cheat engine.shp.svn-base

这是一段游戏修改工具的源代码.ring3功能由dephi开发,驱动是C开发.希望对大家有帮助

<b>readonly</b>
The readonly checkbox tells Cheat Engine, if you want to scan read-only memory or not. Normaly games do not store important game information in read-only memory, but sometimes you may feel a need to scan that memory anyhow. (e.g. If you want to change some text in the game etc...)

<b>fastscan</b>
The fastscan checkbox tells CE to skip addresses that arn't located on a alligned. (Address devidable by 2 or 4 depending on the type)
----- SHM ---- page 3 ---- 
The select window process can be accessed by clicking on the computer icon on the top left side of the main window.

This window holds a list of all the processes currently running.
Double click on a entry and cheat engine will open this <pop=SHM_contents0005>process</pop> for scanning.

If you click on the window button at the bottom you'll get to see all the windows, and the processes that own them, so if you dont know the process name you can use the window to find the process.

The process window also has the ability to attach the debugger the a running process, or to create a new process. The option to attach to a running process is usefull if you don't want a delay when you want to use the debugger, and he option to create a process is usefull when you're using windows 98 or ealier which doesn't have the ability to attach to a running process.

If you have enabled the option to use the processwatcher in settings->extra you will have a 3th button at the bottom saying "Process watcher". Clicking that will open the process watcher window. It'll show you which processes have been created since the start of CE
----- SHM ---- page 4 ---- 
A process is a program or game running in windows.
----- SHM ---- page 5 ---- 
The found list is the list on the left side of the window, under the <klink=Select Process,1>Select Process </klink>button.

When you do a search and the number of addresses your scan found is smaller or equal to the max number of addresses to show(You can change that in the <klink=Settings Window,1>setting window</klink>), then this list will be filled with the addresses you've found.

If you double click an address, drag it to the list at the bottom, or select some addresses and click the red arrow, the addresses will be added to the memory watch list at the bottom
----- SHM ---- page 6 ---- 
<b>Binary</b>
The binary scan is a slow but powerfull scan.
It will scan between bytes for a value
Also, if you want to search for a array of bits that possible too, it even allows wildcard(?,*) instead of the normal 1's and 0's. This allows you to do a search like 1101?001, which will give the results of all addresses+bit that have either 11010001 or 11011001. (More wildcards in a string are allowed)

The range of a bitscan can be as long as you like. (as long as it fits in the memory)

If you're wondering if this is usefull: 
Lets say a program stores the following values as follow:
100=1001100100110110
200=1011001000101001
300=1100101100110110

also note that in normal binary notation the following values are:
100=1100100
200=11001000
300=100101100

now, if you look at the above example you'll notice that the binary value of 100 does apear in the binary that represents 100, but has a 1 as last bit, and the first few bits are random (read from right to left) , same for 200 and 300, with the binary scan you can scan for the binary representation of the values 100-200 or 300.

<b>Byte</b> (8-bits)
A byte is a value that can hold a number between 0 and 255 or -128 to 127. (The last one if it is a <pop=SHM_contents0008>signed value</pop>)
1-byte values aren't used much except for 8-bit emulators, etc... Even though a 1-byte scan seems useless, it will normaly find the value when you dont know for sure wheter the value is either 1-byte, 2-bytes, 4-bytes, or 8-bytes, that is because all those types are build from this base type.

Of course, the number of initial addresses you'll find doing a 1 byte scan is very big, and it will take a while to find the address you're looking for, but at least the change of finding it is higher.

<b>2 bytes</b> (16-bits)
a "2 Byte" value can hold a number between 0 and 65536 or -32768 to 32767 (The last one if it is a <pop=SHM_contents0008>signed value</pop>)
"2 byte" values are used in old dos games, and other 16-bit application.


<b>4 bytes</b> (32-bits)
a "4 byte" value can hold a number between 0..4294967295 or -2147483648 and 2147483647 (The last one if it is a <pop=SHM_contents0008>signed value</pop>)
"4 byte" values are the standard way of storing information in a windows system. So doing a 4-byte scan will normaly give the best results.

<b>8 bytes</b> (64-bits)
a "8 byte" value can hold a number between 9223372036854775808 and 9223372036854775807 (no need for unsigned values anymore)
"8 bytes" aren't used often because they take up a lot of space, and require extra processing. (except for 64-bit processors)
Some programs do use them though, and scanning for a "8-byte" value doesn't return many addresses, so finding the right one is easy then.

If the address you're looking for is smaller than 8 bytes, the chance that the scan has skipped that address is big.

<b>Single</b> (32-bits) (IEEE standard)
a "Single" value can hold a number between 1.5 x 10^-45 and 3.4 x 10^38	.

