DIR Return Create A Forum - Home
---------------------------------------------------------
3xtGamingCoding
HTML https://3xtgamingcoding.createaforum.com
---------------------------------------------------------
*****************************************************
DIR Return to: C/C++/C#
*****************************************************
#Post#: 15--------------------------------------------------
Basic Trainer Maker with C++
DIR By: akimo360
Date: November 25, 2011, 2:53 pm
---------------------------------------------------------
I made this tutorial at 2 a.m.! So do take your time to read. I
will be explaining in very close detail on how to find address.
In this tutorial we are going to be creating an "unlimited
Lives" trainer for the freeware game "Plastic Kitten".
I chose Plastic Kitten as our game because it has all the basic
values in most games, eg. Lives, Score, Level.
In some future tutorials i will focus on more complicated parts
such as:
- Increasing Lives when you die (Instead of Decreasing).
- Adding extra points to your score at will/ Making things worth
more points to your score.
But for now let's stick to basic memory freezing.
For this tutorial you will need the following tools:
* Trainer Maker Kit 1.51 (Cheat Terms And Tools)
* TSearch v1.6 (Cheat Terms And Tools)
* and of course our game, Plastic Kitten (download here
HTML http://www.cheathappens.com/~zipchittybang/plastickitten.zip)
Now once you have all these tools available to you, start up
plastic kitten and start a new game. Notice you have 2 heads
below the "Score: 0" text? This indicates you have 3 lives.
Although there are only 2 heads visible, when both of those are
gone (you die twice) you still have 1 last life.
** Pause your Plastic Kitten game by pressing "P" **
Now we open up T-Search and click the "Open Process" button,
which is the one with the chip on it. Select our Plastic Kitten
icon and click "Open". This simply allows us to serach Plastic
Kittens memory and debug it. Now click the little magnifying
glass just under our Open Process button, not the one with the
three dots, and choose "Exact Value" and "4 Bytes". Now type in
the amount of lives we have (3) into the Value TextBox and click
OK.
T-Search should have searched the memory and found roughly 6240
different addresses with the value "3". Well we aren't going to
check all 6247 addresses to find out which one is our lives
address so we simply go back into plastic kitten and un-pause
it. Die 1 time by jumping off the edge at the bottom and you
will notice one head has dissapeared, meaning we only have 2
lives left.
** Pause your Plastic Kitten game by pressing "P" **
Go back into T-Search and click the Magnifying Glass (the one
with the 3 dots on it this time!) and search for "2". This
basically searches through our old "3" values and only keeps the
ones which have changed to "2". Now you should have only a few
addresses, most of the time you will have 1 but sometimes you
will see 2 or 3 left over. Now click the Autohack menu up at the
top of T-Search and click Enable Debugger. Now double-click your
value(s) and they will now be at the table on the right. Right
click each value and select Autohack. Now go back up to the
autohack menu at the top of T-Search and click Autohack Window.
This will bring up our autohack window which we just leave for
the time being.
Now go back into your plastic kitten game and un-pause it then
die again. Pause it once you have died and look at your Autohack
window. You should now see something like "48D87e: mov
[ecx],eax". Press the button just above our code which has the
red smiley-face on it (no blue cross). This simply "nop's" this
piece of code (makes it do nothing).
Now you can go back into Plastic Kitten and die as many times as
you like and you should never have "Game Over".
But this is all too much hassle to repeat every time you want
unlimited lives. So now we make this NOP code into a trainer
using Trainer Maker Kit (TMK). Leave all your T-Search windows
up and Plastic Kitten game running and open up TMK. Type in a
project name, i used "kitty" and click create. Now you see the
window labelled "Dialog" on it inside TMK? This will be our exe
layout. Now we want to add a button by going to Insert->Button
at the top of TMK. Make sure you insert 2 buttons, as one will
be used for turning on Unlimited Lives and the other for turning
it off. Now once you have your 2 buttons added, right click on
button 1 and goto "Properties". Change it's caption to "ON" and
do the same for button 2 but change button 2 to "OFF" instead.
Now go back into T-Search's Autohack window, and up at the top
click the "Tmk" menu and press "Button Script". You should now
see the following in a different window:
Patched script:
Poke 48D87E 90 90
UnPatched script:
Poke 48D87E 89 01
Patched Script is for enabling unlimited lives, replacing 89 01
with 90 90 (NOP/ No-Operation). UnPatched Scritp is for
disabling unlimited lives, replacing 90 90 with the original 89
01.
So what you want to do now is go into TMK and right click button
1 and choose "Write Memory Actions". In the window that pops up,
insert your patched script which is simple "Poke 48D87E 90 90"
without the quotation marks and click Apply. Do the same for
button 2 but insert the UnPatched "poke" into this one instead.
