Quote:
Originally Posted by h4x0r #
What happen?, no trainer for Oil Rush 1.0 and yes sicheats + 1, no trainer for Oil Rush 1.1 and yes sicheats +2 and Today VOILA!, CH have a + 2 Trainer? 
Sicheats release:
Published on January 28, 2012 21:12: by Cocodrilo
CH Release:
Trainer . added: 1/28/2012 12:44:24 PM
Please CH, type here source Code from this trainer and come on to see comparation.
Great work, fantastic.
 |
First of all THANKS FOR THE PROPS! we do good work over here at CH.
i am sorry that you feel we somehow borrowed your work, Jose Francisco Sanchez Romero.
at the time we posted our trainer on our site there was only one other trainer that we saw. The trainer was from:
gchan
and the website is:
3dmgame.com
also i am seeing that his trainer has an earlier time stamp than yours. In other words, HIS trainer was first before OURS and YOURS. therefore with YOUR logic, we BOTH ripped him off since the options were the same in ALL THREE TRAINERS.. oil and points are two pretty SENSIBLE options though, arent they JOSE?
anyways-
i don't know how your trainer nor HIS trainer works, but we found no good way to isolate the addresses by code injection and compare (standard trainer making practice) and since this game seems to send alot of addresses through 3 main portals (i.e. there are 3 code areas that all data seems to sift through) then you can assume the game is basically script driven via a scripting language like LUA or actionscript or UniScript or whatever from this engine.
Therefore the decision was made to try and see if this engine had a static address that pointer chains could be used to point to the same addresses over and over.
We all know what pointer chains are, right?
At any rate, using Cheatengine latest version, you can isolate the OIL by doing a search, then building something, and then search. Then you can do a pointerscan (i used 5 levels) and you get a list of about 15000 or so. then you stop the game and restart it and repeat over and over. i did this in both campaign AND Quick Match. it takes literally 10-15 mins each one to narrow down the pointer scan list (the pointer chain) to a static address and working chain.
here are the working chains i searched for this game:
POINTER SCAN
============
unigine_x86.dll
campaign
+5fbac4]+90]+60c]+70]+30==OIL LONG
+5fbac4]+90]+654]+9c]+30==POINTS LONG
quickgame
+5fbac4]+90]+610]+9c]+30==OIL LONG
+5fbac4]+90]+650]+70]+30==POINTS LONG
+5fbac4 is the static offset from the BASE of the unigine_x86.dll
there is no real 'code' to post, other than the readprocessmemory to set up the actual address:
; -------------------------
;-ADDRESS LIST
; -------------------------
;{
;GameNumber=1
Address1=RendBase+$5fbac4; BASE
;Address2=RendBase+$42FC0F; TEST2
;Version=$99999999
;versionoffset=ProgramBase+$200000
;Gosub CreateAddressData
;Gosub SearchAddressData
;}
AND:
; -------------------------
;-GET ADDRESSES
; -------------------------
;{
result = ReadProcessMemory_(app,Address1 ,buffer,4,Null)
MainAddress=PeekL(buffer)+$90
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$60C
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$70
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$30
CampaignOilAddress=MainAddress
;Debug Hex(MainAddress)
;=========================================
result = ReadProcessMemory_(app,Address1 ,buffer,4,Null)
MainAddress=PeekL(buffer)+$90
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$654
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$9c
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$30
CampaignUpgradePointsAddress=MainAddress
;Debug Hex(MainAddress)
;=========================================
result = ReadProcessMemory_(app,Address1 ,buffer,4,Null)
MainAddress=PeekL(buffer)+$90
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$610
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$9c
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$30
QuickGameOilAddress=MainAddress
;Debug Hex(MainAddress)
;=========================================
result = ReadProcessMemory_(app,Address1 ,buffer,4,Null)
MainAddress=PeekL(buffer)+$90
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$650
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$70
;Debug Hex(MainAddress)
result = ReadProcessMemory_(app,MainAddress ,buffer,4,Null)
MainAddress=PeekL(buffer)+$30
QuickGameUpgradePointsAddress=MainAddress
;Debug Hex(MainAddress)
;End
;}
then writing to them when user presses key:
such as:
; -------------------------
;-Detect 'F1' Keypress
; -------------------------
;{
aaaa=1:keypressed1=CheckKeypress(key(aaaa), keys(aaaa), keyc(aaaa), keya(aaaa))
If keypressed1<>0
result=PokeL(buffer,999)
result = WriteProcessMemory_(app,CampaignOilAddress,buffer, 4,Null)
result = WriteProcessMemory_(app,QuickGameOilAddress,buffer ,4,Null)
PlaySound(0)
Delay(300)
EndIf
;}
nobody 'stole' anyone's code. if you found a way to write to the addresses using direct .exe manipulation (i.e. code injection) then more power to you. we went the long hard route of doing pointer scans, which is annoying and takes forever to truly isolate, and also each patch i have to do this over and over again. but i have no idea how your trainer and this other fellow trainer works. by the way, the pointer chain has it's faults and our trainer isn't working 'perfect' 100% of the time, and people have to follow the correct instructions.
here is some notes where i tried to make the trainer access the .exe but i could never get a stable working solution that worked every time:
OIL / POINTS
=============
6019E321 8B0C81 MOV ECX,DWORD PTR DS:[ECX+EAX*4]
then
EAX==181
then, [ECX+18]+50 == OIL +30?
EAX==192
then, [ECX+18]+50 == POINTS +30?
6019E308 8B0483 MOV EAX,DWORD PTR DS:[EBX+EAX*4]
6019E30B 0FB70F MOVZX ECX,WORD PTR DS:[EDI]
6019E30E 8B80 A0000000 MOV EAX,DWORD PTR DS:[EAX+A0]
6019E314 8B0488 MOV EAX,DWORD PTR DS:[EAX+ECX*4]
6019E317 8B4C24 30 MOV ECX,DWORD PTR SS:[ESP+30]
6019E31B 8B89 90000000 MOV ECX,DWORD PTR DS:[ECX+90]
6019E321 8B0C81 MOV ECX,DWORD PTR DS:[ECX+EAX*4]
6019E324 > E8 0FDFFCFF CALL Unigine_.6016C238
TROOPS
=======
601711B8 8B0C81 MOV ECX,DWORD PTR DS:[ECX+EAX*4]
EAX==8a7
then, [ECX+20]+10 == OIL
601711A3 8B47 14 MOV EAX,DWORD PTR DS:[EDI+14]
601711A6 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
601711A9 8B0498 MOV EAX,DWORD PTR DS:[EAX+EBX*4]
601711AC 8B89 90000000 MOV ECX,DWORD PTR DS:[ECX+90]
601711B2 FFB5 DCFBFFFF PUSH DWORD PTR SS:[EBP-424]
601711B8 8B0C81 MOV ECX,DWORD PTR DS:[ECX+EAX*4]
i thought that fileforums and GCW were killing this sort of stuff? are you going to post a retration now JOSE? are trippex and Blow Forster going to chime in here and tell JOSE how stupid he and this CoCoDildo lackey look accusing people without actually using and testing our trainer?
if it gets down to it, i guess we can post the actual trainer somewhere if needed but, really, this is just pathetic. you are fueling this fight again, and losing......
best,
Cal