This is one of the 2 standard floating-point value allocations. (IEEE) The other one is DOUBLE
A Single consists of 4 bytes, which is build up in a special way, which is VERY different from normal variables! (so normal byte scanning wont work)

Cheat Engine rounds values up/down till the number of digits you specify in the scan value box.
e.g.:if you scan for 12 it will find all values between 11.5 and 12.4 and 12.0 results in values between 11.95 and 12.04

<b>double</b> (64-bits) (IEEE standard)
See Single, and the range is between 5.0 x 10^-324 and 1.7 x 10^308	


<b>Text</b>
The "Text" scanvalue can be used to scan the memory of a game for text. E.g: if you know that 12 bytes after your name as a variable you need you can use that to recalculate the addresses each time a game restarts.

<b>array of byte</b>
Same as text, but uses a array of byte instead of characters, and supports wildcards.
input:
xx xx xx xx ...
xx ?? xx xx
xx ** xx xx

a array of byte scan can be usefull when you know that prior to the address you need is always a specific occurance of bytes. (like: 66 66 66 10 10, and 4 bytes after that is your health which is stored as 1 byte. Scanning for 1 byte will take a lot longer than scanning for this string of bytes. Scanning for this string will propably only result 1 address, where as scanning for 1 byte will return thousands of addresses the first time)

<b>All</b>
A combination of byte, 2 bytes, 4 bytes, 8 bytes, single and double

<b>Custom</b>
Lets you assign an auto assembler script where you can fill in how the compare wioth an address should be done and what would result in a positive or negative result
To delete a custom scanscript selexct it and when it's still focuseed press delete
----- SHM ---- page 7 ---- 
Signed:
A value can hold a negative value if it is a signed value.
This is done by inverting all the bits. (all 0's become 1's and 1's become 0's) and increasing the resulting value by 1

example:
12=		00001100
invert=	11110011
-12=		11110100 (notice that if this was a unsigned value this would be 244)
----- SHM ---- page 8 ---- 
Unknown initial values: ("First scan" only)
This scantype  makes a copy of the game in memory, so it can be used later on. (Like comparing it with the current memory and see if it has changed or not)

Exact:
The "exact" scan will scan the memory for the value(or string) you've entered

Bigger than
The "Bigger than" scantype scans for all the values that are higher than the value you've entered

Smaller than
The "Smaller than" scantype scans for all the values that are smaller than the value you've entered

The following scantypes are available only when doing a "next scan"
Increased
If the value of a address has increased it will be added to the list.

Increased by...
If the value of a address has increased with the specified ammount it will be added to the list.

Decreased
If the value of a address has decreased it will be added to the list.

Decreased by...
If the value of a address has decreased with the specified ammount it will be added to the list.

Changed
This scantype will check if the value of an address has changed or not. If it has changed it'll be added to the list

Unchanged
This scantype will check if the value of an address has changed or not . If it has not it'll be added to the list

Same as first scan
This scantype will check if the value of an address is the same as when it was when you did first scan. If it is, it'll be added to the list.
----- SHM ---- page 9 ---- 
The address list is the place where all the addresses will go that you think are usable.

The list can be navigated by using they keyboard and mouse.
There are 2 ways to change a value in the list, by either double-clicking the value, or by selecting it and pressing enter.
For all the other items in the list just double click on it and it will open up a new window allowing you to change it.

The checkboxes allow you to freeze and unfreeze the address. If you freeze a address the address will not change untill you unfreeze it. The value does change but Cheat Engine will restore the value to it's frozen state every few milliseconds(The number of milliseconds can be changed in the <klink=Settings Window,1>settings window</klink>) 

There are 3 types of freezing: Normal (=),Allow Positive (+), and Allow Negative (-). You can change the type of freezing by clicking on the symbol right of the checkbox. The allow positive and negative can be set also by keyboard's numeric + and - keys.

Also, when you right-click on one or more addresses a popup window will show with additional options.


The following keys can be used when the address list has focus:
ENTER:		Change value
Ctrl+Enter:	Change destription
Alt+Enter:	Change Address
Space:		Freeze
+			Positive freeze
-			Negative freeze
Delete:		Delete Address
Ctrl+S:		Switch the position of 2 selected addresses
Ctrl+E:		Edit the selected address
Ctrl+Alt+A:	Open the auto assembler
Ctrl+Alt+Grey Plus:	Move down one position
Ctrl+Alt+Grey Minus:	Move up one position
----- SHM ---- page 10 ---- 
The questionmark on the bottom right of the cheat engine window opens the Comments window.
The comments window can be used to store extra information in your cheat tables. You can for example use it to leave notes on how you found a address, or other stuff, like your name.
----- SHM ---- page 11 ---- 
The memory view can be reached by clicking on the memory view in the main cheat engine window.

The memory view contains several tools and functions for advanced game hackers like the autoassembler, a codecave scanner, a thread generator, a memory allocator, a code dissector, a dll injector, debugger options, a disassembler, a assembler, a hex viewer and more.

To change assembler code just stand on the address you want to edit and type in your now code.
To edit the value of some bytes directly in memory just click on a byte and start typing in the new values.

