jesseemond/cheat-and-gin

C++ cheat engine (memory scanner)

Cheat Engine (Memory Scanner)

cheat-and-gin is a program that you can use to modify the memory of another process while it is running.

Such a program is popular for hacking games that are running locally, but I build one to get familiar with the particularities of modifying a program's memory under Window and Linux for learning purposes.

Examples

Minecraft

Here's an example where we give ourselves 999 dirt blocks by using an old version of the cheat engine (the 999 blocks could actually be placed!):

Now all you have to do is find 1 diamond to actually find 999...

I don't actually encourage cheating in Minecraft. This is more of an interesting real test for a cheat engine... Please don't use this in multiplayer.

Python REPL

Here's an example where we modify the value of a string variable in a python REPL interprer. We can do the same with integers, for example.

How?!

A description of how a cheat engine works (and what platform functions are used) is provided in the CheatEngine's README.

Building

I use premake4 for build configuration. You can find a download link on premake's website.

Windows

To create a Visual Studio solution, use:

premake4 vs2017

You can then build in the solution.

Linux

To create a GNU Makefile and compile, run:

premake4 gmake
cd build
make

Cheating

Our Target

There is a provided program named FakeGame which shows some fake game parameters (health, mana, gold, ...) which change every time a newline is entered along with their associated addresses:

> ./FakeGame/bin/FakeGame
health(4): 100 - 0x7ffcb173c07c
mana(4): 100 - 0x7ffcb173c078
gold(1):   - 0x7ffcb173c077
miles(2): 5 - 0x7ffcb173c074
rate(4): 0.1 - 0x7ffcb173c070
science(8): 0.1 - 0x7ffcb173c068

Our Attack

We can then start our cheat engine and specify the name of the process that we want to attack. Note that we're playing with another process' memory, so we need extra rights. I am doing so by running with sudo here:

> sudo ./CheatEngine/bin/CheatEngine
Process name: FakeGame

We enter FakeGame and we are then prompted to know the size of the variable that we want to modify:

What is the type of the searched value?
A) unsigned byte
B) character
C) 16-bit integer
D) 32-bit integer
E) 64-bit integer
F) float
G) double
H) string
Value type: D

Say that we want to modify the health (4 bytes), we enter the choice of 32-bit integer.

We are then asked for the current value of the target variable:

Value for 32-bit integer: 100

We enter the observed 100. We are told that multiple addresses hold our value:

10 memory address(es) containing the value.
Keep searching? (y/n): y

We want to pin down our address, so we'll update our game (newline in our FakeGame process) and keep searching with the updated value. Let's start by updating the game:

health(4): 99 - 0x7ffd647d71ac
mana(4): 98 - 0x7ffd647d71a8
gold(1): ! - 0x7ffd647d71a7
miles(2): 15 - 0x7ffd647d71a4
rate(4): 0.3 - 0x7ffd647d71a0
science(8): 0.103 - 0x7ffd647d7198

We can then enter the updated value (99):

Value for 32-bit integer: 99

Set a new value:

What value should the new address(es) have?
Value for 32-bit integer: 424242
Value(s) modified.

Finally, we can admire the results of our cheat by updating the FakeGame:

health(4): 424241 - 0x7ffd3d5b7c5c
mana(4): 96 - 0x7ffd3d5b7c58
(...)

Running Tests

./CheatEngine/tests/bin/Tests

cheat-and-gin's Issues

Clean code that searches for matching values within memory chunks

First, common code that goes through a chunk of memory and searches for a specific value should be refactored to be reused on windows/linux.

Second, it would be much cleaner to have a vector of bytes for the chunk of memory and std::search with a vector of bytes representing the value.

Test on Minecraft

And add images on the README.

Can't find addresses on notepad memory

1. open notepad.exe
2. type "a" in notepad
3. search for byte "a"
4. no values found

Page where the value is doesn't fit the current criteria? What is going on here?

