UnReal World forums

UnReal World => Modding => Topic started by: Night on December 04, 2019, 12:07:30 PM

Title: [Guide] Modding with Cheat Engine
Post by: Night on December 04, 2019, 12:07:30 PM
Hello all, this is going to be a guide on modifying the game with cheat engine, its a pretty common guide found among other games but I figured I'd give my go at it for URW seeing as there isn't much activity in regards to finding new addresses for the game, maybe we can spark up someones imagination! We'll be nose diving straight into it so make sure you've got your head ready for the use of good'ol numbers (yuck!) and the motivation to imagine what treasures hide within :).

note: this guide based on Windows, Linux and ios users experience may differ.

The Guide:

~ removed table of contents, anchors were buggy.

Setting up Cheat Engine:

Step 1: Required files
Make sure you have the required files installed and administrative permission, essential to completing this guide successfully:
note: You can choose to use another memory editor, there are many other options available aside from cheat engine, but in this guide I will be using cheat engine, features in cheat engine may or may not exist in alternatives, I will be using Cheat engine v6.7, most versions are identical but if you have any issues following along, post below.

Step 2: Run
If you haven't done so already after acquiring the required files, run both the game and cheat engine with administrative privileges
(we don't want annoying permission troubles)

This is what your screen should look like: (resize cheat engine to be comfortable)
Spoiler: Image 1 • show

Step 3: Select target
Now that we have both programs open, we need to select what program cheat engine is targeting. This applies for any program you are attempting to modify with cheat engine.

Directions for the labeled figures in the image below:
Spoiler: Image 2 • show

If you followed the instructions correctly, cheat engine should be attached to the game and we are ready to start using it.
This is what you should see on cheat engine to indicate you have attached to a process: (the handle, 000021FC, is run-time dependent and will not be identical)
Spoiler: Image 3 • show

Using Cheat Engine:

Step 1: Understanding what the tool does
It's important to understand what exactly you're looking at when you use this tool, so I'm going to try to give you a short description over each feature we will be using and its function. I am not a grandmaster when it comes to this stuff, so there are many advanced features I have no qualification in covering, we won't be going over these, but there are many powerful features that can improve and speed up the process of using cheat engine successfully.
This is pretty much the bare minimum understanding required to use Cheat Engine, so if you have any questions or trouble, now is the time to make a post below and ask.

Step 2: Finding a target
This is where the fun of imagination begins, deciding what we want to edit and figuring out what the representation of what we're trying to edit in the data is going to be. There are many many many potential target addresses across all applications, in video games, we mostly target values that are going to allow some sort of unnatural advantage or effect to create a sense of satisfaction we could not obtain normally, some prime examples include health, currency and resources, attack damage, points. It's important to remember, that not all values you're attempting to look for will be in plain sight, some values you will need to make a hypothesis and filtration method to find effectively. The diagram below will show some potential targets I have indicated, we will be targeting one in particular.
Spoiler: show
I have indicated several nice targets, some are obvious such as hunger, thirst, warmth, and energy, others like what item you're wielding, the location of that rock near my character, the direction I'm facing, may be less obvious and hard to grasp numerically, but if you can hypothesis what the data for these addresses might be, you are likely to find the address you are looking for. I have indicated the target address we'll be looking for with a green arrow and box, Time of day

To begin with the process of finding this address, we need to consider all possible values that could encompass what "time of day" represents in the data, this means we need knowledge of the concept of time itself, (seconds, minutes, hours, days, months, years) and we need to hypothesize what the game is most likely doing with the data (does the game have 1 address for total elapsed seconds and then coverts it with math to its date representation? does the game have multiple addresses representing seconds, minutes, hours, days? does the game "skip" sections of time?) a hypothesize that can filter through as many of these potential options as possible will allow you to get the best results, for example, we may not know how the game has setup the time system, but we do know that we can increase the amount of time passed by making our character wait, and therefor create a filtration method that will eventually leave us with the address and data responsible for controlling time, once we have this address we can infer how the code uses it in relation to its display data.

