types Undo scan array to scan scan types First scan read only Select Process X{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18\b First scan\b0\line The "First Scan" is the first thing you do when you are scanning the memory. "First Scan" initializes the data structures inside cheat engine and reads the complete memory of the selected game. If you already know the value it will scan the memory while it's reading, and take less memory.\line\line\b Next scan\b0\line The next scan processes the results of the previous scan. If you did a first scan before with a "Advanced" scantype, it wont have any results, but cheat engine does contain the memory of the game as it was when you did the scan the previous time. That way you can do a scan for a changed,unchanged value etc...\line If you did get results from a previous scan the next scan will look at those results, and compare them to the scantype you selected, and remove those addresses that dont pass the test, making the list smaller and smaller till there are only a few or even 1 address left.\line\line\b Undo scan\b0\line If you made a error while scanning, like searching for a increased value, while you had to search for a decreased value, you can click "Undo Scan" an"srtkd Cheat Engine will restore the results back to the previous scan, allowing you to try again, instead of completly starting over.\line\line\b New scan\b0\line The new scan whipes out all your results, and frees the memory, allowing you to start a new scan.\line\line\b Scan types\cf4\ul{\field{\*\fldinst HYPERLINK !}{\fldrslt }}\cf3\b0\ul0\line In the scantype combobox you can select what type of scanning will be done.\line\line\b Value types\cf4\ul{\field{\*\fldinst HYPERLINK !}{\fldrslt }}\cf3\b0\ul0\line In the value types combobox you can select what type of address you are looking for.\line Normaly a value is 4-bytes in windows, but sometimes it is different, or you are looking for something else, in that case choose another value type.\line\line\b array to scan\b0\line Programs reside in the memory, and store their addresses in various locations. With the Array to scan option you can increase/decrease the number of locations that Cheat Engine will look at for the address you need. This can dramatically increase your scanning speed, and improve the results, when used wisely.\line\line\i If you're playing dosgames in windows ME or earlier choose the 16-bit memory array. If you're targeting a dos game in NT, 2000, XP , Vista or later, target ntvdm.exe and set as range 0 to 7fffffff \i0\line\line\b readonly\b0\line The readonly checkbox tells Cheat Engine, if you want to scan read-only memory or not. Normaly games do not store important game information in read-only memory, but sometimes you may feel a need to scan that memory anyhow. (e.g. If you want to change some text in the game etc...)\line\line\b fastscan\b0\line The fastscan checkbox tells CE to skip addresses that arn't located on a alligned. (Address devidable by 2 or 4 depending on the type)\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Standard scan settings\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Select ProcessSelectProcessSelectProcessHelpMacro=4 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13"Select Process {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The select window process can be accessed by clicking on the computer icon on the top left side of the main window.\line\line This window holds a list of all the processes currently running.\line Double click on a entry and cheat engine will open this \cf4\ul{\field{\*\fldinst HYPERLINK Process}{\fldrslt process }}\cf3\ul0 for scanning.\line\line If you click on the window button at the bottom you'll get to see all the windows, and the processes that own them, so if you dont know the process name you can use the window to find the process.\line\line The process window also has the ability to attach the debugger the a running process, or to create a new process. The option to attach to a running process is usefull if you don't want a delay when you want to use the debugger, and he option to create a process is usefull when you're using windows 98 or ealier which doesn't have the ability to attach to a running process.\line\line If you have enabled the option to use the processwatcher in settings->extra you will have a 3th button at the bottom saying "Process watcher". Clicking that will open the process watcher window. It'll show you which processes have been created since the start of CE\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Select Process\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1ProcessProcessProcessHelpMacro=5 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13results {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbk"tsulpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 A process is a program or game running in windows.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f1\fs24\par} N1Found listFoundlistFoundlistHelpMacro=6 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Presults Found list max value types {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The found list is the list on the left side of the window, under the Select Process \cf4\ul{\field{\*\fldinst HYPERLINK !process}{\fldrslt process }}\cf3\ul0 button.\line\line When you do a search and the number of addresses your scan found is smaller or equal to the max number of addresses to show(You can change that in the setting window\cf4\ul{\field{\*\fldinst HYPERLINK !process}{\fldrslt process }}\cf3\ul0 ), then this list will be filled with the addresses you've found.\line\line If you double click an address, drag it to the list at the bottom, or select some addresses and click the red arrow, the addresses will be added to the memory watch list at the bottom\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Found list\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Value typesValuetypesValuetypesHelpMacro=7 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13value types f{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18\b Binary\b0\line The binary scan is a slow but powerfull scan.\line It will scan between bytes for a value\line Also, if you want to search for a array of bits that possible too, it even allows wildcard(?,*) instead of the normal 1's and 0's. This allows you to do a search like 1101?001, which will give the results of all addresses+bit that have either 11010001 or 11011001. (More wildcards in a string are allowed)\line\line The range of a bitscan can be as long as you like. (as long as it fits in the memory)\line\line If you're wondering if this is usefull: \line Lets say a program stores the following values as follow:\line 100=1001100100110110\line 200=1011001000101001\line 300=1100101100110110\line\line also note that in normal binary notation the following values are:\line 100=1100100\line 200=11001000\line 300=100101100\line\line now, if you look at the above example you'll notice that the binary value of 100 does apear in the binary that represents 100, but has a 1 as last bit, and the first few bits are random (read from right to left) , same for 200 and 300, with the binary scan you can scan for the binary representation of the values 100-200 or 300.\line\line\b Byte\b0 (8-bits)\line A byte is a value that can hold a number between 0 and 255 or -128 to 127. (The last one if it is a \cf4\ul{\field{\*\fldinst HYPERLINK Signedvalue}{\fldrslt signed value }}\cf3\ul0 )\line 1-byte values aren't used much except for 8-bit emulators, etc... Even though a 1-byte scan seems useless, it will normaly find the value when you dont know for sure wheter the value is either 1-byte, 2-bytes, 4-bytes, or 8-bytes, that is because all those types are build from this base type.\line\line Of course, the number of initial addresses you'll find doing a 1 byte scan is very big, and it will take a while to find the address you're looking for, but at least the change of finding it is higher.\line\line\b 2 bytes\b0 (16-bits)\line a "2 Byte" value can hold a number between 0 and 65536 or -32768 to 32767 (The last one if it is a \cf4\ul{\field{\*\fldinst HYPERLINK Signedvalue}{\fldrslt signed v"utvmalue }}\cf3\ul0 )\line "2 byte" values are used in old dos games, and other 16-bit application.\line\line\line\b 4 bytes\b0 (32-bits)\line a "4 byte" value can hold a number between 0..4294967295 or -2147483648 and 2147483647 (The last one if it is a \cf4\ul{\field{\*\fldinst HYPERLINK Signedvalue}{\fldrslt signed value }}\cf3\ul0 )\line "4 byte" values are the standard way of storing information in a windows system. So doing a 4-byte scan will normaly give the best results.\line\line\b 8 bytes\b0 (64-bits)\line a "8 byte" value can hold a number between 9223372036854775808 and 9223372036854775807 (no need for unsigned values anymore)\line "8 bytes" aren't used often because they take up a lot of space, and require extra processing. (except for 64-bit processors)\line Some programs do use them though, and scanning for a "8-byte" value doesn't return many addresses, so finding the right one is easy then.\line\line If the address you're looking for is smaller than 8 bytes, the chance that the scan has skipped that address is big.\line\line\b Single\b0 (32-bits) (IEEE standard)\line a "Single" value can hold a number between 1.5 x 10^-45 and 3.4 x 10^38\tab\tab .\line\line This is one of the 2 standard floating-point value allocations. (IEEE) The other one is DOUBLE\line A Single consists of 4 bytes, which is build up in a special way, which is VERY different from normal variables! (so normal byte scanning wont work)\line\line Cheat Engine rounds values up/down till the number of digits you specify in the scan value box.\line e.g.:if you scan for 12 it will find all values between 11.5 and 12.4 and 12.0 results in values between 11.95 and 12.04\line\line\b double\b0 (64-bits) (IEEE standard)\line See Single, and the range is between 5.0 x 10^-324 and 1.7 x 10^308\tab\tab\line\line\line\b Text\b0\line The "Text" scanvalue can be used to scan the memory of a game for text. E.g: if you know that 12 bytes after your name as a variable you need you can use that to recalculate the addresses each time a game restarts.\line\line\b array of byte\b0\line Same as text, but uses a array of byte instead of characters, and supports wildcards.\line input:\line xx xx xx xx ...