Now that we have our trainer ready, at the bottom left of TMK
choose the "Build Settings" Tab and click on the box with "Exe
Name" next to it. This is basically where we enter what we want
our executable trainer to be named, eg. Kitty.
Now above that there should be a list of processes. Simply look
through those for your plastic kitty process name, which was
"PLASTI~1.exe" for me, and double click it.
Now lets build our trainer by pressing the button up to the left
of the Exclamation Mark or alternatively press Build on the menu
the select "Build Your Project". This should only take 3-4
seconds to compile.
When you have compiled it, it should be in the same folder you
installed TMK to. Once you've found it, open it up and close
Plastic Kitten, T-Search and TMK (Assuming you've saved your TMK
Project). Now open up a new game of Plastic Kitten and when
you're in-game click your trainer and press the "ON" button. Now
for
the moment of truth... die once or twice and see if it reduces
your lives at all. My trainer didn't so if you followed all
steps correctly then you should have a nice working Unlimited
Lives trainer for Plastic Kitten. If you wish to make your
trainer look better, simply load the project into TMK where you
can now add image files for backgrounds, change the "Dialog"
text and even add Messages to let the user know that the memory
was "Poked" Successfully.
Do feel free to ask me any questions in this thread or PM me.
---------------------------------------------------------
FAQ
Do I need to learn C++ or anything to beable to hack multiplayer
games?
You don't need to learn any language to do basic hacks, but
learning one (such as assembly) will greatly improve your
hacking skills.
Which operating system should I use?
It would be good to have Windows 7 (64-bit) on your machine,
because most of the tools we used were designed for that
operating system. You can install it if you installed windows
vista first (my suggestion) w/o losing any data by doing
non-destructive partitioning.
---------------------------------------------------------
Now, using a little of C++ knowledge, we shall hack pinball in
windows games!
Knowledge needed/optional:
Basic C++ coding skills
Basic understanding of the PE and finding an address with Cheat
Engine
Ok let's get to it then.
Our target today is Windows's pinball game
(start->run->"pinball")
First, declarations.
--- Code ---
HWND hWnd;
DWORD dwID;
HANDLE hProcess;
--- End Code ---
hWnd = Window Handle.
dwID = Process ID.
hProcess = Process Handle.
Defined in windows.h btw, so #include <windows.h>
Let's recover the window handle then.
--- Code ---
hWnd = FindWindow(NULL, "3D Pinball for Windows - Space
Cadet");
--- End Code ---
FindWindow's return value is the HANDLE of the window.
For more info goto msdn. (google->msdn)
Let's recover the process id.
--- Code ---
GetWindowThreadProcessId(hWnd, &dwID);
--- End Code ---
For more info goto msdn, this isn't difficult at all.
We recovered the process's ID.
Next, process handle.
--- Code ---
hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, dwID);
--- End Code ---
Process security and access rights : Process Security and Access
Rights (Windows)
HTML http://msdn.microsoft.com/en-us/library/ms684880(VS.85).aspx
PROCESS_ALL_ACCESS, hmm, I wonder what that might be.
Anyways, we don't need the second argument, and the third
argument is the process ID.
If function works successfuly returned value is the process
handle, which is exactly what we need.
Error handling would look like this:
--- Code ---
hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, dwID);
if(hProcess == NULL)
whatever //error
--- End Code ---
Here comes the fun part ;D
--- Code ---
int value = 1000000;
WriteProcessMemory(hProcess, (LPVOID) 0x00C20C62, (LPVOID)
&value, sizeof(&value), NULL);
--- End Code ---
hProcess = Process handle.
(LPVOID) typecasting - needed.
0x00C20C62 - "Score" address in pinball.
(LPVOID) typecasting - needed.
&value - pointer to the value integer (1000000)
Next argument is number of bytes to be written (size)
So we use sizeof for it to work well.
We don't need the next parameter.
So basically, this is the source code for our successfull
trainer my friends :
--- Code ---
#include <iostream>
#include <windows.h>
using namespace std;
int main()
{
HWND hWnd;
DWORD dwID;
HANDLE hProcess;
hWnd = FindWindow(NULL, "3D Pinball for Windows -
Space Cadet");
GetWindowThreadProcessId(hWnd, &dwID);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL,
dwID);
int value = 1000000;
WriteProcessMemory(hProcess, (LPVOID) 0x00C20C62,
(LPVOID) &value, sizeof(&value), NULL);
return 0;
}
--- End Code ---
Congratulations.!
Now that's the difference between a normal trainer and a c++
trainer.
*****************************************************
Page 1 of 1