There are also some hotkeys, like CTRL+G to jump which will popup a box where you can fill in the new address you want to go to and ctrl+f in the hex view to do a simple scan
If you have a jmp or call selected you can press SPACE to follow that address. BACKSPACE and CTRL+SPACE will go back
----- SHM ---- page 12 ---- 
You will sometimes read about the debugger of cheat engine, this is a thread that has access to the opened process, and handles all debugging events, like creating threads, handling exeptions, etc...
a thread is a part of the program that runs seperatly from the rest of the program, but still has access to the memory of the main program
----- SHM ---- page 13 ---- 
The settings window allows you to change several aspects of Cheat Engine ranging from how it looks to how it scans.
----- SHM ---- page 14 ---- 
Older versions of cheat engine come with a seperate Client and Server version

There are a few games that give no possibility to switch between programs. (It either closes, crashes, or takes down your whole pc when you switch to something else)
In those cases the Network versions of Cheat Engine come in handy.(Assuming you have 2 computers or a friend over internet willing to help)

Load the server program on the computer that will run the game and start the server.
Then run the game on that computer and start the client part of Cheat Engine on another computer.
Make a connection with the client to the computer that runs the server. When a connection is established the Cheat Engine userinterface will show up on the client side. With that you can open the process of the game on the server and scan the memory as if you're local.

To get them, download Cheat engine 5.3 or earlier
----- SHM ---- page 15 ---- 
To create a trainer click on the advanced button and then click on the create trainer button (the one with the save file icon) or save your table with a .exe extention to get to the same screen.
In this screen you can choose to open a already existing trainer, or to create a new one. 

File patcher: This will allow you to create a trainer that will scan through your files and take out code.

Memory trainer:
With the memory trainer you can create cheats by adding cheats to the list and assigning hotkeys to them.
Also got other features like pop-up on keypress, etc...

Designer:
If the default userinterface of the trainer doesn't look good you can always try to make your own by using the option to design your own.
If activated it opens a window in which you can place controls like images, and buttons.

keys for the designer: (when a object is selected)

arrow keys:	move the object 1 pixel in that direction
shift+arrow keys:	resize the object 1 pixel in that direction
delete:		delete the selected object
ctrl+n:		go to next object
----- SHM ---- page 16 ---- 
The speedhack of cheat engine replaces some commonly used funtions in games to keep the speed constant with it's own routine that goes faster or slower.

There are 2 values you can fill in, speed and sleeptime.
Speed allows you to specify the speed you want the game to run at. (0.5=Half speed, 2=Double speed)

The sleeptime handles how accurate the speed is emulated. A higher sleeptime gives a more accurate speed, but if you make it too high, the game may become choppy. This is due to the way the speedhack works. Every few milliseconds it updates the time. And the time it waits between the updates is the sleeptime. As you can imagine, waiting a long time before uopdating the current time will result in weird/choppy behaviour, but having no wait will eat up the whole cpu leaving no time for the game, making it extremely slow.
----- SHM ---- page 17 ---- 
Auto assemble allows you to write assembler code at different locations using a script. It can be found in the memoryview part of cheat engine under extra.

There are 3 special commands you can give it, ALLOC , LABEL and FULLACCESS. With LABEL you can give a address a name by declaring it before you use it. ALLOC is basicly the same as LABEL but allocates some memory for you.
Usage: 
LABEL(labelname) //Enables the word labelname to be used as a address
ALLOC(allocname,sizeinbytes) //same as label, but allocates the memory it points to itself
DEALLOC(allocname) //Deallocates a block of memory allocated with alloc. It always gets executed last, no matter where it is positioned in the code, and only actually frees the memory when all allocations have been freed.  only usable in a script designed as cheattable. (e.g used for the disable cheat)
FULLACCESS(address,size)  //makes a memory region at the specified address and at least "size" bytes readable, writable and executable

REGISTERSYMBOL(symboname) //adds the symbol to the userdefined symbol list so cheattables and the memory browser can use that name instead of a address (The symbol has to be declared in the script when using it)
UNREGISTERSYMBOL(symbolname) //removes the symbol from the userdefined symbol list. It won't give a error if it isn't found

DEFINE(name,whatever) //Will replace all tokens with the specified name with the text of whatever
INCLUDE(filename) //includes another auto assembler file at that spot
LOADBINARY(address,filename) //will load a binary file at the specified address
CREATETHREAD(address) //Will spawn a thread in the process at the specified address
LOADLIBRARY(filename) //Will inject the specified dll into the target process
READMEM(address,size) //Will write the addresses at address at the location this instruction is placed

<b>Basic Example</b>:
00451029:
jmp 00410000
nop
nop
nop

00410000:
mov [00580120],esi
mov [esi+80],ebx
xor eax,eax
jmp 00451031

<b>Example using LABEL</b>:
label(mylabel)

00451029: