Announcement

Collapse
No announcement yet.

How to hack PC games using Tsearch

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • How to hack PC games using Tsearch

    First of all let’s take a look at TSearch. On the main screen there are some buttons and one of them is "open process"



    If you go there you will see all of the programs that are open. So let’s play The Witcher, start a new game. Press Alt and Tab so you can go to the desktop. Go to TSearch and press the “open process” button. You will see "Witcher.exe", left click it and press open.

    Now below the "open process" button there are other buttons. One of them is called "Init new search".



    Press this one (you can’t press the other ones anyway).

    Now I’m going to explain what all these options are…

    "Exact value" is used when you know the value you’re looking for (i.e. you have 20 White Myrtle petals).

    "Range" is used when you know the value is between two numbers (i.e. you have 1-2 lives but you don’t really know).

    "Unknown value" is used when you don’t know the value you’re looking for (it’s used for energy bars mostly).

    Now I bet you’re wondering what all these bytes are.

    "1 byte" is used when the value can be between 0-255.

    "2 bytes" is used when the value can be between 0-65535.

    "4 bytes" is used when the value can be between 0-4294967295.

    "8 bytes" is used when the value can be between 0-18446744073709551615.

    "Float" is used when the value can be between 1.2E-38-3.4E38, it’s used for games like Zoo Tycoon and Age Of Empires.

    "Double" is used when the value can be between 2.2E-308-1.8E308.

    Now that I explained that we can continue.

    We’re still on TSearch and we’re ready to search the memory for 999 of any herb in your inventory.

    We’re going to use "exact value".

    Collect at least 10 White Myrtle Petals.

    Then open your inventory.

    While your inventory window is still open, press Alt then Tab to leave the game and go back to Tsearch.

    Put 10 on the value box and "2 bytes" on the type box.

    There are going to be many addresses so we have to do it again, so click ok.

    Go back in the game and press Ctrl and left-click on your mouse while on the White Myrtle petals.this will give you 9 petals.

    Now go back to TSearch and press the "search next" button that is next to "init new search".

    The only thing you have to do is change is the value to 9.

    If there are still many addresses then you have to do it again until you have four to eight addresses.

    Once you find the addresses (could be one which is better but it’ll most likely be more in this case) double click on the first one so that it’ll "transfer" to the table on the right and change the value to whatever you want (up to 999).

    Go back in the game and see if your White Myrtle Petals changed to the number you put on TSearch.

    If it didn’t change, go back to TSearch delete the address you changed by selecting it and pressing the "X" button and transfer the second address to the table.

    Repeat the process until you find the right one. Save your game and repeat for your next herb or ingredient.
    The Hackmaster

  • #2
    Nice tut. I haven't used Tsearch since Cheat Engine was released. I have a guide I wrote a long time ago to convert DMA addresses to Static. I might look around and post it here.
    Last edited by Abystus; 06-14-2011, 11:44:56 AM.
    Not taking any requests at this time.

    Bored? Watch some of my hacks here.

    Comment


    • #3
      Please do. Cheat Engine tends to be a little complicated, I could use all the help that I can get with that tool.
      The Hackmaster

      Comment


      • #4
        Yes. We need as many PC game hacking guides as possible.
        I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

        Comment


        • #5
          Here you go. My name was Epic_Cataclysm back then and this was a port of a SoftIce tutorial to Tsearch.

          TSearch DMA Tutorial
          ASM Game Hacking Explained
          ------------------------------------------------------------+
          Subject: Code Injection - DMA To Static address with Tsearch
          Tools Needed: Tsearch 1.6 or higher
          Game Needed: Grand Theft Auto: Vice City
          User Knowledge Needed: Basic Asm, Tsearch Functions
          Tutorial Difficulty Level: Advanced
          Written By: Epic Cataclysm
          Based on: [Sheep]'s Tutorials for Softice
          ------------------------------------------------------------+
          Time to rewrite one of [Sheep]'s tutorials for those of us who can't seem to fire up the old softice debugger for some reason or another. For those who can, well you are some of the lucky. I however have a radeon 9800, and softice didn't like that. So i have turned to Tsearch which seems to be neck and neck with softice in my opinion. Plus you dont have to worry about games protecting against softice when you are using Tsearch to hack everything that you need. In this tutorial, we are going to hack a vital code for Grand Theft Auto: Vice City. This code is Infinite Health.

