Cheat Engine 6.4 Tutorial Part 9: Array of Byte (AOB) Scans Demystified! [HuniePop]

[@StephenChapman]

*Click here to browse ALL of my Cheat Engine tutorial series (45+ videos and counting):* kzbin.info/aero/PLNffuWEygffbbT9Vz-Y1NXQxv2m6mrmHr

[@eletronnical1957]

I don't understand nothing

[@cloudstellar5157]

i have a question. how do u create an aob script that works after a restart

[@mattbeach6918]

I'm very surprised these videos don't have more views/likes. These are awesome and in depth. I'm going to make sure CE forums knows about these videos because I'm POSITIVE these would do wonders for newbs, like me, on there.

[@StephenChapman]

Matt Eason Hey, thanks! I'm just glad people out there are finding them useful! I actually have these posted in a thread on the CE forums; my nickname there is h3x1c. =)

[@mattirwin4337]

I know right, I think I've linked this tut for questions more then the number of likes.

[@kilkenny6745]

You actually taught me more about registers, addresses and whatnot compared to my professors. And this is through Cheat Engine XD. I really appreciate it

[@Joefish90]

I just wanted to look up an explanation for multi pointers in CE but ended up binge watching most of the playlist. Love the hands on approach and that you focus on the task at hand and don't get stuck in e.g. teaching assembly that stretches over 100 episodes with tidbits inbetween.

[@ragman150]

It just had to crash just as we're getting to the good part.

[@adeshpoz1167]

Frank Wier yeah. 😂😂😂😂

[@TheForgottenOnestm]

GREAT TUTORIAL! I can honestly say all the videos out there hasn't caught my understanding involving instructions being this much into depth. Thank you.

[@PASTRAMIKick]

I knew that Computer Organization and Assembly Language class I took wasn't useless, I understand everything, all the types of jumps, memory addressing modes for 8086/x86. Knowing assembly language is surprisingly useful.

[@s.t.d.r.a.s.h.3703]

You explained it perfectly, I'm just learning this too, new by 2 days but I want to be a pro at code writing so, I'm really enjoying what your teaching, even though sometimes I feel your speaking in Chinese (ebx+difficult 4 me) I'm am learning slowly because your very patient in your teaching.

[@s.t.d.r.a.s.h.3703]

I'm = X

[@SKU11KRUSH3R]

Your tutorials are amazing. I never understood how scripts worked or how to find the injection point just from the CE forums but this cleared everything up! Thank you so much!

[@taceddinsancak]

Even it was 7 years ago, great stuff.

[@jimchrist-x]

This series still rocks

[@lawzinhoO]

YEAH, I'm very proud of being in programming, codes an computing is one of the most beautiful things I have ever seen

[@MausomePossum]

Your a fantastic teacher, i appreciate all the work you put into these videos so much man. I know theyre old but still. Thanks for being awesome. Ive learned a lot from this series and plan to continue :)

[@ametalon5053]

Same thing, I'm enjoying this series too and I wanted to like this video but it's at 666 likes right now and I don't want to spoil it :) Thank you, Stephen!

[@not-lain]

"let me know if you want me to cover stuff up " bro i want you to uncover stuff hhhh

[@MsJavaWolf]

I always thought CE was a pretty simple tool and only useful for beginners, but it actualy has some good features. I write 3rd party tools, and will need to use my own injector, but CE seems very cool for early testing. Thanks for the tutorials.

[@glennwatts6809]

Stephen, this was very well explained and an outstanding tutorial. Great job!

[@StephenChapman]

Glenn Watts Thanks for watching, Glenn; I'm glad you found it useful!

[@firebirdss80]

So much help i have needed thanks for all this information you have shared.

[@StephenChapman]

Glad you found it helpful!

[@JeanCarloz1]

You are an awesome teacher, these videos are gold, subscribed.

[@pmgvictor4625]

I knew scripting and coding has a lot of labeling and commands but it is like a puzzle that jmp-s around. It is not as complicated as I thought it would be but that's with the Cheat Engine that helps you out. Having to do this from scratch and making the codes for it would be difficult.

[@Nebur999]

Because of you I'm able to understand a lot more of cheat engine thank you.

[@kybe236]

thanks for this great tutorial. realy good to get started with cheat engine.

[@jokerfrown]

thanks the video was very helpful even without boobs at the end

[@mr.kalidor896]

Such a great series of videos. Super helpful and explained really well. Thanks big time!

[@StephenChapman]

Mr. Kalidor Glad you've found them helpful! Thanks for the feedback!

[@diegonovaes]

Dude, this is actually a rly good tutorial !! I tried to learn a bit from the forum but dont realize that much. Probably because im newbie now or didnt find good tutorials links like this. Could u share your source of knowledge ? where are u reading from ? I would like to level up my skills also. U know... learn these things with assembly and these tools of the cheat engine. Your video-tutorials are the best of the youtube! U got that talent of teaching (and cheating hehe) :P

[@StephenChapman]

Diego Novaes Thanks! I'm really glad you've enjoyed them. Most of my early CE learning took place here, on KZbin, and on the CE forum. Here on KZbin, I watched Cheat Engine videos from Fleep Hacks , jgoemat , ***** , tutorialsfromgeri , and others. For really learning Assembly, I cannot recommend enough these guys: Open SecurityTraining That channel is full of HOURS worth of amazing, amazing content--all free! Lastly, check out videos from these two guys: kzbin.infovideos and kzbin.infovideos

[@raflesia1822]

All Your Explanation So Nice And Fun to listen I love it...

[@MisterMultiplayer]

@Stephen Chapman @1:10 That was a good one! I was like "GASP.....Motherfuc...oh" and then started laughing

[@hydrus77]

Excellent videos, you are a gentleman and a scholar.

[@lopo8000]

how do i prevent bytes from changing back if a made like setmemory(0xff7294 "my byte changes") but once i do it they change back how do i prevent that?

[@GrimAngel85]

to Answering to your 5:55 if aob in a script finds more than 1 results. It will always take the first result and inject code, it will ignore the rest of them.

[@Cheng32290]

Thanks you so much! I'm learning a lot with your videos

[@MeBeiManusTube]

Yo're awesome! Great video, great explaination, and overall just a very good tutorial for any kind of user! Keep it going man.

[@ThatGuyNamedBender]

Quick question, I have multiple scripts set up on my CE and when I activate multiple scripts I can only deactivate one of them then the rest become locked in the enabled state. Any ideas? Should I change the names of the symbol CE uses? How it's default INJECT should I be changing that with multiple scripts?

[@StephenChapman]

+Biosystem Studios Always individualize the names, yes! Change "inject" to whatever your script is going to do. For instance, I usually change mine to something like aobInfiniteHealth, aobMaxExperience, aobAllTheGold, etc. The same should be the case for each AOB scan you have if you have multiple in one single script.

[@PASTRAMIKick]

You could've also used the Stack Segment to push the addressed value in memory into the stack and then pop it into the register you want, instead of using a general purpose register.

[@crazydescent]

Awesome, gonna check some of your other vids

[@Antiyoukai]

Question. You can't use push and pop with a byte, right? Has to be word, at the very least. I tried using them with a byte register (because using the usual ebx and such would crash the emulator, due to the memory size literally only given a single byte to store the value) and it wouldn't run.

[@bolfri1266]

Sir. I have script written like this, Fst Dword ptr [Ecx+00001CB8]. I wanna make Inf. Health. What should I do ?

[@roboghost3253]

2018 and it's still a great tutorial :)

[@chrisevil7012]

hey man, really enjoy the video. thanks for posting. i edited my comment as another comment covered my question further down. lmao.

[@dubbog7870]

Hey hows it going, I'm just kinda stuck with something and idk if an AOB scan is whats meant to be done in my problem, but on a game im trying to change the value of my ammo / bandages in a game called InfectZ. Now, when I do this its only changing the display value because like it changes it and when i want to take out more than my original number off lets say ammo, it takes out only my original number and if i try to take out anymore it doesnt let me. How would I change the value instead of the display value? Thanks (((:

[@Sparonax]

Another awesome tutorial! I think people would like to see some AA scripting. There aren't so many videos about it, I thought it would be nice if you make a one. I can personally help you with the code and/or if you find it hard to make.

[@StephenChapman]

mixmax35 Thanks for watching! Yeah, scripting will be the next thing I touch on, but I'll get slowly into that. I'm getting ready to start picking up Lua so I can start teaching that. Everyone references generic Lua tutorials, but there's not any clarity out there that says, "here are some of the specific things of Lua that you can primarily use in CE." I want to change that! I'll probably start it off with discussing CE's built-in trainer generator, but...yeah, this will be a couple of months down the road likely. =) Thanks for the offer to help; I appreciate it!

