Flock [Demo STEAM] +4 Trainer

[h4x0r #]

ONLY FOR ORIGINAL DEMO STEAM

INSTRUCTIONS:

1. Run the trainer and after the game or vice versa.
2. Once in game press the keys that are displayed on the trainer for unlimited resources.

Cheers and enjoy!

DOWNLOAD IN GCW

[DABhand]

hmmmm...

Unlimited turbo = unlimited ufo speed?
Freeze Bonus = Pause Bonus Timer?
Max Puntuation = Add 1000 score?

Hmmm now to check out the coding, between yours and CH's.

[h4x0r #]

Originally Posted by DABhand

hmmmm...

Unlimited turbo = unlimited ufo speed?
Freeze Bonus = Pause Bonus Timer?
Max Puntuation = Add 1000 score?

Hmmm now to check out the coding, between yours and CH's.

no man,I repeat for the last time that I have nothing to do with these people, take it or leave it.

SOURCE:

Unlimited turbo

alloc(newmem,xxx) //2kb es suficiente
label(returnhere)
label(exit)

Flock.exe+50e5b:
jmp newmem
nop
returnhere:

newmem:
mov dword ptr [ebp+000027c4],3f800000
fld dword ptr [ebp+000027c4]

exit:
jmp returnhere

dealloc(newmem)
Flock.exe+50e5b:
fld dword ptr [ebp+000027c4]

Freeze Bonus

alloc(newmem,xxx) //2kb es suficiente
label(returnhere)
label(exit)

Flock.exe+2c000:
jmp newmem
nop
returnhere:

newmem:
mov dword ptr [ecx+00000928],4479c000
fld dword ptr [ecx+00000928]

exit:
jmp returnhere

dealloc(newmem)
Flock.exe+2c000:
fld dword ptr [ecx+00000928]

Max Puntuation = 999999999

alloc(newmem,xxx) //2kb es suficiente
label(returnhere)
label(exit)

Flock.exe+2ef6e:
jmp newmem
nop
returnhere:

newmem:
mov [esi+0000061c],3b9ac9ff
mov ecx,[esi+0000061c]

exit:
jmp returnhere

dealloc(newmem)
Flock.exe+2ef6e:
mov ecx,[esi+0000061c]

am until the eggs that I compare with these people, that is the last time I compared with those people, if you do not want to download not tell no worse, we all have right to do such things.
is the first and only code that I publish, I will not say again that I have nothing to do with these people if we start seeing less reputation to people who do not deserve.

i say demo, and the code is the same for all.

grettings

[DABhand]

Dont get so defensive, it was weird you had 4 options and so did they.

Just so you know.

mov [esi+0000061c],3b9ac9ff
mov ecx,[esi+0000061c]

Could easily be condensed to

mov ecx,3b9ac9ff

[h4x0r #]

Originally Posted by DABhand

Dont get so defensive, it was weird you had 4 options and so did they.

Just so you know.

mov [esi+0000061c],3b9ac9ff
mov ecx,[esi+0000061c]

Could easily be condensed to

mov ecx,3b9ac9ff

is right thanks

[[Psych]]

Sometimes it is nice to stick the value directly into the register used in the routine like DAB said, although other times it is also good to put it into the pointer (the memory address). Depends what options you are doing.

Because that seems to be the write pointer that deducts/adds to your cash when you spend/sell something (not sure how this game works), and if you wrote into the ecx register, you would only see the result in game the second time round, because that amount hasn't been written in to that memory address. The routines that deal with reading from that address to print on screen won't pick it up straight away. You'll still be able to buy sell something, but until you do that the second time you won't see a result.

^ Nothing like talking sh!t heh, lol :P You know what I mean... I messed with ways of condensing code way back when I did some Call of Duty trainers... all good fun...

[Caliber]

for completeness sake:

my demo locations are at:

QUOTA +2828
=====


0045D3C0 0388 28280000 ADD ECX,DWORD PTR DS:[EAX+2828]

QUOTA +2828
=====


0045D3C0 0388 28280000 ADD ECX,DWORD PTR DS:[EAX+2828]


UFO SPEED +27c4 (float)
=========

00450E70 D99D C4270000 FSTP DWORD PTR SS:[EBP+27C4]


SCORE +61c
=====

0042EF6E 8B8E 1C060000 MOV ECX,DWORD PTR DS:[ESI+61C]


BONUS TIMER +928 (float)
===========


0045CCA9 D998 28090000 FSTP DWORD PTR DS:[EAX+928]

AGAIN: once you have attached ollydbg, then log where my trainer attacks the game it's PIE to take this information and create your own trainer...

for the timer you can just convert to FSTP ST

or write the value (mov [esi+0000061c],3b9ac9ff) high

or you can avoid the function altogether.... depends on HOW you want to do it so as to not be noticed...

NOW given all of this, we didn't release our DEMO trainer.... so it's hard to say Hax0r copied us or not. even if he did, how you going to prove it when there's so many ways to TAKE the info and then use it to make your own (slightly different approach) trainer with same options.

what we don't appreciate is when they put out the SAME TRAINER OPTIONS, less than 24 hours after we do with SAME NAMES, in SAME ORDER, with copies of OUR IMAGES in the SAME size (249X339 LOL) taken from the same CODE AREAS with similar or SAME SOLUTIONS.

Tippex been asking for proof of this, well we sent all this to empire quite a while back. i don't have it handy but we also sent a link to cheatengine forums where kelsat was admitting trainer ripping. we DONT HAVE TIME TO GO OVER ALL THIS AGAIN.

there's no way to definitively prove each trainer and our point is that there's enough dots and info to connect these people to our work. If they continue to have a venue here then we are done posting here .... it's that simple. I respect whatever decision EMPIRE arrives at but we ask that he does the SAME regarding our decisions.

also:

mov [esi+0000061c],3b9ac9ff
mov ecx,[esi+0000061c]

is NOT the same as:

mov ecx, 3b9ac9ff

because [esi+0000061c] is holding the float value which declines as time goes on. I don't know if this code snippet has the actual DEC of the float in it but it's better to write to the [esi+0000061c] directly what you want it to be than to rely on the ecx register to carry the new value...

best,
Cal

[Caliber]

also, we've had 19 downloads of our trainer so my thoughts on this game is that it's wildly unpopular OR people refuse to buy it and are waiting for the 'free warez' version of it.

best,
Cal

[DABhand]

Originally Posted by Caliber

mov [esi+0000061c],3b9ac9ff
mov ecx,[esi+0000061c]

is NOT the same as:

mov ecx, 3b9ac9ff

because [esi+0000061c] is holding the float value which declines as time goes on. I don't know if this code snippet has the actual DEC of the float in it but it's better to write to the [esi+0000061c] directly what you want it to be than to rely on the ecx register to carry the new value...

Damn there goes my plan to see if he knew ASM O_o

[h4x0r #]

Originally Posted by DABhand

Damn there goes my plan to see if he knew ASM O_o

some moderate to close the topic, because I do not stand this hypocrisy.

[Joe Forster/STA]

Closed upon request.