\line xx ?? xx xx\line xx ** xx xx\line\line a array of byte scan can be usefull when you know that prior to the address you need is always a specific occurance of bytes. (like: 66 66 66 10 10, and 4 bytes after that is your health which is stored as 1 byte. Scanning for 1 byte will take a lot longer than scanning for this string of bytes. Scanning for this string will propably only result 1 address, where as scanning for 1 byte will return thousands of addresses the first time)\line\line\b All\b0\line A combination of byte, 2 bytes, 4 bytes, 8 bytes, single and double\line\line\b Custom\b0\line Lets you assign an auto assembler script where you can fill in how the compare wioth an address should be done and what would result in a positive or negative result\line To delete a custom scanscript selexct it and when it's still focuseed press delete\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Value types\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Signed valueSignedvalueSignedvalueHelpMacro=8 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Smaller than r{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Signed:\line A value can hold a negative value if it is a signed value.\line This is done by inverting all the bits. (all 0's become 1's and 1's become 0's) and increasing the resulting value by 1\line\line example:\line 12=\tab\tab\tab\tab 00001100\line invert=\tab\tab 11110011\line -12=\tab\tab\tab\tab 11110100 (notice that if this was a unsigned value this would be 244)\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f1\fs24\par} N1Scan typesScantypesScantypesHelpMacro=9 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Smaller than Exact Decreased by Decreased Increased Increased by Unchanged Changed Bigger than scan types Address list {\rtf1\ansi\deflang103"vuwn3\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Unknown initial values: ("First scan" only)\line This scantype makes a copy of the game in memory, so it can be used later on. (Like comparing it with the current memory and see if it has changed or not)\line\line Exact:\line The "exact" scan will scan the memory for the value(or string) you've entered\line\line Bigger than\line The "Bigger than" scantype scans for all the values that are higher than the value you've entered\line\line Smaller than\line The "Smaller than" scantype scans for all the values that are smaller than the value you've entered\line\line The following scantypes are available only when doing a "next scan"\line Increased\line If the value of a address has increased it will be added to the list.\line\line Increased by...\line If the value of a address has increased with the specified ammount it will be added to the list.\line\line Decreased\line If the value of a address has decreased it will be added to the list.\line\line Decreased by...\line If the value of a address has decreased with the specified ammount it will be added to the list.\line\line Changed\line This scantype will check if the value of an address has changed or not. If it has changed it'll be added to the list\line\line Unchanged\line This scantype will check if the value of an address has changed or not . If it has not it'll be added to the list\line\line Same as first scan\line This scantype will check if the value of an address is the same as when it was when you did first scan. If it is, it'll be added to the list.\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Scan types\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Address listAddresslistAddresslistHelpMacro=10 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:132Address list comments ] {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;\red0\green0\blue255 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The address list is the place where all the addresses will go that you think are usable.\line\line The list can be navigated by using they keyboard and mouse.\line There are 2 ways to change a value in the list, by either double-clicking the value, or by selecting it and pressing enter.\line For all the other items in the list just double click on it and it will open up a new window allowing you to change it.\line\line The checkboxes allow you to freeze and unfreeze the address. If you freeze a address the address will not change untill you unfreeze it. The value does change but Cheat Engine will restore the value to it's frozen state every few milliseconds(The number of milliseconds can be changed in the settings window\cf4\ul{\field{\*\fldinst HYPERLINK !signedvalue}{\fldrslt signed value }}\cf3\ul0 ) \line\line There are 3 types of freezing: Normal (=),Allow Positive (+), and Allow Negative (-). You can change the type of freezing by clicking on the symbol right of the checkbox. The allow positive and negative can be set also by keyboard's numeric + and - keys.\line\line Also, when you right-click on one or more addresses a popup window will show with additional options.\line\line\line The following keys can be used when the address list has focus:\line ENTER:\tab\tab\tab\tab Change value\line Ctrl+Enter:\tab\tab Change destription\line Alt+Enter:\tab\tab Change Address\line Space:\tab\tab\tab\tab Freeze\line +\tab\tab\tab\tab\tab\tab Positive freeze\line -\tab\tab\tab\tab\tab\tab Negative freeze\line Delete:\tab\tab\tab\tab Delete Address\line Ctrl+S:\tab\tab\tab\tab Switch the position of 2 selected addresses\line Ctrl+E:\tab\tab\tab\tab Edit the selected address\line Ctrl+Alt+A:\tab\tab Open the auto assembler\line Ctrl+Alt+Grey Plus:\tab\tab Move down one position\line Ctrl+Alt+Grey Minus:\tab\tab Move up one position\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Address list\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1CommentsCommentsCommentsHelpMacro=11 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateM"wvxoodified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Dcomments comments Memory view {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The questionmark on the bottom right of the cheat engine window opens the Comments window.\line The comments window can be used to store extra information in your cheat tables. You can for example use it to leave notes on how you found a address, or other stuff, like your name.\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Comments\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Memory viewMemoryviewMemoryviewHelpMacro=12 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Memory view inject codecave thread debugger assembler dll About the debugger {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The memory view can be reached by clicking on the memory view in the main cheat engine window.\line\line The memory view contains several tools and functions for advanced game hackers like the autoassembler, a codecave scanner, a thread generator, a memory allocator, a code dissector, a dll injector, debugger options, a disassembler, a assembler, a hex viewer and more.\line\line To change assembler code just stand on the address you want to edit and type in your now code.\line To edit the value of some bytes directly in memory just click on a byte and start typing in the new values.\line\line There are also some hotkeys, like CTRL+G to jump which will popup a box where you can fill in the new address you want to go to and ctrl+f in the hex view to do a simple scan\line If you have a jmp or call selected you can press SPACE to follow that address. BACKSPACE and SHIFT+SPACE will go back\line CTRL+SPACE will set either the memory browser to the current disassembled location, or the disassembled location to that of the memory browser\line\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Memory view\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1$About the debugger Aboutthedebugger AboutthedebuggerHelpMacro=13 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13LAbout the debugger Settings Window 9{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 You will sometimes read about the debugger of cheat engine, this is a thread tha"xwypt has access to the opened process, and handles all debugging events, like creating threads, handling exeptions, etc...\line a thread is a part of the program that runs seperatly from the rest of the program, but still has access to the memory of the main program\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b About the debugger\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Settings WindowSettingsWindowSettingsWindowHelpMacro=14 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13HSettings Window Network versions S{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The settings window allows you to change several aspects of Cheat Engine ranging from how it looks to how it scans.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Settings Window\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1 Network versionsNetworkversionsHelpMacro=15 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13:Network versions designer {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Older versions of cheat engine come with a seperate Client and Server version\line\line There are a few games that give no possibility to switch between programs. (It either closes, crashes, or takes down your whole pc when you switch to something else)\line In those cases the Network versions of Cheat Engine come in handy.(Assuming you have 2 computers or a friend over internet willing to help)\line\line Load the server program on the computer that will run the game and start the server.\line Then run the game on that computer and start the client part of Cheat Engine on another computer.\line Make a connection with the client to the computer that runs the server. When a connection is established the Cheat Engine userinterface will show up on the client side. With that you can open the process of the game on the server and scan the memory as if you're local.\line\line To get them, download Cheat engine 5.3 or earlier\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b Network versions\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N1TrainerTrainerTrainerHelpMacro=16 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13"yxzq sBookPage=13/09/2008 03:13>designer Trainer sleeptime {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 To create a trainer click on the advanced button and then click on the create trainer button (the one with the save file icon) or save your table with a .exe extention to get to the same screen.\line In this screen you can choose to open a already existing trainer, or to create a new one. \line\line File patcher: This will allow you to create a trainer that will scan through your files and take out code.\line\line Memory trainer:\line With the memory trainer you can create cheats by adding cheats to the list and assigning hotkeys to them.\line Also got other features like pop-up on keypress, etc...