[@alaaalattab8694]

hi bro pls can you help me i have a game when i change the money is changing but i cant use the money and also when i try to its jump to the original number pls can you answer thank you

[@Porkchopio]

Hey i've got an issue. I did a stucture dissect as I normally do but this time I need a double value type. I looked for the edx (It says movq [edx+20],xmm0) So I looked for the edx of 0C08A420 in the structure dissect and went to +20 but it shows a value of 0 for value type 4 bytes. I changed it to double and it showed the correct value. I want to know how to changes multiple addresses in the stucture dissect to double since doing it one by one would take an eternity.

[@StephenChapman]

Porkchopio I'll have to see if there's a way to set a scan like that, but for the time being, you can hold ctrl and click on all the addresses you'd like to change to doubles at the same time. Once you've selected all the ones you want, right-click and select "change element," then select "double" from the drop-down box and click OK.

[@xpiova]

your videos have helped me alot, but could you explain how to find character values? for example i want to change my character in party with another. how would i go about that

[@G000POINTBLANK000D]

Hey Chapman, How do you deal with addresses that change whenever a new map/stage is loaded? The addresses on each map stay the same even if I restart. But I hate having to find the same thing over and over again for each new area. I couldn't find pointers either through pointer scanning or manual. The game I'm messing with is MGS3 Subsistence on PSX2. Totally offline game.

[@psilocybinarium]

Hello! Thank you for your awesome tutorials! Do you have a video on how to auto fill out entries in a cheat table asuming you have a proper AOB for the base or whatever, and offsets from that base to other values such as maybe HP, MP etc. Cant figure out how its done

[@lllccc8813]

hello would you be able to make a video showing on how to make a script that allows address access i get the script some what down but when i add the address add the right pointer location but when try to find the offset's to point me to the rright place i can never find that would you be able to make a video showing how to do so

[@putthi91]

could u show how to make the Moves not decreasing every time u make a move ? I've been trying but no luck... :(

[@ricecake1065]

Great, love d tutorial with good explanation. Keep d good work.

[@Glenbob1337]

Can someone explain to me the Ebx part of the video? Where did he get that variable from? Did i miss something?

[@StephenChapman]

Glenbob1337 Which section (time-wise) in the video are you talking about? Perhaps I can try to clarify more for you.

[@DrBrownbor]

Dunno what i am doing wrong, but after i restart the game nothing works and if i search for the AOB its different content... So for example i tried to Pointer Scan it - Restart - Search again - Rescan to minimize the results... after the 3. run the list is complete empty... Its all working untill i restart mhh... help plz, someone?!

[@8x808]

best youtuber

[@D3f4uLT_]

*Something is rising* and it's not the Shield Hero

[@neralem]

Why does sub and add share the same opcode-number? (83) Can someone explain this to me?

[@Apex_Evo]

You should do a video on cheat engine about flash games. I have trouble trying to do flash games.

[@chraimeegbatac5585]

hi sir stephen..i would like to ask where can i find those "term" in the memory view of cheat engine? e.g. jmp, pop, dec, nop, add etc..so i could know what it does and to do changes to the part i want to disassemble and create my own cheat or script?? thank you ^_^

[@unforgiven8464]

hei Stephen,are you still active ? I need pls some help here....i have multiple adresses,but I cant figure it out how I have to add them ?

[@numluckz9295]

Intersting stuff, Excellent tutorials!

[@yukixxl]

Hi. Nice video. Excellent explanation and tutorial but could you help me a bit. I have a game and the game on certain point starts secret round if difficulty is higher than Normal. I have difficulty value so any tips on how to get how secret round starts up ? Also, there is this one boss character and on special game mode it cannot move up or down as others do. Any tips on that ? Thank you a lot ;D

[@pacefred398]

Its a great tutorial. But I watching this through the phone. So it lil'bit hard to see the numbers there. Can u zoom it lil bit :)

[@davidnguyen9065]

hey stephen, I jave a question and I do hope you can answer it>_< When I try scanning for health value, it gave me a double type, I then try to copy it's address, in preperation to put it into disect/data thingy. But when I do view it's address, it gave me an assembly code instead. How do I find the address of the value I've just found? Do I just type down manually what I see on the cheat table or do I do something about the code I found? Thanks

[@lysergic4500]

why does every tutorial have eax, edi, and I have rdi, rax, rcx, eax etc. ?? are they the same? and when I try to scan for an array of bytes on my game I get no results? is it because I have to make it more unique or simply because it wont work? thanks.

