Code Searches

Using Trainers

Trainers come in various forms and are called different things (code generator, code searcher, etc). They may vary in look and features, but they all function the same way. They "dump" the memory from a game and search for values in it. Most trainers save this dump temporarily for making relative comparisons (greater/less/equal/different) at different points in the game. The idea being to change something in the game and compare the new memory to the old, in order to find which locations in memory have changed each time. This allows the hacker to find the address in memory of something, whether it be lives, health, or removing Lara Croft's underwear on Tomb Raider.

Typical Search Options

- Initial Dump / Start Search - This grabs the current memory for comparing to after causing something to change.
- Known Value - Searches for a user entered value
- Greater Than - Find values that have increased.
- Less Than - Find values that have decreased.
- Different To / Not Equal To - Find values that have changed.
- Equal To - Find values that are the same.
- In-Range - Find any value within a certain range (like between 1 and 10).
- An Example Search For a Health Bar
- Get to the point in the game where health is actually displayed.
- Start Search (Initial Dump)
- Get back in the game and lose health.
- Search for values that are Less Than.
- Go back to the game and lose health again.
- Search Less Than again.
- If health is gained by pickups or something, pick one up, and search Greater Than.
- Repeat this until the number of results shown by the trainer is reasonably small.
Sometimes it will narrow all the way to 1 result, but don't count on it.
- Test the result(s) until one effects health.

Known Value Searches

A known value search is the most basic search that there is. It is used to search for things that you know the exact value of, generally something displayed onscreen, such as a score or number of lives. It's worth keeping in mind that the on-screen value is not necessarily the value that is stored in memory. It is not uncommon for the value to be stored in memory with one added or subtracted to it. Additionally, the value may be stored as a BCD or float values instead of a normal hexadecimal number. If searching for known values is not successful, unknown value searches may be necessary to find the code.

Unknown Value Searches

For use when the user doesn't know the exact value to search for, like timers, and health bars. Unknown value searches consist of comparing memory dumps in relation to how the target has changed. If health/time decreases, search "Less Than." If it increases, search "Greater than." Examples of such comparison search options include: Greater Than, Less Than, Different To, and Equal To.

Signed Searches

Some trainers allow signed searching by sign-extending values being compared, just as the game would sign them for doing things. This allows for finding things that would might be handled by a game as negative values. With a regular 32-bit search, for example, 0xFFFFFFE0 would be greater than 0x42C80000. However, if these were compared as signed, 0x42C80000 would be greater because 0xFFFFFFE0 is read as negative 0x20 (-32).

Games use signed values for anything from acceleration to coordinates. For example, acceleration might be stored by a game as a negative value while driving in reverse because that's how vectors are stored.

The direction is like the most significant bit, so looking at them signed makes them easy to search for. There are also times when games display a negative number for something on the screen as well.

Tutorail made by: Unknown
Website: http://www.bsfree.org/
Tutorail posted by: MF Tlaxcala