          ------------------------+
          Find the Initial Address:
          ------------------------+
          Start a new game and make sure that your health is at 100 %. Next use Tsearch to search for a known value of 17096. Go back into the game and loose a bit of health. Alt+tab the game and do a search for "Value Has Decreased". Repeat this a few times until you come up with an address that works. *Note* Your address will not be the same as mine because of DMA.

          ----------------------+
          Time to get Around DMA:
          ----------------------+
          My address is A02DDE6. This is a DMA address and is not static. We need to set a breakpoint for read/write on this address to see what is reading and writing to this address. In Tsearch go to the menu "AutoHack" and choose "Enable Debugger". Next go to menu "AutoHack" and choose "AutoHack Window" to show the AutoHack window. Next go to menu "Edit" and choose "Set BreakPoint". A new screen will come up asking your for the address to set the breakpoint on, how many bytes, and the type of breakpoint. Enter your address that you found above, leave the byte settings like they are, and then choose "Read/Write" from the breakpoint list. Click "Set" to set the breakpoint for read/write on your address. REturn to the game and run around for a sec or so, then alt+tab and check autohack window. Notice all the offset addresses from your DMA address.

          For Vice City the decreaser address affects everyone in the game, and not just you. Meaning that if you lock it then everyone in the game becomes immortal when you do. If you would have just set a write breakpoint you would have gotten just the pointer address that decreases everyones health, which is useless to us.

          These are the offsets that you should see in the autohack window:

          501973: fld dword ptr [ecx+0x354]
          505CEA: fld dword ptr [ebx+0x354]
          50A66B: fld dword ptr [ebx+0x354]
          509FBB: fld dword ptr [ebx+0x354]
          50F3A6: fld dword ptr [eax+0x354]
          558A9D: fld dword ptr [eax+0x354]
          558B41: fld dword ptr [eax+0x354]
          5D30BC: fld dword ptr [ebp+0x354]
          5267C0: fld dword ptr [ebx+0x354]
          5267DE: fld dword ptr [ebx+0x354]
          5267E8: fstp dword ptr [ebx+0x354]
          5D3ABF: fld dword ptr [ebp+0x354]

          Next we must set a BPX, or break on execution, on each of these addresses so that that we can see if they return a value. To do this, we take each address (example 501973) and go to menu "Edit" in the autohack window and choose "Disassemble", and enter your address. Choose the Disassembler tab from the bottom and you will see your address listed at the top. Right click your address from the list and choose "Register". Go to the register tab and you will see your address has been set for a Break on execute. Next look at the register that goes along with the address ([ecx+0x354] EAX in 501973's case), and choose it from the register list. Next click the box to the left of your address to enable the break and return to the game. Run around for a sec or so and alt+tab the game. If your address returns any value other than 0 and doesn't fluctuate in value then write the address down in notepad. Continue through all the values above until you have a list of working addresses.

          My addresses are:

          501973 fld dword ptr [ecx+0x354]
          505CEA fld dword ptr [ebx+0x354]
          50A66B fld dword ptr [ebx+0x354]
          509FBB fld dword ptr [ebx+0x354]
          558A9D fld dword ptr [eax+0x354]
          558B41 fld dword ptr [eax+0x354]

          All of the addresses above should have returned the same value. That value that they returned is an address in itself (remember, these are pointers to an address that holds a value of your life).

          Ok, now gain some life to get your health % back to 100. Then take the value/address returned by the pointers above

          Take the value of one of the pointers listed above and replace the original address you hacked (DMA address) with the value + 354h (example A01F331h + 354h = A01F685h). The reason we added 354h is because the pointer told us to add 354h to the register value. The value of that address that you just inserted will automatically change to a your health value. You address should return 1120403456 which is full health. Notice that in this game is it different from its counterpart value 17096 (DMA Address, Value).

          ----------------------+
          Building Our Code Cave:
          ----------------------+
          First thing we need to do is convert the value returned by the register value + 354h which is 1119754650 and convert it to hex which is 42C80000h. Next we will start building a code cave structure so that we can test our pointers above.

          Memory in most games gets allocated from 0x10000, is used till 10950.., and then thereafter is empty space. So I am choosing 0x10bb0 to write my code cave to.