Unit tests

just some a basic UTs setup for now:

• find a value from a memory block
• extract good offsets from a linux memory map file line

Question regarding Source Code Explanation

Hello Jesse,
First of all, thank you for sharing your work with us.

I just wanted to know that where did you do implementation of pure virtual functions like readPage(), getChetablePages() etc.

Show "Keep searching?" options

Not obvious what we're supposed to enter here. y/n? 1/0?

Would be nice to have [Y]/n (default option).

& update docs

FakeGame: start gold at printable char

and update docs

rewrite cheat-and-gin using golang

Is it difficult to realize this idea?

Create classes for platform-specific operations

Will isolate the communication with the OS and will allow to easily test the app logic through mocking.

Make console choices with letters instead of numbers

The choice menu:

1 - byte(1)
2 - word(2)
3 - dword(4)
4 - qword(8)
5 - float(4)
6 - double(8)

is a bit confusing with numbers. Might be better with A, B, C, ...

Should also update documentation.

Clean includes

See CheatEngine.cpp

Show total potential addresses

Instead of only the # of memory pages

& update docs

Memory page count typo

memory pag(es) should be memory page(s).

& update docs

Try with sublime text / notepad++

Test the string search there.

A question about cheat-and-gin source code

Hello Jesse,
First of all, thank you for sharing your work with us.

I am having trouble with something in helper.h file ; in 44 line that is

template
using Reader = std::function<std::istream&(std::istream&, T&)>;

while (!read(std::cin, t) || !validate(t))

I understood that t is loaded by user input via console in Reader function, however i want to bind t with string via programmatically like t= Soccer ... How can I do that? Thank you for your help...

Integration test

Create a test program that exits when a certain variable reaches a certain value, interact with the CheatEngine to attach to that program and change the value to the desired one.

Would probably need unit tests for the cin/cout interaction before doing that though.

Linux support

Refactor value matches outside of CheatEngine

I think it would be cleaner if we had a class that takes care of holding the "state" of the cheat. This way, we could refactor CheatEngine to be relatively stateless:

auto matches = engine.search(value);
// ...
matches = engine.narrowDown(value, matches);

Clean value_t code

How about a polymorphic ValueType class? It would make the implementation of #4 easier and less distinct from the normal integer types.

CheatEngine unit tests

Should be done after #24 to have cleaner tests.

Document how a CheatEngine works in CheatEngine/README.md

and point to it from main README

Crash when running on big applications

Happened when trying it with Minecraft. Doesn't look like it's easily reproduce-able. Finding out what the error is would be the first step... Next, it might be good to understand the conditions that lead to the crash and make a program that reproduces it.

Fix Windows version

Need to properly test on windows as I fully expect to break it through refactoring without Windows CI running.

Support strings with spaces

We should be able to search for this is a test. The problem here is that we are asking the std::string via std::cin >>. We should use getline for a String ValueType.

Stop searching when there is only one address left

& update docs

Pages with calls to ReadProcessMemory that partially fail are ignored

Might be the cause for some values that are not found while testing in Minecraft.

Solution: store the bytesRead and only work with that (updating the memory block).

unknown value

i doing my own cheat engine scanner i do the first scan but i do not know how can i get unknown value,
i tried to get all values for ex 8 bit value in all regoins but it take along time in cheat engine it did not take 1 second
so what is the idea of unknown value ??

Change README.md

Give build instructions for premake.

String search

Could be interesting to add the "string" value type to search. Would read an std::string and search for the sequence of characters (excluding the null terminator).

how to use cgo to write cheat engine code

Add check on new value size

We should verify that a write does not cross a page's boundary with the provided new value size. We are currently okay because our values are fixed size, but it would be better to check that when the user enters a new value.

Error handling via exceptions

Many cases where we just use std::cerr and exit(1). It would be better to bubble up via custom exceptions in these cases. Let the main application take care of the error messages.