So to begin the search, we'll be searching for a value over 0 (time is moving forward, negative value unlikely) albeit currently unknown, and we're going to search for a type of byte (value between 0 and 255) since it is likely the game will be increasing the data in small amounts as time progresses, this will give us addresses that are increasing even if their data representation is larger than a byte, allowing us to also determine if the address we're looking for is a larger type than a byte. This is what your first scan should look like:
Spoiler: show
After completing your first scan, we need to modify the game time address so we can apply a filtration method to the address list, so alt tab back into your game and pass time with the - key for only as much as necessary to indicate to you that time has definitely passed, then pause the game again and alt tab back to cheat engine. Your next scan is going to be a search for an increased value, as time has almost definitely increased in value (we're not sure how much) This should look like this: (Make sure to use NEXT SCAN, not new scan when filtering)
Spoiler: show
Once you complete this first filter, you're going to see a list of addresses with values on the left side, some of them are changing and highlighted red. This is an indication that the particular address that is changing, does not have any correlation between the address we're looking for and its value, as we have not passed any time since our previous scan, our address should have an Unchanged value, so in cheat engine we're going to filter out the addresses that have had their values changed by doing this:
Spoiler: show
This is going to filter our list of addresses unrelated to what we're looking for, so now we need to let time pass some more to indicate an increase in the value, allowing us to filter for such an increase again:
Spoiler: show
with each effective filter, you're going to notice the amount of addresses found decreasing in the top right, we need to keep filtering until we can get the amount of addresses we're looking at as low as possible, as this will give us the best chance to identify our target address. It is important to make sure when filtering you are following a pattern with the expected data you are trying to locate, one wrong filter can easily remove the address you're looking for from the list you're filtering, resulting in frustration. Continue filtering until you reach a small list:
Spoiler: show
When your filters stop removing addresses, its time to take a look at the addresses and data and try to interpret what you're looking at. In my case, I have filtered the addresses to a list of 54 addresses, just by looking at the list and thinking about what kind of address we're trying to find, we can eliminate some of these addresses through the process of representational likely-hood, and by this I mean do the addresses and values I'm looking at make any sense in relation to a system of time? Thinking through this I can already figure there's probably not 54 addresses that determine time, maybe closer to 4 or 5 at max? How do we know which of the addresses we should eliminate from the list? There are a variety of "probability" methods we can employ, so the first thing we're gonna do is move all the addresses with green text in the search listbox to the editing list box so we can see what we're doing easier (green addresses aren't runtime dependant and will not change, and are the ones we will be using):
Spoiler: show
From my particular group of found addresses, I have noticed about 20~ of them with the same value and roughly in the same area of memory, these are not likely to contain the address I'm looking for, so I remove them from the list and am now left with the remaining addresses to experiment with:
Spoiler: show
There are indications that some of these addresses are related to some sort of variable, the addresses i have boxed are very close together in memory, and are seperated by 4 bytes (basically neighbors), likely meaning the value they represent is actually 4 bytes and not 1, we will be changing the address type to 4 bytes to further observe the data between these groups of addresses as they indicate the maximum value to be higher than 1 byte, there are also two addresses relatively close to these addresses i have marked with arrows, they could be related but its less likely (notice this is all guess work, this is the process of documenting addresses from memory from scratch). Now that I have an extremely small list of addresses to work with, we can watch the values change in real time and effectively make guesses. So what you're going to do is make sure you have cheat engine and your game setup like so:
Spoiler: show
When you pass time in the game, you're going to see the values of your addresses change in cheat engine, these are the addresses we are most interested in testing, as any value that is not changing while time is passing is probably not the address in control of time. I delete all addresses that aren't changing as time is passing and am left with the following:
Spoiler: show
Title: Re: [Guide] Modding with Cheat Engine
Post by: Night on December 04, 2019, 12:07:53 PM
Using Cheat Engine: (Continued)

Step 3: Confirming your target

Now that I have a reasonable amount of addresses to test for actual effects with, I want to document these addresses in a separate file offhand so I don't lose them in the event I give the game invalid data to work with and cause a crash, so double click the address and copy the information to a notepad so you can add the address back manually, or even save the cheat table so you can load them again. Green addresses have the following format: urw.exe+A2EC404 where urw.exe represents the games base handle (runtime dependant), and A2EC404 represents the offset of the address, this equates to B2AC404 when combined together.

After backing up my addresses, I am now ready to effectively modify them and see what they actually represent in the game. To do this, I need to effectively represent the numerical value of the address to a direct result on the game. A good way to easily test values that change over time, is to simply freeze them and record if they change over time, if they do not, chances are you are freezing the variable that effects that aspect of the game... I freeze all four of my addresses and pass time twice for a total of 8 hours, the indicator I was originally searching for does not change (Early evening, wait 8 hours, still Early evening, you also notice the sun graphics in the top left stuttering and lacking movement), almost definitely meaning one of the four addresses I have frozen controls the time of day. So now that we know we have the address, its important to document what the values represent for that address so we can effectively use it to our will. To begin, we're going to isolate the time of day address to one single address, by changing each address to different value and refreshing the game by passing time, I should be able to determine which of the four addresses directly edits time.

I have Isolated the time of day offset to 0B2AC4B5, as it is the only address I am editing and having a direct impact on the time of day, I however notice strange effects when editing this address making it act irregular to what you'd expect the data to do. This generally means you are looking at the right spot, but are interpreting the data wrong. In my case, our search results yielded the address for the "minute" address, meaning 0B2AC4B5 determines the minute of the hour, representing a value of 0-60 (you can watch the address cycle from 1-60 when passing time and resetting). Knowing this is what the address is, and that time is stored in this fashion in the game (each representation of time has an address) I can now predict what addresses such as "day", "hour", and "month" will represent value wise for a particular address. Meaning we can use exact numbers in our filtration methods in relation to the data, for example, if we wanted to search for the address that contains our month, we would be looking for a value between 0-12 (sometimes code will use 0 as an index representation). We can also assume that the Hour of the day address, is a value between 0-24, finding this address will be easier because we can now set the minute of the hour address to 59, pass a tiny bit of time, and filter for an increase in the hour value when the minute value resets, as that would indicate the hour has passed. We can repeat this process until we have every address for determining the current world time, using minutes to get the address for hours, hours to get the address for current day, days to determine the passing of the month, and then using the passing of months to find an address that indicates the year. Once you have each of these addresses, you will be able to essentially control anything that relies on time. This includes the weather/season based on month, daylight/night based on hour (also has an effect on animal activity), plant growth / hide working times can effectively be "skipped" by adding time to the current world time.

Concluding notes:

This is effectively, the basis for finding addresses and modifying the games memory. there are many techniques that I did not cover in this guide that can be helpful in finding and documenting addresses, but this effectively covers the basics of what you need to know in order to produce any kind of modification. The address I decided to target wasn't a particularly easy one to search for, but I think it gives you a good amount of perspective on the type of thinking required in order to get the results you're looking for, especially for addresses that aren't self evident (like stats that show you the actual number so you can just do an exact value filter) For getting a feel of using cheat engine, I would recommend searching for values you can actually see so you're not using abstract thinking to effectively predict what the value is going to be.

If you're having trouble following this guide or are simply stuck, feel free to reply to the thread and ask questions or PM me directly, I can also provide much easier examples for people to find if they get lost. Hopefully you or someone else reading this thread finds educational value, if not at least a good read on how I find modifications to use.