\line\line Designer:\line If the default userinterface of the trainer doesn't look good you can always try to make your own by using the option to design your own.\line If activated it opens a window in which you can place controls like images, and buttons.\line\line keys for the designer: (when a object is selected)\line\line arrow keys:\tab\tab move the object 1 pixel in that direction\line shift+arrow keys:\tab\tab resize the object 1 pixel in that direction\line delete:\tab\tab\tab\tab delete the selected object\line ctrl+n:\tab\tab\tab\tab go to next object\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Trainer\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1SpeedhackSpeedhackSpeedhackHelpMacro=17 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Jsleeptime speed Speedhack ALLOC Z{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 The speedhack of cheat engine replaces some commonly used funtions in games to keep the speed constant with it's own routine that goes faster or slower.\line\line There are 2 values you can fill in, speed and sleeptime.\line Speed allows you to specify the speed you want the game to run at. (0.5=Half speed, 2=Double speed)\line\line The sleeptime handles how accurate the speed is emulated. A higher sleeptime gives a more accurate speed, but if you make it too high, the game may become choppy. This is due to the way the speedhack works. Every few milliseconds it updates the time. And the time it waits between the updates is the sleeptime. As you can imagine, waiting a long time before uopdating the current time will result in weird/choppy behaviour, but having no wait will eat up the whole cpu leaving no time for the game, making it extremely slow.\line\cf2\fs24\par\pard\s0\ql\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\tx360\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Speedhack\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Auto AssembleAutoAssembleAutoAssembleHelpMacro=18 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13rALLOC Auto Assemble LABEL FULLACCESS Script engine {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn"zy{r1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Auto assemble allows you to write assembler code at different locations using a script. It can be found in the memoryview part of cheat engine under extra.\line\line There are 3 special commands you can give it, ALLOC , LABEL and FULLACCESS. With LABEL you can give a address a name by declaring it before you use it. ALLOC is basicly the same as LABEL but allocates some memory for you.\line Usage: \line LABEL(labelname) //Enables the word labelname to be used as a address\line ALLOC(allocname,sizeinbytes) //same as label, but allocates the memory it points to itself\line DEALLOC(allocname) //Deallocates a block of memory allocated with alloc. It always gets executed last, no matter where it is positioned in the code, and only actually frees the memory when all allocations have been freed. only usable in a script designed as cheattable. (e.g used for the disable cheat)\line FULLACCESS(address,size) //makes a memory region at the specified address and at least "size" bytes readable, writable and executable\line\line REGISTERSYMBOL(symboname) //adds the symbol to the userdefined symbol list so cheattables and the memory browser can use that name instead of a address (The symbol has to be declared in the script when using it)\line UNREGISTERSYMBOL(symbolname) //removes the symbol from the userdefined symbol list. It won't give a error if it isn't found\line\line DEFINE(name,whatever) //Will replace all tokens with the specified name with the text of whatever\line INCLUDE(filename) //includes another auto assembler file at that spot\line LOADBINARY(address,filename) //will load a binary file at the specified address\line CREATETHREAD(address) //Will spawn a thread in the process at the specified address\line LOADLIBRARY(filename) //Will inject the specified dll into the target process\line READMEM(address,size) //Will write the addresses at address at the location this instruction is placed\line\line\b Basic Example\b0 :\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line\line 00410000:\line mov [00580120],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp 00451031\line\line\b Example using LABEL\b0 :\line label(mylabel)\line\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line mylabel:\line\line 00410000:\line mov [00580120],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp mylabel\line\line\b Example using ALLOC\b0 :\line alloc(memloc1,4)\line\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line\line 00410000:\line mov [alloc1],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp 00451031\line\line\b Example using ALLOC and LABEL\b0\line alloc(alloc1,4)\line label(mylabel)\line\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line mylabel:\line\line 00410000:\line mov [alloc1],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp mylabel\line\line\line\b Example using FULLACCESS\b0\line FULLACCESS(00400800,4) //00400800 is usually read only non executable data, this makes it writable and executable\line 00451029:\line jmp 00410000\line nop\line nop\line nop\line\line 00410000:\line mov [00400800],esi\line mov [esi+80],ebx\line xor eax,eax\line jmp 00451031\line\line\b Example using DEFINE\b0\line DEFINE(clear_eax,xor eax,eax)\line 00400500:\line clear_eax\line\line\b ReadMem example\b0\line alloc(x,16)\line alloc(script,2048)\line\line script:\line mov eax,[x]\line mov edx,[x+c]\line ret\line\line x:\line readmem(00410000,16) //place the contents of address 00410000 at the address of X\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Auto Assemble\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1Script engineScriptengineHelpMacro=19 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13:Script engine Other stuff {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Cheat engine also has a script engine in which you can execute simple c-scripts.\line You can run thos c-scripts inside CE, but you can also inject them into the target process and let it execute there. The scripts have access to the real memory.\line Also, when running in the contectx of Cheat Engine using the normal execute button the script engine provides you with several extra commands that are not available when using the injected form.\line They are:\line\line\b void ce_showmessage(char* message);\b0\line Will popup a messagebox with the specified message\line Usefull for showing the result of an operation.\line e.g:\line char result[100];\line int x=123;\line x=x+6;\line sprintf(result,"123+6 = %d",x);\line ce_showmessage(result);\line\line\b int ce_ChangeRegistersAtAddress(unsigned long addresstonbreakat, void *changeregstructure);\b0\line This will use ce's "Change register at address" feature.\line addresstonbreakat is the address to place the break at and changeregstructure is a pointer to the changereg structure.\line\line Look at the plugin-system help or the changeregtest.CEC example provided for the structure.\line\line\b int ce_AutoAssemble(char *script);\b0\line Will autoassemble the script provided in script.\line will return 0 if failure\line\line\b int ce_Assembler(unsigned int address, char *instruction, unsigned char *outputbuffer, int maxbuffersize, int *numberofbytes);\b0\line Will assemble one specific instruction and return the bytes to a structure you've allocated\line\line\line\b int ce_Disassembler(unsigned int address, char *outputstring, int maxsizeofstring);\b0\line Will disassemble a specific address of the currently selected process and fill it in outputstring.\line\line\b int ce_InjectDLL(char *pathtodll, char *optionalfunction);\b0\line Will inject a dll and calls a function of that dll (No parameters) Optionalfunction can be 0\line\line\b unsigned int ce_GetAddressFromPointer(unsigned int baseaddress, int offsetcount, unsigned int *offsetlist);\b0\line Will convert "{z|san address with offsets to the final address.\line offsetcount is the number of offsets in the list (offsetlist)\line\line\b int ce_GetSelectedProcessHandle(void);\b0\line Will return the current processhandle;\line\line\b int ce_ReadProcessMemory(unsigned int processhandle, void *baseaddress, void *buffer, unsigned long bytestoread, void *numberofbytesread);\b0\line Will use the current ReadProcessMemory currently used by Cheat Engine\line\line\b int ce_WriteProcessMemory(unsigned int processhandle, void *baseaddress, void *buffer, unsigned long bytestowrite, void *numberofbyteswritten);\b0\line Will use the current WriteProcessMemory currently used by Cheat Engine.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b Script engine\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N1Other stuffOtherstuffOtherstuffHelpMacro=20 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:132Other stuff Tutorials m{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Cheat Engine is filled with other features, try to find them and find out what they do, or send questions about them to dark_byte@hotmail.com\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Other stuff\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1TutorialsTutorialsTutorialsHelpMacro=21 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13LTutorials Anti tab protected games H{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 This section contains a collection of all usefull tutorials originally posted on the cheat engine forum.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Tutorials\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N10Anti tab protected games*AntitabprotectedgamesHelpMacro=22 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13vAnti tab protected games protected anti tab valuetype x {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1"|{}t\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by Emperor:\line\line Hope it's usefull ...after all i did much research on it. This guide written by me explains how to use CE for anti tab protected games. \line First you may wonder : \line\b What does anti tab protected mean? \b0\line It means if you minimize it, it will never come up again, it will kill itself. This happens if you use any kind of task switching or click on any other program. \line\b What can be done about it? \b0\line Possiblity 1: \line There is a program AAT that freezes the game and then brings your cheat-tool (of course we all use CE don't we?) to the front. Once a scan is done you can press another button to switch back to the game and resume it. Because it was frozen during that time it didn't notice it was not in the foreground. Altough being frozen CE can still attach itself to the game (although it may require you to switch to the game unfreeze it and then freeze again in order to make it work). With AAT however there's always the risc the game will crash anywaays or AAT will stop responding making it impossible to unfreeze the game. \line Possbility 2: \line Xunleashed. With it you can run directx programs in a normal window. \line Xunleashed has not been tried by me as it costs 20$ (after all i can still use AAT and CE network version). It should work, if you are unsure weather it works with your game or not look at the message board. \line Possiblity 3 \line Use the CE network version. This of course requires 2 computers and you to switch between them. Also the functions in the network version are limited, but new features are being added. \line\b What do game creators do against those? \b0\line -Game guard. : The 4.4 Version of CE can cheat Anti Tab protected games. Therefore you can safely use the network version. AAT will not work with nProtected games but if you execute the game as a normal user and AAT as an administrator it will still work.