[@StephenChapman]

For your first question, start studying registers--specifically, the differences between x86 (32-bit) and x64 (64-bit) registers. RAX, EAX, AX, AH, and AL all refer to different sections of the same register. There are also references to various regions (or bits) of other registers, but you'll need to familiarize yourself with them. Here's a good reference image: goo.gl/oSyIIt This will give you enough to go on to start searching Google, StackOverflow, and KZbin for answers on registers. As for your next question, if CE doesn't find your scan, then you either have bytes in the array that are incorrect (which can happen if your byte array contains a memory address, meaning that will certainly change the next time you start the game), or if you're doing a manual scan, you have to make sure to set your scan settings to scan both read/write memory (it's one of the check boxes beneath where you scan).

[@lysergic4500]

thank you for your help stephan. :)

[@KaLul1]

what did go wrong when i have an arrey of bytes where the MIDDLE part changes every start? Like: F2 08 27 6A 01 40 30 80 50 And on next start it is: F2 08 12 00 01 40 30 80 50

[@shwb9]

+KaLul0 You can use * to pretty much say its a wild card, so if you notice the first two bytes are always the same you can do it like this: f2 08 * * * 40 30 80 50 also, check if 01 is always the same as well, i doubt it but if it is include that, the closest you can get it, the best. PS: im a newb when it comes to cheat engine and this may not be the best answer, just posting one since you havnt got an answer yet

[@KaLul1]

+shwb9 nooooow i get it xD thank you! someone helped me out with the script and he placed "*" inside and i searched for his lines to fill in the "missing" bytes. but in fact those where just place holders. anyway his script couldnt be activated before i placed the bytes inside so i have to look about what was wrong. maybe i need to fill in some more bytes to not find another array of bytes fitting in

[@killerconsoles517]

Great videos, do you know if theres any way to do this in c#? i like having a custom gui, I''m using memory.dll to read and write.

[@MasterMindSlyy]

+Stephen Chapman For this specific game, how would i make the moves infinite?

[@s.t.d.r.a.s.h.3703]

Question: how did you come up with xba

[@s.t.d.r.a.s.h.3703]

I guess what I'm asking is, how did you come up with the term ebx? How did you know to use that? Can we just make up something like ebb, or aol, I'm not trying to sound dumb, I'm just trying to know where the ebx term came from....

[@chrisevil7012]

hi. he covers this in a different post. i'll repost it for you " Stephen Chapman 2 years ago +TrayShade I pretty much did pull EBX out of my ass, as it were. =) There are 8 general purpose registers in x86: EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP. Unless you REALLY know what you're doing, you should always assume that every register has something in it when you go to do code injections. At that point in the script, I could have used any register except EDI (since the game was referencing EDI plus an offset, we don't want to futz with that; we have 7 other registers we can work with to do stuff in), so I chose EBX since the game uses a MOV instruction to move something from EAX (so I chose not to use it) into EDI+offset at the point where we're injecting code. The PUSH instruction basically says, "okay, I want you to move whatever's sitting in this register right now (EBX, in our case), to some address in memory that you'll know where it is and you'll pull it again when I'm done messing with this register." The POP instruction says, "I'm done using this register now, so go fetch what was in it when I told you to PUSH it and put that back in the register." So, PUSH EBX saves whatever might be in EBX before we start fucking with it, then POP EBX returns EBX to the state it was in before we came along! Lots of script writers will just PUSHAD/POPAD (stores/restores what's in EVERY register) and PUSHFD/POPFD (stores/restores all EFLAGS, which is a totally different topic I won't delve into), but if my script is for something like this and I know I only need 1-3 registers, then I'll just PUSH/POP them individually. There's a lot more to all this that will help you understand it all in context, but I hope the aforementioned helps you at least understand where EBX comes from in this scenario. =)"

[@100milsubswitheducation2]

*SHOULD I LEARN ASSEMBLE FIRST?*

[@andrzejgawlowski6520]

thank you very much for learning me! :)

[@RAFLAMOLAO]

why did you choose EBX? just wondering.. kinda new here.. well I actually have messed around with Cheat Engine long time ago to do similar things with Maple Story... an MMORPG lol But why did you used EBX? instead of EAX? EDIT: NVM, just read some of the comments down below and you clarified to someone else the same question.. Nice explanation too. Wish I knew this stuff 7 years ago :/ lol would've understand better the way people hacked Maple Story and such. Thanks! (yes a multiplayer online game lol)

[@StephenChapman]

No particular reason. You could use any register you want to there, with the exception of EDI since it's where the base of that particular structure is referenced (with offsets A0 and A4 containing the data we're interested in).