          Ok, so we are ready to write some asm code now. Open the easywrite window by clicking the icon. Choose a new project and give that project a name (example "infinite health"). Next, write the following into the upper text area. Then press the "check" button to make sure everything is ok. Finally, press "OK" to save it.

          offset 0x10bb0 <--- Address of our code cave
          mov dword ptr [eax+0x354],0x42C80000 <--- Write max health into our health pointer
          fld dword ptr [eax+0x354] <--- Reconstruct original instruction
          jmp 0x501979 <--- Jump Back to original routine
          offset 0x501973 <--- Address of our gateway
          jmp 0x10bb0 <--- Jumps to our code cave
          nop <--- Balance the instruction

          To make the asm that we just wrote run, we need to check the little box to the left of "infinite health" (or whatever you've titled it), and return to the game to see if it worked. We are using the first pointer address 501973 in the above code cave. This code will write 42C80000h (1120403456) to each address you set it up with. Go through and test each pointer this way by replacing the pointer address 501973 and next address in line 501979 with a new address from above and the following address in line after it. To get the next address in line after your pointer address just go to the autohack window, choose "Disassemble", type your address in and then choose "Disassembler" tab from the bottom and look to see what address follows.

          Through trial and error of 6 pointers you will find that the pointer of choice would be 558B41 fld dword ptr [eax+0x354]. It is the only one of the above codes that makes you invincible and everyone else mortal. So our code cave should look as follows:

          offset 0x10bb0
          mov dword ptr [eax+0x354],0x42C80000
          fld dword ptr [eax+0x354]
          jmp 0x558B47
          offset 0x558B41
          jmp 0x10bb0
          nop

          To set the instruction of your address back to normal enter the asm below into the bottom text area, press "check" to make sure it is error free, and then "Ok" to accept. This sets the offset back to its normal instruction set (Letting you become mortal again).

          offset 0x558B41
          fld dword ptr [eax+0x354]

          -------------------------------------+
          Converting Code Cave to TMK addresses:
          -------------------------------------+
          To get the addresses to poke in TMK from the asm code we just created, in the easywrite window press the "TMK" button, then the "Check" button to reveal what you should put in TMK to get your code cave to work in a trainer.

          Your converted code should look like:

          Our Code Cave:

          Poke 400E00 C7 80 54 03 00 00 00 00 C8 42 D9
          Poke 400E0B 80 54 03 00 00 E9 32 7D 15 00
          Poke 558B41 E9 BA 82 EA FF 90

          Set Address Back to Original Instruction Set:

          Poke 558B41 D9 80 54 03 00 00

          ---------------------------------+
          Special thanks to all that helped:
          ---------------------------------+
          [Sheep], Sain, Fahrenheit and anyone else that I am forgetting to mention.

          No order, just great people...
          Last edited by Abystus; 06-14-2011, 11:55:42 AM.
          Not taking any requests at this time.

          Bored? Watch some of my hacks here.

          Comment


          • #6
            Cool; I'll add it to the Library. Shall I change the credit to Abystus?
            I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

            Comment


            • #7
              You can change the credit if you like. It's a heavily outdated tutorial but it should be of some use to someone as it still uses the basic principles.
              Not taking any requests at this time.

              Bored? Watch some of my hacks here.

              Comment


              • #8
                Done; thanks
                I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                Comment


                • #9
                  Thanks, this is just what I needed!
                  The Hackmaster

                  Comment


                  • #10
                    I've added your guide to the Library as well, dlevere. Thanks.
                    I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                    Comment


                    • #11
                      Mi!!!finally;3
                      It will take of ages to understand whole thinks!!!
                      But thanks
                      I found some hope;3
                      Many thanks dood!!!!
                      Tsearch source pleasse????!!!!
                      Last edited by olala; 03-06-2013, 02:40:43 PM. Reason: i forgot somethin important lol;)
                      dood! im a uniter, not a divider dood

                      Comment


                      • #12
                        TSearch
                        The Hackmaster

                        Comment


                        • #13
                          I used Tsearch so many years ago to hack SegaCD codes but I never knew it had a debugger, you learn something everyday.
                          Spoiler Alert! Click to view...

                          THE BAD GUY!!!!!!

                          Comment

                          Working...
                          X