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b Anti tab protected games\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N1DWhat is the difference in bytetype:Whatisthedifferenceinbytetype:WhatisthedifferenceinbytetypeHelpMacro=23 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13valuetype What is the difference in bytetype 3D pinball for windows (pointer+code) {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by emperor:\line\line 2 Byte means: 00 00 to FF FF this allows only up to 65535, obviously. \line 4 byte maens: 00 00 00 00 to FF FF FF FF (allows up to 4294967295). \line Now for example you can miss 2 byte values with 4 byte scans: \line example: value in game is 300 stored in game's memory as 012C \line If you search for 12C as 2 Byte it will be in your results. \line If you search for 12C as 4 byte the 2 Bytes before the 012C matter as well. \line For example the 012C would be after an FF FF. \line Meaning: FF FF 01 2C is in the memory 01 2C being what you are searching for. However seen as 4 Byte this is not 01 2C (300) but it's FF FF 01 2 C (4294902060) . \line To my mind for exact value scans you should use the smallest appopirate byte type (for ex if it doesn't rise over 65000 use 2 byte). However since most games multiply it with a certain factor exact value scans are hardly any useful...when doing an unknown value scan it's up to you to chose the correct bytesize...most commonly used is 4 byte after all. It's nothing new to me seeing games showing a stat up to like 2000-3000 as 4 Byte in a huge number over serveral hundret thousands..however how much a certain game multiplies,adds or substracts, or tries to hide it depends on the game, is therefore sort of unknown therefore i think in many cases the bytesize is also sort of unknown although 4 Byte is always likely. Note doing increase/decrease value scans wouldn't fail even if there were some other bytes before it: for ex \line FF FF 01 2C is increased by one... \line ---> FF FF 01 2D increased would still be okay as unknown initial. \line But if the FF FF also changes \line to like FE FE then it would screw up the scan.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b What is the difference in bytetype\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1J3D pinball for windows (pointer+code)<3Dpinballforwindo"}|~uwspointercodeHelpMacro=24 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:133D pinball for windows (pointer+code) pinball code pointers directx {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by me. (no not me, but the user called me)\line\line this is to try answer the most common questions from people new to cheat engine \line\line using 3d pinball for windows space cadet as an example,,, \line it might be an idea to print this and other tuts so its easier to work through them,,, \line\line ( this game gives you some free balls so be on the look out for that during this tut ) \line\line start 3D PINBALL FOR WINDOWS ,, and wait for the first ball to deploy \line start cheat engine \line click on the flashing icon in the top left of cheat engine \line in the bottom of process list window \line double click on PINBALL.EXE to attache the game to cheat engine \line in the value box type in 3 \line go into the pinball game and lose a ball \line wait for the next ball to be deployed \line go back into cheat engine \line type 2 into the value box \line click on the next scan button \line I got the address A9FEE6 yours may be different \line\line ok \line\line I'll double click on the found address A9FEE6 to add it to the bottom pane \line click on the checkbox to freeze this address \line go back into the PINBALL GAME \line lose some balls to see if its the right address \line if you have got it right you'll have infinite balls \line\line ------------------------------------------------------------------------------- \line now to find the code that changes the number of balls \line ------------------------------------------------------------------------------- \line\line go back into cheat engine \line (if you want you can double click on the value part of the address in the bottom pane and change it back to 3 or 4 balls) \line In the bottom pane again right click on the address A9FEE6 and choose \line FIND OUT WHAT WRITES TO THIS ADDRESS \line\line you will then get the debugger window \line go back into pinball and lose another ball \line in the debugger window you should see the address of the code that changes the number of balls \line\line I got 01015f02 - 89 86 46 01 00 00 - mov [esi+00000146],eax \line click on this to highlight the code,, and click on the ADD TO CODELIST button \line a box called CHEAT ENGINE CODE will pop up \line name balls \line and hit the OK button \line\line a window called ADVANCED OPTIONS WILL pop up with balls in it \line you can right click it and choose REPLACE WITH CODE THAT DOES NOTHING \line to show that the code has been nopped out the name will turn red \line you can hit the ok button to close the advanced options window then the stop and close button to exit the debugger \line then save your table,,,, but for now \line just hit the ok button to close the advanced options window \line\line in the debugger window look at the code 01015f02 - 89 86 46 01 00 00 - mov [esi+00000146],eax \line now with the code highlighted click on the MORE INFORMATION button \line the EXTRA INFO box will pop up \line in this box under copy memory you will see the sentance \line\line THE VALUE OF THE POINTER NEEDED TO FIND THIS ADDRESS IS PROBABLY 00A9FDA0 \line\line this is the address held in the ESI register below this you can see all the values that the registers held at the instant you lost a ball,, \line as you can see ESI=00A9FDA0 \line and highlighted in red you can see \line\line 01015F02 - mov [ esi + 00000146 ],eax \line\line this is all in hexadecimal \line so the ESI register holds 00A9FDA0 therefore \line [esi + 00000146] = [ 00A9FDA0 + 00000146 ] \line 00A9FDA0 + 146 = 00A9EEF6 \line\line the first address I found when I started scanning at the start of the game \line\line so note down the address 00A9FDA0 \line and the offset 146 \line\line close the EXTRA INFO window \line in the main cheat engine window ,,,hit the new scan button \line next to the value box theres a hex checkbox ,, check it so you can enter a hex value \line put in our address without the zeros in front of it A9FDAO \line and hit the first scan button \line\line you will get a couple of hundred results \line i'll try the first address on the list 009A4356 \line\line click on the add address manually button \line click on the poiter checkbox and you will see the ADD ADDRESS window change \line\line where it says ADDRESS OF POINTER type in our address 9A4356 \line and in the OFFSET [HEX] box type in 146 ,,,,,,,,, remember [esi + 00000146] \line and hit the ok button \line\line hopefully a new address with should look like this in the bottom pane \line No description P->00A9FEE6 4 bytes 0x00000003 \line or how ever many balls you got left \line you can freeze the number of balls from this pointer now,,,,, \line in games that use Dynamic Memory Allocation ,,, DMA \line and use the same code to change things for you and the enemies,, \line pointers are usfull \line\line ------------------------------------ \line ok a couple of things \line\line 1) this game don't use dma ,, but its an easy game to practice on \line 2) Its free and most people have it \line 3) so for newcomers it gives an idea of how to use the basic search / pointer / and advanced options \line\line well as they say thats my two cents \line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b 3D pinball for windows (pointer+code)\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N12Direct x-mess +anti-debug,Directx-messanti-debugHelpMacro=25 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/20"~}v08 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13directx Direct x-mess +anti-debug debugger Find out what addresses are accessed by a piece of code {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originaly posted by Dark Byte\line If you want to use the directx-mess functions in a game but the game detects the debugger (or crashes because of it) then before clicking on OK to run the game select another process, or simpley close Cheat Engine.\line This will detach the debugger from Cheat Engine.