[@RAFLAMOLAO]

lol holy crap u answered so fast! hahah thanks! I edited the original post though! You explained it to someone else kinda more in depth! THANKS! :D

[@jackovaltra9787]

You made my day :'D xD

[@GTO2800]

Really helpful! However I dont really understand the purpose of AOB scans. The memory location which holds the code is always static, right? Why dont you just remember this address and inject the code there, without scanning?

[@StephenChapman]

AOB scans serve a number of purposes: 1: You find your way to instructions related to values you want to modify. While this means you can directly hack a value like health, the greater point is that you're taken to a relevant place within a subroutine that you may want to reverse engineer. For instance, instead of just giving yourself infinite health, maybe you trace your way back to the start of an entire health-related function that, if injecting a RET, will not only do nothing to your health, but will also get rid of other health-related subroutines, like making blood appear on your screen when you get hit, or triggering your character to make a sound, etc., etc. 2: Few are the games these days that store values in static locations. Instructions, sure. But values tend to move around in various addresses. Thus pointer scanning, or AOB scanning--the latter of which can future-proof your hacks in the event that a game update is pushed which only adds content (thus shifting around memory addresses containing data, but not necessarily resulting in a recompile of instructions that might change bytes), etc. 3: In a game that uses shared instructions to modify multiple values (such as one health-related function that writes to player, enemy, and object health), you can't rely on memory addresses alone unless you want to search for them every single time an enemy/item/etc. spawns -- and even then, you may never find the value because the enemy/item/etc. might not have enough "health" for you to find in time. Thus, you can do an AOB scan on the player to find the instruction, then use that to find addresses the instruction writes to, and then you can compare the data structure and write cheats that set apart the player from everything else, etc. There are many reasons for AOB scans! This video may not have been the best vehicle to convey exactly why, but it's been 2 years since I recorded this and I don't remember what I covered, lol. If you keep watching my videos in this series, you'll get an overall idea of why AOB scans are so handy.

[@GTO2800]

Thanks a lot! :)

[@qubasaqube1112]

This Video and this answer just spared me an insane amount of time of practicing! Thanks a lot :-)

[@iGavid_Doggins]

Thank you my bald headed brother this is gud shtuff!

[@AeshwaryeAggarwal]

Thank you sir, for yet another amazing tutorial.....i have been watching every tutorial here and i think it has helped me understand a lot about the way programs work. I can never thank you enough. Anyway, particular to this video,I still got some doubts eating my brain away:>Why do we paste any random array of bytes from the blue code in to the unique array? >-How do you choose which part of arrays to copy in the unique one? >From where do those other array of bytes come from that we copy from to make our array unique(the blue code)? >-Was the blue code pre-written? >-If so then what are those descriptions about(written at right side of each array after the hyphen'-') ? >And also, How do we know that this unique array will be present just once? >-What if the aob scan gets zero results? >You said that aob scan means searching for an array of bytes right?, so technically,the engine while searching should look for the exact same sequence of unique array that we entered in the script, but you also said that it could be much more long., So how does the computer identify? Correction:Sorry, looks like i got too many questions :P. Maybe i'll have to pay more attention

[@StephenChapman]

Aeshwarye Aggarwal I would say watch again a bit closer; however, you may want to supplement with this guide: forum.cheatengine.org/viewtopic.php?t=572465 Make sure to check out the other AOB-related tutorial in his signature. He basically explains how to do the same thing, so maybe his tutorial and some of the questions others ask in it will help you with a lot of these questions!

[@AeshwaryeAggarwal]

Thanks!

[@derpyleedle6983]

Question - When I lock/activate my saved values they change anyways... Any tips?

[@StephenChapman]

Derpy Leedle If this is concerning a multiplayer game, then I can't help you. Otherwise, you've either found the wrong value, or you need to find the instruction that writes to the address, then create a code injection to make the value change in the way you want it to.

[@rejisha]

Does it work with emulators?

