Modding | Memory Editing | PC | Works On GTA V Too |

[GhostMode1]

*Sticky Please*

What is this?
This is basically how you can edit memory, which can allow you cheat/mod many different PC games, including Website games too. Please note that SOME games will BAN you, and will contain anti-cheat systems that may detect memory editing.

Important Information
All memory is stored in bytes (essentially numbers, which then break down to binary [i.e 0011001001] is the number 201, but that's in decimal, and bytes are usually shown in Hexadecimal (0-F) so 201 in HEX = 0xC9

Number System Conversions
Decimal To Hex
Hex To Decimal

So all memory is stored in bytes, which means every single type of variable needs to be converted to and from bytes.
Some common variable types in games are:
STRING = Normal text like this
CHAR = A
INT16 (Integer 16bit) = 553
INT32 (Integer 32bit Also known as "INT") = 5642664
INT64 (Integer 64bit) = 642786582358023752
FLOAT = 32624.5747
BOOL (Short for boolean) = True or False (Also 1 or 0)

Also note the difference between 16bit, 32bit and 64bit is how much memory each can hold. INT16 bit is only 2bytes long (eg 00 02), INT32 is 4bytes long (00 02 50 01) and INT64 is 8bytes long (01 35 5F 3E 1A 10 B0)

Common Notes
If a number is a whole number, most of the time it will be Int32, for example the number of Lives you have left.
If a number is a decimal number which for example could be like the Speed which could be 315.3452362 then it will be a FLOAT
If you are searching for unlocks, most likely it will be a BOOLEAN as it can either be true (locked or unlocked depending how its programmed) and false (opposite)
The only example of an INT64 number i have found is in GTA How long the user has played, as they store the time in milliseconds. So lets say we have played for 16 days, 12 hours, 32 minutes, 32 seconds and 205 milliseconds, that would be in total;
(16 * 86400000) + (12 * 3600000) + (32 * 60000) + (32 * 1000) + 205 = 14,27,552,205 which would not be possible with Int32 as the maximum int32 number is 2,147,483,647.

Editing Tutorial
So now you know the basics, it's time to put it into practice. For this example i will use a nice easy example for the basics so i will use the game "Peggle"

Step 1: Click the top left Computer icon, and it will show you a dialog of processes, find the game you are searching for. If you are doing an internet game choose the internet browser (Sucks for Chrome as chrome as lots of processes running)


Step 2: Look for a numeric value, text etc that you want to change. (More complex searching options in spoiler)
[spoiler](More complex games you are best looking at game files for values that are not shown in game, such as player size etc. Also note the more consecutive values the less results you should find. So convert the numbers to bytes (Link then search the byte array)[/spoiler] Change the "Value Type" drop down with the type you want to search. Note
2bytes = Int16, 4bytes = Int32 and 8bytes = int64. You can search for changes in numbers by changing the scan type, but for most of the time Exact Value should be good.

Step 3: Enter the value in the textbox you want to search, then choose "First Scan" (My example searches for number of red blocks/balls [If you've never played peggle, the aim is to destroy all red blocks/balls without running out of balls and for me there is 15 left]


Step 4: If you have more than one address in the results section, alter that numerical value. Then change the value in the textbox to the new value in the game. Then press "Next Scan" (For my example i shot some so the new value is 13)


Step 5: Now if you only have one address go to Step 6, if you still have more than one address repeat Step 4 until it narrows down to 1 or a couple address (Sometime you get Mirror Addresses which mirror the original)

Step 6: Double click the address under the "Address" column, and it will now be in the bottom box. If you now double click the value in the "Value" column in the bottom box it will allow you to edit the value. if you got the right address you will see that the number changed. (For me the number of red items on the game didn't change, however it made the game think there was 0 red items left, ultimately causing the level to complete.



So i went on to find some more addresses (These are dynamic as they change every time game is restarted, for some addresses in games are dynamic, some are not)
Score = 0x6D30C14
Balls = 0x6D30C1C
Special = 0x6D30C94
Red = 0x6D30E00
Blue = 0x6D30E0C

So from this, as they are all very close we can use the first one as a Main Address, and the rest of them can be offsets from the main address;
Score = Find manually
Balls = Score + 0x8
Special = Score + 0x80
Red = Score + 0x1EC
Blue = Score + 0x1F8

Pointers
So you've found out your address is dynamic? That'll be annoying having to search for it every time you reboot the game right? So pointers are basically a static place in memory, which "point" to the dynamic address. So it stores the address you are wanting to find. So you read the number from the pointer, and that's your address

Finding Pointers
Step 1: Right click the address you found, then choose "Pointer scan for this address"


Step 2: Untick "Don't include pointers with read-only nodes" then press OK, create a new folder then save the pointer scan with a name like "1"


Step 3: Once the scan is complete it will have a huge list of possible pointers, now make sure you do NOT close cheat engine, but do restart your game (causing the dynamic address to change)


Step 4: Once you have restarted the game, find the exact same address again in cheat engine (May need to attach to process again), copy down the address, then in the pointer dialog click "Pointer Scanner" > "Rescan Memory - Removes pointers not pointing to the right address". Then enter the new address into the "Address to find:" textbox then press "OK" and name it "2"


Step 5: This should narrow down your results, now keep repeating Step4 until the results are either only a few (Less than 5), or the pointercount is not changing. Now you want to double click one that has your game name + address, so for example with mine its "Peggle.exe"+00250174, double click it in the Pointer scan view, then it should appear in the main section at the bottom of the main Cheat Engine form, now double click the pointer address and a dialog should appear.


Step 6: So i will explain this step with the above image, this pointer has 5 pointers to get to the final step.
So this is in steps
Address1 = Read Number ("Peggle.exe"+00250174)
Address2 = Read Number (Address 1 + 58)
Address3 = Read Number (Address 2 + 88)
Address4 = Read Number (Address 3 + 8)
Address5 = Read Number (Address 4 + 154)
MainAddress = Read Number(Address 5) THEN + 174

Credit to Eddie (son-of-a-beach) For the idea

[hiimachicken1]

This doesnt teach you how to put this into a c++ project

[Khyy]

Awesome guide man, i'm sure this is going to help a lot of people who's experience is only search for a value once > change all records. Now they'll find the static addresses.