\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b Direct x-mess +anti-debug\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N1nFind out what addresses are accessed by a piece of codeZFindoutwhataddressesareaccessedbyapieceofcodeHelpMacro=26 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Find out what addresses are accessed by a piece of code code assembler z{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by Dark Byte\line\line Sometimes when you've found a address and the code to change that address is also used to change other addresses (like that of the enemy) the following function will be usefull: \line\line When you've found the code that accesses the address you've found you can save that and use it to find the address you are looking for, so you don't have to go through the slow scanning routine again. (unless of course scanning for it is a lot faster than this, like finding a piece of text and then recalculating the rest) \line\line Go to the advanced window, rightclick the code and choose "Find out what addresses this code writes to" (or reads from depending on what kind of code it is, and can sometimes be a write instead of a read but that doesn't matter) and play the game. after a while the list will be filled up with all the addresses that that code used. (enemy's energy including if it is also used to handle the enemy) \line\line Only downside is that this (currently) only works for instructions that have a [...] part. So instructions like "rep movsb" won't work, but that is a instruction thats useless to cheating anyhow)\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b Find out what addresses are accessed by a piece of code\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N1Basic assemblerBasicassemblerBasicassemblerHelpMacro=27 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Xassembler Basic assembler Auto Assemble +{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by Dark Byte + addition by Smidge204\line\line Most people think assembler is very difficult, but in fact it's"~w very easy. \line In this tutorial i'll try to explain how some basic assembler works \line\line The processor works with memory and registers. The registers are like memory but a lot faster than memory. Registers are EAX,EBX,ECX,EDX,ESP,EBP,ESI,EDI, and the segment registers. (There's also EIP, wich is the Instruction Pointer. It points to the instruction that is about to be executed) \line\line Some examples: \line\line\ul sub ebx,eax\ul0 (ebx=00000005,eax=00000002) \line Lets take it apart in it's most basic elements: \line opcode param1,param2 \line\line The opcode is the instruction telling the processor what to do, in this case decrease the value stored in register ebx with the value stored in register eax. \line\line In this case ebx=5 and eax=2 so ebx would be after this instruction 3. (5-3) \line\line Also note that whever you see a opcode with 2 parameters: The first parameter is the target of the instruction. The 2nd is the source \line\line\ul sub [esi+13],ebx\ul0 (ebx=00000003,esi=008AB100) \line In this case you see the first parameter is between brackets. This indicates that instead of registers a memorylocation is being used. \line The memorylocation is pointed at by whats in between the brackets, in this case esi+13 (Note that the 13 is in hexadecimal) \line\line ESI=008AB100 so the address pointed at is 008AB113. \line This instruction would decrease the value stored at location 008AB113 with the value stored in ebx(wich is 3). \line\line If the value at location 008AB113 was 100 then the value stored at 008AB113 after this instruction would be 97. \line\line\ul sub [esi+13],63\ul0 (esi=008AB100) \line This is almost the same as above but instead of using a register it uses a direct value. \line\line Note that 63 is actually 99 because the instruction is always written using hexadecimal. \line\line Lets say the value at 008ab113 is 100 (wich is 64 in hexadecimal) then the value at 008ab113 after execution would be 1 (100-99) \line\line\ul sub ebx,[esi+13]\ul0 (ebx=00000064 esi=008ab100) \line This instruction decreases the value stored in ebx with the value stored at location 008ab113. (esi+13=008ab100+13=008ab113, in case you forgot) \line\line\line Up until now i've only used SUB as instruction, but there are lots and lots of other instructions the procesor knows. \line\line Lets take a look at MOV, one of the most often used instructions \line although it's name sugests that it moves data, it just COPYs data from one spot to another. \line\line MOV works exactly the same as sub. first parameter is the destination, and second parameter is the source. \line\line examples: \line\ul MOV eax,ebx\ul0 eax=5,ebx=12 \line Copies the value stored in ebx into eax \line\line So, if this instruction would be executed eax would be 12. (and ebx would stay 12) \line\line\ul MOV [edi+16],eax\ul0 eax=00000064, edi=008cd200) \line This instruction will place the value of eax(64hex=100 decimal) at the location of edi+16 (008cd200+16=008cd216). \line So after instruction the value stored at 008cd216 will be 100 (64 hex) \line\line As you see, it works just like the SUB instruction. \line\line Then there are also those instructions that only have 1 parameter like inc and dec. \line example: \line inc eax :increase the value at eax with 1 \line dec ecx: decrease the value of ecx with 1 \line dec [ebp]: Decrease the value stored at the address pointed to by ebp with 1. \line\line Right now i've only shown the 32-bit registers (eax, ebx ecx....) but there are also 16-bit register and 8-bit registers that can be used. \line the 16 bit registers are: AX,BX,CX,DX,SP,BP,SI,DI \line the 8 bit register are: AH,AL,BH,BL,CH,CL,DH,DL \line\line Note that when changing ah or al you'll also change AX, and if you change AX you'll also change EAX, same goes for bl+bh+bx+ebx,ch+cl+cx+ecx,dh+dl+dx+edx \line\line You can use them almost the same with the instructions for 32 bit but they will only change 1 (8 bit) or 2(16-bit) bytes, instead of 4 (32-bit) bytes. \line\line example: \line dec al :decreases the 8 bit register al \line sub [esi+12],al :decreases the 1-byte value stored at the location esi+12 points at with the value of al \line mov al,[esi+13]:places the 1-byte value stored at the location esi+13 points in the al register. \line\line Note that it is IMPOSSIBLE to use a 16 or 8 bit register for instructions that point to an address. eg: mov [al+12],0 will NOT work. \line\line There are also 64 and 128 bit registers, but I wont discuss them since they are hardly ever used, and cant be used with the other instructions that also work with 32 bit) \line\line\line Then there are the JUMPS, LOOPS, and CALLS: \line JMP: \line The JMP instruction is the easiest it changes the Instruction Pointer (EIP) to the location the JMP instruction points at and continues from there. \line\line There are also conditional jumps that will only change the instruction pointer if a special condition has met. (for example set using the compare instruncion (CMP)) \line\line JA=Jump if Above \line JNA=Ju,p if not above \line JB=Jump if below \line JE=Jump if equal \line JC=Jump if carry \line and LOTS of other conditional jump \line\line LOOP: \line The loop instruction also points just like the JMP to a memory location, but only jumps to that location if the ECX register is not 0. \line\line and of course, there are also special contitional loops: \line LOOPE:Loop while ecx is not 0 AND the zero flag is not set \line LOOPZ:same as LOOPE. \line LOOPNE:Loop while ECX is not 0 AND the zero flag is set. \line LOOPNZ:Same as LOOPNE \line\line I gues I should also explain what flags are, they are bits in the processor that can be used to check the condition of a previous instruction like 'cmp al,12' if al=12 then the zero flag (ZF) will be set to true, else the Zero flag(ZF) will be set to false. \line\line CALL: \line Call is the same as JMP except it uses the stack to go back. \line\line Explenation of the stack: \line The stack is a location on memory pointed at by the ESP register. \line You can put values in it using the PUSH command, and take out it using the POP command. If you use PUSH it will decrease the ESP register and place the value at the location of ESP. If you use POP it will place the value pointed at by pop into the location pointed at by the parameter of POP and increase the value of ESP. In short: The last thing you push in the stack will be the first thing you pop from the stack, the 2nd last item in will be the 2nd item out. \line\line RET: \line After CALL has pushed the location of the next instruction onto the stack it jumps to that location. (sets the instruction pointer to that location) \line\line After a while it will encounter a RET instruction, and will then jump to the location that is stored in the stack. (Call pushed the location in the stack, ret pops it out again and jumps to that location) \line\line And thats the tutorial on the basics of assembler, if you have questions about assembler and stuff just ask and I'll try to answer. \line\line Nice file to check out if you want more info: \line http://podgoretsky.com/ftp/Docs/Hardware/Processors/Intel/24547111.pdf \line\line note: It's really usefull to understand how those values between brackets work, because then you can make the most use of the pointer stuff in CE 4.1 (It will remove for most games the Dynamic Memory Allocation problem for most games, if you know how how to look at the assembler code that accesses the values you found)\line\line ------------------------------------------------------------------\line\line The "flags" are a set of bits stored in a special register. If the bit is "1" the flag is said to be set, and if it's "0" then the flag said to be "clear". Collectively, the flags tell you all about the processor's internal status and gives more information about the results of previous instructions. \line\line There are three types of flags: Status flags that tell you about the results of the last instruction, Control flags that tell you how the processor will behave, an"xd System flags that tell you about the environment your program is executing it. \line\line The flag register is 32 bits: (S=Status flag, C=Control flag, X=System flag) \line\line\line Code: \line 0 S Carry \line 1 (Reserved) \line 2 S Parity \line 3 (Reserved) \line 4 S Auxiliary Carry \line 5 (Reserved) \line 6 S Zero \line 7 S Sign \line 8 X Trap \line 9 X Interrupt Enable \line 10 C Direction \line 11 S Overflow \line 12 X I/O Privilage (bits 12&13) \line 13 X \line 14 X Nested Task \line 15 (Reserved) \line 16 X Resume \line 17 X Virtual 8086 \line 18 X Alignment Check \line 19 X Virtual Interrupt \line 20 X Virtual Interrupt Pending \line 21 X Identification \line 22 \line 23 | \line 24 | \line 25 | \line 26 |_ (Reserved) \line 27 | \line 28 | \line 29 | \line 30 | \line 31 / \line\line\line Let's go over the status flags, since those are used most often. \line\line Overflow: \line When an operation (Addition, subtraction, multiplication, etc) produces a result that is too big to fit in the register (or memory location) used, the Carry flag is set. (If not, it's cleared automatically) For example, if you're using a 16 bit register and your operation produces a value that won't fit in 16 bits, the carry flag is set. \line\line Sign: \line Set if the result is negative, cleared if positive. This is typically a mirror of MSB (most significant bit) of a value. \line\line Zero: \line Set if result is 0. \line\line Auxiliary Carry: \line Similar to Carry, but it will treat the register/memory location as 3-bits instead of 8, 16 or 32. This is used for BCD (Binary coded decimal) stuff and it generally pretty useless otherwise. \line\line Carry: \line The carry flag is set if the bit one past the lmit of the register/memory location would have been set. For example, mov al, 0xFF then add al, 1 will cause a carry because the 9th bit would have been set. Also note that the overflow and zero flags would be set and sign flag cleared, too! \line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Basic assembler\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1JCode Injection and the auto assembler@CodeInjectionandtheautoassemblerHelpMacro=28 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Auto Assemble Code Injection and the auto assembler assembler code injection Searching Tip I9{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by scribly:\line\line Lets say you've found the code that decreases your health \line Problem is that it seems to also affect the health of your opponents, and somehow you can't seem to find the basepointer. \line In those cases doing some code injection using CE's auto assembler is the easiest solution \line\line There are several ways code injection can help solve this problem. \line One method is finding another code that accesses your health, but does it only for your own health. (e.g the code that is used to display your current health) \line There inject some code that stores the address of your health to a address you can find back again (more on that later) \line Then in the code that decreases your health inject some code that checks if the address changes is the address stored by the other routine, if it is, skip the code, otherwhise, just decrease the health, or even create a instant kill cheat by decreasing the health of opponents by a really big value. \line\line Now for the auto assemble script part: \line lets say that at 00405000 is the code that reads your health: mov eax,[esi+ecx*4] \line and at 00421000 is the code that decreases the health of enemies: mov [esi+ecx*4],edx \line\line First allocate some memory to place your code in, and to allocate space for variables, use alloc(name,size) for that. \line Alloc allocates a region of memory with read,write and execute access. (be aware, this wont work in windows me, 98 or 95 so please upgrade if you are using those ancient os's) \line So: \line Code: \line\line alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024 bytes \line alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management \line alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have to be 8 bytes) \line \line\line\line\line Now, write your injecthealthreader routine to store the address, and place a jump to your original code as well. dont forget that when placing a jump to your code cave keep in mind that if the instruction was larger than a jump to nop the remaining bytes, and in case of the jump being bigger than the instruction also save the other instruction, AND nop incomplete bytes. Jumps are 5 bytes. \line So in the case of "mov eax,[esi+ecx*4]" the bytecode is 8b 04 8e (3 bytes) so you'll also need to save the instruction after it. Let's say it's followed by a "mov ecx,[esi+edx*4+4]" , bytecode=8b 4c 8e 04 (4 bytes), so now we have 7 bytes to place our jump, thats more than enough. So we'll have to place 2 nops after the jump (7-5=2) \line\line\line Code: \line\line 00405000: \line jmp InjectHealthAddress //jump to the codecave \line nop //nops for the lost space \line nop \line returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down 00405007 when jumping back, just to make it easy....) \line\line\line injectHealthReader: \line push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save and restore registers \line lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax \l"yine mov [playerhealthaddress],eax \line pop eax //restore the register, again, not needed here, but good habbit to do \line\line originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed here \line mov eax,[esi+ecx*4] //read health \line mov ecx,[esi+edx*4+4] //read something else, my gues, armor \line\line jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash... \line \line\line\line As you see to specify a exact address just type it in ended with a ':' . Everything you type in after that will get assembled on and after that address (the jump and nops in this case, and the definition of the returnHealthReader:, which is in it's own turn also a address specifier, but doesn't change the current address) \line\line This code introduces labels, they are basicly identifiers specifying a address where thay have been placed. \line you can't just use a label though, you'll first have to declare it using the label(labelname) function. I usually declare labels right after the part where I alloc memory. \line\line so, right after the alloc I have this code to get the code above working: \line Code: \line\line label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out \line label(originalhealthreadercode) //same as above \line \line\line\line now when you run the game the address of your health will get stored into the location of playerhealthaddress. \line You can already use this with cheat engine, because the auto assembler will tell you the address, but the allocation will change each time, so making a table for other people won't work, they'd have to fill in the address each time themselves. (I dont find that a problem but somehow some people do....) \line\line\line\line So, let's automate it a little further and use the knowledge of your healthaddress to make yourself invulnerable, but not your oponents. \line Just like the injection for the code that reads your health you can do the same for that that decreases health. \line And you can put it in the same script as the injection for the reader, as you saw in the alloc part where I already allocated space for the injection for the health decreaser (so you dont have to edit the address the other script allocated) \line\line so, write scriptcode that places a jump over the code that decreases your health, in this case "mov [esi+ecx*4],edx" which has bytecode 89 14 8e (3 bytes), too small, so find a instruction before or after thats also suitable, in this case there's a sub edx,eax just before this instruction, its bytecode is 29 c2 (2 bytes) so a perfect fit (5 bytes, so no need to nop), and even easier to make a code injection for (else I'd have to use a label between the 2 instructions to just skip the original line, but this sub edx,eax line is used to decrease as well, and doesn't change any of the locator addresses, and useless for the rest, so it doesn't hurt to skip it as well) \line\line so to inject your routine that checks if this is your health or not and if so, dont decrease do: \line Code: \line\line 00421000: \line jmp injectHealthWriter \line returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005 \line\line\line injectHealthWriter: \line //do a check if esi+ecx*4 matches the address stored in playerhealthaddress \line //if it matches, skip the original code, if it doesn't just execute it \line\line //save the registers we use, and before I forget, do not touch esp between saving and restoring the registers unless \line //it's to read something(like parameters), in which case you'll have to adjust the offset \line //also, dont change the registers that you use to find the address \line push eax \line push ebx \line mov eax,[playerhealthaddress] \line lea ebx,[esi+ecx*4] \line cmp eax,ebx \line\line je itstheplayer \line\line //not the player \line pop ebx //I think I could have doen this before the je, but better safe than sorry \line pop eax \line jmp originaldecreasehealthcode \line\line\line itstheplayer: \line pop ebx //restore the registers, keep in mind to restore the registers in reverse order \line pop eax \line jmp returnHealthWriter //dont execute the original code, return imeadiatly \line\line originaldecreasehealthcode: \line sub edx,eax \line mov [esi+ecx*4],edx \line jmp returnHealthWriter \line \line\line\line again, I used a few labels to make it easier for me \line but, that also means I'd have to declare them, else the assembler will complain it doesn't recognize them \line so: \line Code: \line\line label(returnHealthWriter) \line label(itstheplayer) \line label(originaldecreasehealthcode) \line \line\line\line and I prefer adding declarations at the top. \line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line\line So, the complete auto assembler script would look like: \line Code: \line\line alloc(injectHealthReader,1024) //creates a identifier called injecthealthreader that points to a block of 1024 bytes \line alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management \line alloc(playerhealthaddress,4) //this will hold the address of health, a 4 byte value (pointer, in 64 bit this'll have to be 8 bytes) \line label(returnHealthReader) //tell the assembler than returnHealthReader is a valid identifier, so dont bug out \line label(originalhealthreadercode) //same as above \line label(returnHealthWriter) \line label(itstheplayer) \line label(originaldecreasehealthcode) \line\line\line //---------------------------------------- \line // Healthreader \line //---------------------------------------- \line 00405000: \line jmp InjectHealthAddress //jump to the codecave \line nop //nops for the lost space \line nop \line returnHealthReader: //this is the label that is used to return to the address (so you dont have to write down 00405007 when jumping back, just to make it easy....) \line\line\line injectHealthReader: \line push eax //save eax, not really needed here since eax gets changed anyhow, but it's a good habbit to save and restore registers \line lea eax,[esi+ecx*4] //this instruction places the result of esi+ecx*4 into eax \line mov [playerhealthaddress],eax \line pop eax //restore the register, again, not needed here, but good habbit to do \line\line originalhealthreadercode: //label defining the original code, can be used to jump into or just skip, not needed here \line mov eax,[esi+ecx*4] //read health \line mov ecx,[esi+edx*4+4] //read something else, my gues, armor \line\line jmp returnHealthReader //jump back to the original game code, when done successfull, it wont crash... \line\line\line\line //---------------------------------------- \line // Health decreaser \line //---------------------------------------- \line\line\line\line 00421000: \line jmp injectHealthWriter //overwrite the original code with a jump. \line returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005 \line\line\line injectHealthWriter: \line //do a check if esi+ecx*4 matches the address stored in playerhealthaddress \line //if it matches, skip the original code, if it doesn't just execute it \line\line //save the registers we use, and before I forget, do not touch esp between saving and restoring the registers unless \line //it's to read something(like parameters), in which case you'll have to adjust the offset \line //also, dont change the registers that you use to find the address \line push eax \line push ebx \line mov eax,[playerhealthaddress] \line lea ebx,[esi+ecx*4] \line cmp eax,ebx \line\line je itstheplayer \line\line //not the player \line pop ebx //I think I could have doen this before the je, but better safe than sorry \line pop eax \line jmp originaldecreasehealthcode \line\line\line itstheplayer: \line pop ebx //restore the registers, keep in mind to restore"z the registers in reverse order \line pop eax \line jmp returnHealthWriter //dont execute the original code, return imeadiatly \line\line originaldecreasehealthcode: \line sub edx,eax \line mov [esi+ecx*4],edx \line jmp returnHealthWriter \line\line\line \line\line\line Please be aware that I havn't tested this in ce yet, I've been writing this in notepad on a pc that doesnt have ce installed, so there may be a few syntax errors, and some of the code I've written can surely be optimised, but I hope you get the general idea. \line\line Also, there's a bug in ce 5.0 where you can't use small identiers that can apear in the name of another identifier. (e.g weirdmemlocxxx and memloc can't be used at the same time, because memloc fits in weirdmemlocxxx) \line But if you use normal names for identifiers this wont couse a problem, and I recommend identifiers of more than 4 characters, else it may happen you get the name of a assembler instruction and accidentally overwrite that when used. \line\line _____________________\line \line The other method of using code injection is finding if there are differences between the player data and opponent data. \line Lets say that if it's the player [esi+ecx*4+14] contains a 1 otherwhise a 0. you can then do a check if that is set or not, if so, skip, otherwhise, decrease health \line\line Code: \line\line alloc(injectHealthWriter,1024) //2nd code cave to handle the code of the decrease health code, for easy management \line label(returnHealthWriter) \line label(itstheplayer) \line label(originaldecreasehealthcode) \line\line\line //---------------------------------------- \line // Health decreaser \line //---------------------------------------- \line\line\line\line 00421000: \line jmp injectHealthWriter //overwrite the original code with a jump. \line returnHealthWriter: //just declare it here, it'll get address 00421005, so a jmp returnHealthWriter will get converted to jmp 00421005 \line\line\line injectHealthWriter: \line push eax \line mov eax,[esi+ecx*4+14] \line cmp eax,1 \line je itstheplayer \line\line //not the player \line pop eax \line jmp originaldecreasehealthcode \line\line\line itstheplayer: \line pop eax //restore the register \line jmp returnHealthWriter //dont execute the original code, return imeadiatly \line\line originaldecreasehealthcode: \line sub edx,eax \line mov [esi+ecx*4],edx \line jmp returnHealthWriter \line \line \line \line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1024\hich\f1\dbch\f1\loch\f1\cf2\b Code Injection and the auto assembler\fs18\b0\par\pard\s0\ql\plain\f1\fs24\par} N1Searching TipSearchingTipSearchingTipHelpMacro=29 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13vSearching Tip Remote desktop instead of network version {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by Smidge204\line\line When searching for a value in memory using the scan, here are a few pointers to find the value quickly: \line\line 1) If the value is known, but the format is not (ie: Byte, 2 Bytes, 4 Bytes...) search for the smallest type that will hold the data. \line\line For example, if the value you want is 60, search for bytes. If the value is 1224, search for 2 Byte values, etc. The idea being that if the actual format is larger (You searched for 2 byte values but it's actually a 4 byte values) then the other bytes would be 0 anyway and the value would still be found. \line\line But if you search for a 4 byte value when it's really less, you might never find it because you're reading nearby bytes as well that might screw up your search! \line\line\line 2) If the value is unknown, use the "Unknown initial value" scan along with method 1 (ie: always use bytes unless you happen to know it's size). Then do something that changes it's value. \line\line Once the value has changed, repeat the scan using "Changed values". This will filter out all the crap. \line\line Now go back into the game and do a bunch of stuff that DOESN'T change the value, if possible. Now repeat the scan for "Unchanged values". This will filter out stuff like position values, timers and counters. \line\line Keep repeating until you've widdled down the searches to a managable amount, then add all the results to your list and keep an eye on them as the game runs. Remove anything that changes when it logically shouldn't. Anything that's left, try plugging in random values and see if something happens! \line\line\line 3) If you've found a bunch of good values, and youre looking for information that is somewhat related (Such as Lives and money, or whatever) , try restricting your search range to within a few kilobytes of the known value either way. This is especially powerful when looking for values in tables (High score list, for example) since they tend to be right next to eachother. \line\line\line 4) Use "Bigger than" and "Smaller than" as often as possible, especially after scans for changed or unchanged values. This can generally wittle down the results pretty fast. \line\line\line 5) Use arrays to peek at multiple byte values at once. Useful for detecing patterns! \line\line\line\line 6) Sometimes string values are not stored as ASCII strings, so the "Text" search doesn't work. For example, "A" might be stored as 0x01 instead of 41. If that's the case, and you have control over the value in-game (character name?) then try these steps: \line\line -Set the character name \line -Search for "Unknown initial value" \line -Change name \line -Search for "Changed values" \line (Repeat above two steps to eliminate as much junk as possible. See also tip #2) \line -Change name to all the same characters. ie: "AAAAAAA". Try to max out the space you're given. \line -Search one more time for changed values. If you've"{ increased the number of displayed results enough to get a list, scroll down and see if you have a bunch of consecutive memory locations that have the same value. (Should be the same as the length of the string!) \line -Add the first address to your list as an array equal to the length of the string you entered. \line -Change name to an easily identifiable pattern. ie: "ABCDEFG" \line -See if the bytes in your array changed to a similar pattern. If so, start mapping the characters to their values and you're done! \line\line Once you have the character map, you can use it to "translate" other text you couldn't find before. Simply search for an array of bytes and enter in the expected values of each letter in order. \line\line\line Hope that helps! \line =SMidge=\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Searching Tip\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1RRemote desktop instead of network versionHRemotedesktopinsteadofnetworkversionHRemotedesktopinsteadofnetworkversionHelpMacro=30 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13Remote desktop instead of network version client network remote desktop server {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\cf2\line\cf3\fs18 Originally posted by Zhoul:\line\line *Pre-Req!!! Windows XP Professional - (Not Home) - Upgraded to SP2. Worry not, hacked TCPIP DLL's are talked about below.* \line\line When I first started using cheat engine, I thought it was fantastic! I hated to have to alt+tab, and am usually using 2 PC's anyhow, so I loved the fact that it came with a network client. \line\line The problem(s)? The network client didn't do as good a job, because when I tried to do things like 'See what writes to this value', It would usually end up crashing my game, mostly the very first time I tried doing it. The network client also had more bugs and lacked the newer features. \line\line I fiddled with the settings *a lot*, trying to see if it was something I was doing wrong, or a config option that wasn't set properly. To no avail. \line\line I then launched a massive search for another software/debugger that had a network client, but stumbled upon something I think is a lot better. \line\line Basically, Microsoft messed around with giving us concurrent remote desktop + console sessions. Meaning: The ability to be logged into the console, and still connect remotely, without logging the console session out. They scrapped the idea later, because of licensing. They had released termserv.dll in a beta version of SP2, and of course, it was preserved by techies everywhere. \line\line I quickly installed the new termserv.dll, grinning from ear to ear, rebooted my PC, then tried to login remotely. \line\line Ack! Console session was logged out! Ahh!!! I get it... the same user cannot login twice. So I created a 2nd admin account, and that solved *that* problem. \line\line I then loaded up a game on my main PC and remote desktop'd to it, and loaded up cheat engine on the other. \line\line ACK!! User wasn't allowed to debug?! \line\line I quickly loaded up gpedit.msc and navigated its non-logical tree structure and finally found an option that lets you specify who has rights to debug programs (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Access > Debug programs). Gave my new user rights to debug then tried again. \line\line ACK! I still wasn't allowed to 'connect' to my game, as microsoft does not allow us to 'peek' into a process that was run by another user. \line\line Yet another hurdle I soon passed over, by using a command known as "RunAs". I had to run Cheat Engine.exe AS the console user. I figured this out quite quickly, because I already use it to run internet explorer as a 'guest' account (I'll tell ya, doing that beats out any spyware/virus scanner I've ever used.) \line\line --------------------------------------------------------------------- \line To sum up what is needed: \line\line - Windows XP PROFESSIONAL with SP2 installed (this is a must. I didn't want to go to SP2, but had to. This termserv.dll will *NOT* work with XPSP1). \line - Install the termserv.dll which is linked at the bottom of this post, or find an installer version of it via google. \line - Make sure the service "Fast User Switching" is enabled. Usually is by default, but some of us like to slim down XP to essential processes, and this is notoriously disabled by folks like us (and notoriously the reason people can't get concurrent terminal services working). \line - Create a 2nd administrator account and MAKE SURE to login as that user locally, before you try to do it via remote desktop. New users aren't entirely 'created' until their first login. \line - Load gpedit.msc (from start>run), and give your new user access to debug programs. (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Access > Debug programs). \line - Login via remote desktop, as your new user. \line - Create an icon for cheat engine, that does something like this... \line runas.exe /savecred /profile /user:"MyConsoleSession" "J:EngineEngine.exe" \line --------------------------------------------------------------------- \line\line Of course, replace "MyConsoleSession" with the username that you use to login to the console with. In my case, Zoultan was the console/original username, Zoultan2 was the remote desktop session, so I would put Zoultan where MyConsoleSession is. \line\line Also, change the path to cheat engine.exe \line\line The good thing about runas, is the /savecred switch. The first time you run it, you will be prompted for the pass"|word. This will be saved and not asked for again. \line\line\line I run things as other users a lot, so I created a batch file to do so, then placed it in C:. You don't need this to use cheat engine, but I'll pass it out for those who are interested in it. \line\line ------------ START - Cut below this line but not the line itself ------------ \line @echo off \line set Uname=Zoultan \line\line set Arg=%1 \line SHIFT \line\line :parseArgs \line if "%1" == "" goto RunAz \line set Arg=%Arg% %1 \line SHIFT \line goto parseArgs \line\line\line :RunAz \line If NOT DEFINED Arg ( \line echo. \line echo No program or paramaters were specified. \line echo. \line goto End \line ) \line\line rem The following 2 lines were placed here, to handle .msc's as if they were EXE's. I was tired of having to run mmc.exe . \line set ArgPart=%Arg:"=% \line set ArgPart=%ArgPart:~-3% \line if "%ArgPart%" == "msc" set Arg=%windir%.exe %Arg% \line\line echo. \line echo. \line echo. \line echo Running [ %Arg% ] As [ %Uname% ] \line echo Command: runas.exe /savecred /profile /user:"%Uname%" "%Arg%" \line runas.exe /savecred /profile /user:"%Uname%" "%Arg%"|rem \line echo. \line echo. \line if NOT "%errorlevel%" == "0" echo There has been an error while trying to run %Arg% as %UName% \line goto End \line\line\line :END \line set Arg= \line set ArgPart= \line set Uname= \line ping -n 5 127.0.0.1|rem \line ------------ END - Cut above this line but not the line itself ------------ \line\line Of course, you would change the set Uname=Zoultan line to match the user you want to runas. It could even be changed to accept the username via command line, but this was written specifically to launch as 1 user (and I created 2 other batch files for my other users). \line\line All my CE icons are setup like so... \line Z.bat "J:Engine 1engine.exe" \line Z.bat "J:Engine 2engine.exe" \line etc... etc... etc... \line\line Another reason I setup this .bat is so I could run things like task manager from my remote desktop session. Even though a remote admin can kill another admins processes, they can't do things like "Set Affinity", etc. So when I'm disallowed the ability to do something, I just use z to launch the program, and voila' \line\line You can also run things like regedit.exe , from console, as your remote desktop user, if you're g33ky enough to want to change other users settings without having to login as that user. \line\line Lastly: If you're curious why the .bat file pings 127.0.0.1 (local host)... XP didn't come with a wait or sleep command. Therefore, in my batch files, I use ping and re-direct its output to rem (null essentially). What this does, is leaves the dos window up for 5 seconds, so I can catch the success/error messages, without having to use pause. \line\line Remote Desktop Terminal Services Hack: \line http://sig9.com/articles/concurrent-remote-desktop \line\line If this link doesn't work in the future, then use google, and search for... \line xp sp2 terminal services hack \line There is hella-documentation on this ... undocumented feature =) \line\line - Zhoul\line\cf2\fs24\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Remote desktop instead of network version\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1 Popups Popups,sIcon=6 exp=1 sel=0N1HelpMacro=0 HW=Popup CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=13/09/2008 03:13{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1024\hich\f1\dbch\f1\loch\f1\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f1\fs24\par} N1Window ListWindow List,sIcon=5 exp=1 sel=0N1Main Main>C01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 X01=591 X02=9 X03=9 X04=557 sIcon=8 exp=0 sel=0N1 Popup Popup"}>C01=12632256 C02=15400191 A00=0 A01=1 A02=0 A03=1 A04=1 A05=1 A06=0 A07=0 A08=1 A09=0 A10=1 A11=1 Z01=1 Z02=1 Z03=1 Z04=1 Z05=1 Z06=0 Z07=0 Z08=1 Z09=1 Z10=1 Z11=0 Z12=0 Z13=0 Z14=1 Z15=1 Z16=1 Z17=200 X01=591 X02=9 X03=9 X04=557 sIcon=8 exp=0 sel=0N1ProcessProcessProcessHelpMacro=5 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=1 sel=0 sBook=13/09/2008 03:13 sBookPage=28/12/2008 11:22 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=1 Y1=0 X2=0 Y2=0results {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf3\cb1\chcbpat1\ulc3 Normal;}{\cs1\cf3\cb1\chcbpat1\ulc3 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\par\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\plain\f1\fs24\par} N1TutorialsTutorialsTutorialsHelpMacro=21 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=28/12/2008 11:26 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=1 Y1=0 X2=0 Y2=0 sBookPage2=1LTutorials Anti tab protected games {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;\red1\green1\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf3\fs24\line\par\cf0\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\fs24\b Tutorials\fs18\b0\par\pard\s0\ql\plain\f1\fs20\lang1033\hich\f1\dbch\f1\loch\f1\fs24\par} N1,Functions and pointers(Functionsandpointers(FunctionsandpointersDateCreated=28/12/2008 DateModified=28/12/2008 DateReview=28/12/2008 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=2 Y1=50 X2=0 Y2=0 sBookPage2=1 sBookPage=28/12/2008 13:41 sIcon=13 exp=0 sel=0 sBook=30/12/2008 22:15({\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 InitializePlugin fills in a structure containing pointers to specific addresses and pointers to functions.\par This chapter will try to describe each one of them\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\"~deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20 Functions and pointers\par} N1MenuDateCreated=16/01/2009 DateModified=16/01/2009 DateReview=16/01/2009 CT1=0 CT2=0 CT3=0 CT4=0 CT5=0 CT6=0 CT7=0 CT8=0 CT9=0 CX1=0 CX2=0 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=28/12/2009 17:01 sBookPage=28/12/2009 17:01x{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} N1 MenusDateCreated=28/12/2009 DateModified=28/12/2009 DateReview=28/12/2009 CT1=0 CT2=0 CT3=0 CT4=0 CT5=0 CT6=0 CT7=0 CT8=0 CT9=0 CX1=0 CX2=0 CX3=0 CX4=0 CX5=0 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sIcon=13 exp=1 sel=0 sBook=29/12/2009 15:55 sBookPage=29/12/2009 15:55{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\plain\f1\fs20\par} N1Settings windowSettingsWindowSettingsWindowHelpMacro=14 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=30/12/2009 19:43 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=2 Y1=0 X2=0 Y2=15HSettings Window Network versions {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red1\green1\blue0 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf3\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang1033\hich\f1\dbch\f1\loch\f1\cf2\line\lang2057\hich\f2\dbch\f2\loch\f2\cf0\fs18\par\plain\f1\fs24\par} S{\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs20\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b Settings \lang2057\hich\f2\dbch\f2\loch\f2 w\lang1033\hich\f1\dbch\f1\loch\f1 indow\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1&About this helpfile"Aboutthishelpfile"AboutthishelpfileHelpMacro=1 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1="1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=13/09/2008 DateModified=13/09/2008 DateReview=13/09/2008 sIcon=10 exp=0 sel=0 sBook=13/09/2008 03:13 sBookPage=30/12/2009 19:47 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=1 X1=1 Y1=0 X2=0 Y2=0errors poor lame About this helpfile mistakes Please kill me now shit I am a lemming crap icq {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\par\qc\plain\f1\fs24\plain\f1\fs24\par} {\rtf1\ansi\deflang1033\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs24\pard\s0\ql\keepn\lang1033\hich\f1\dbch\f1\loch\f1\cf2\b About this helpfile\cf0\fs18\b0\par\pard\s0\ql\plain\f1\fs24\plain\f1\fs24\par} N1 Advanced options advanced-options advanced-options$HelpMacro=1068 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=1 Y1=0 X2=0 Y2=16 sChange=Under Construction sBook=30/12/2009 20:11 sBookPage=30/12/2009 20:11 sIcon=10 exp=0 sel=0{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs24\par\hich\f1\dbch\f1\loch\f1\cf2\fs18\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf2\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\fs24\b Advanced options\cf2\b0\par} N14Assembly and Hexing Theory4assembly-and-hexing-theory4assembly-and-hexing-theory>HelpMacro=1072 HW=Main CT1=1 CT2=1 CT3=1 CT4=1 CT5=1 CT6=1 CT7=1 CT8=0 CT9=1 CX1=1 CX2=1 CX3=0 CX4=0 CX5=0 DateCreated=30/12/2009 DateModified=30/12/2009 DateReview=30/12/2009 ShowTree=0 BseStart=0 BseInc=1 pagebreak=1 WordSectionType=0 LastFocus=0 X1=0 Y1=0 X2=0 Y2=0 sChange=Under Construction sBook=30/12/2009 20:24 sBookPage2=1 sBookPage=30/12/2009 20:24 sIcon=10 exp=0 sel=0x{\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs18\cf0\cb1\chcbpat1\ulc0 Normal;}{\cs1\cf0\cb1\chcbpat1\ulc0 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs18\ql\par} {\rtf1\ansi\deflang2057\ftnbj\uc1\deff1 {\fonttbl{\f0 \froman \fcharset0 Times New Roman;}{\f1 \fswiss Arial;}{\f2 \fswiss \fcharset0 Arial;}} {\colortbl ;\red255\green255\blue255 ;\red0\green0\blue0 ;} {\stylesheet{\f1\fs24\cf0\cb1\chcbpat1\ulc2 Normal;}{\cs1\cf2\cb1\chcbpat1\ulc2 Default Paragraph Font;}} {\*\revtbl{Unknown;}} \paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440\headery720\footery720\nogrowautofit\deftab720\formshade\fet4\aendnotes\aftnnrlc\pgbrdrhead\pgbrdrfoot \sectd\pgwsxn12240\pghsxn15840\marglsxn1800\margrsxn1800\margtsxn1440\margbsxn1440\headery720\footery720\sbkpage\pgncont\pgndec \plain\plain\f1\fs20\ql\lang2057\hich\f2\dbch\f2\loch\f2\cf2\fs24 Assembly and Hexing Theory\par}