[@FreyNekki]

ty for making these

[@StephenChapman]

[Atumi] You're welcome! =)

[@Chronic.Pivoter]

Thank you for a great tutorial. I've tried applying the knowledge to a game called LISA made in RPG Maker, and I failed. I simply lack the assembly knowledge required, and I have no idea what the hell happens to the HP value once I find it, so I don't even know what code and when to insert. The structure inside the game is way too convoluted, and it's not worth the hassle, I suppose. Or maybe I'm just dumb. I've even tried following pointers, but I end up at a stage where there's 100+ to choose from, and their addresses seem to get recreated on restart, so it's simply pointless. I give up. It's far easier to just find and lock the stupid value.

[@filipescp96]

These tutorials are some of the most amazing and efficient i've seen every on any kind of coding/hacking around youtube so far. Thanks a bunch for them dude. One question tho... So, i realise that one of the most effective ways to hack is from these AOB since they rarely change, even on patches. So how do i know which array of byte im looking for? Ill give an example for what im going through: a Zoom hack in a game. I need to know a certain array of bytes to reach into the game memory and replace some lines of code with empty code, so that it would remove the limit of zooming out. How do i get to the AOB ? Anyways, thanks for the great videos. u should be bigger and getting money for this my dude

[@njous1990]

Hey Stephen! Could you maybe explain to me why i cant find the base adres when im searching for it? im trying this in ROM game pokemon blue. PS: ive got MEM mapping for ROM enabled and keeping the value type in mind. Thanks in advance :)

[@Cloudxxx23]

Hi. Can you make scripts for Dissidia NT for pc version?

[@uliveulearnandregret]

where did you get ebx from?

[@pubgfarazgho7714]

How can i contact you bro i want to help to cheat a game

[@anthonysmith1026]

You are the man wow

[@elvisbrasileiro6672]

1:15 very funny

[@ajkdrag]

love how you explain basics and get into details... instead of doing the blackbox approach...keep it up.. I have a certain request regarding cheat engine.... is it possible to edit in game textures like cloth color etc.. using CE... awaiting your reply.... so that I can explain my query further.

[@tomysshadow]

I'm not skilled enough at Cheat Engine to know how, but if you were able to find where the cloth texture is stored in memory, you can change it. However it's probably easier to try and find where the game is reading the cloth texture from and modify that. If you want to change it on the fly, the easiest way to test it's possible is to find the game file the cloth texture is stored in, and look for the same bytes in a memory viewer. Alternatively, you could try looking for a magic key - for example, if you know the textures are JPG files you can try looking for the phrase "JFIF". The only danger is if your image you're trying to replace is larger than the original, you'll need to change the length to avoid overwriting another file later in memory in the process.

[@MikeDoesRandomThings]

I have a question, Can you do one for games that use RPG MAKER VX ACE? I dont know if you even check your comments anymore but I am running into some interesting issues

[@StephenChapman]

I do look at them often, but only have time to reply selectively these days ("time" meaning the time it takes to write replies, and time to dig around in the games people inquire about). I haven't dug around any RPG Maker VX Ace games, but I do recall seeing others having issues with it. If I were you, I'd head over to the Cheat Engine forum and do some searches there. If you don't come up with much, then create a post there inquiring about your issues. They're typically really good about steering you in the right direction over there.

[@MustyReaperYT]

great video

[@BoyEastern]

can i ask you onething ? can you explain or make a tutorial video for AOBScans using c++ ?

[@StephenChapman]

BoyEastern I actually can't. The only language I really know anything significant about at this point is Assembly; however, go take a look at Fleep's channel. He's got a ton of excellent tutorials related to game hacking and C++! kzbin.info/www/bejne/o3y4hH-An9GUoMk

[@Galaxis.Genesis]

Curious, why the base address (142)is not green?

[@sevoo1579]

thank you sir !

[@LightBrand]

The game is protecting you from showing inappropriate content to youtube

[@OmbreeTV]

Made my game crash with my aob injection, whoops hahah I tried adding ammo when I reload instead of it subbing, but I think I had the wrong value.

[@elvisbrasileiro6672]

Hey man, Can you please record with the computer on a lowest resolution?, My screen resolution is 1360 so I even on full screen can't see the code clearly. Thanks for all

[@jaimegarcia5773]

Damn, I'm all kinds of confused.

[@angrysaiyan7044]

Dont worry you'll figure it out, I was the same when trying to use this.

[@StephenChapman]

I was, too. =)

[@youngzombie6342]

Don't worry, just keep matching the jems, and you'll see cartoon boobies sooner or later XD

[@amirpaypal5068]

thank you was great really :)

[@HandyFox333]

Her: This guy's playing with my emotions.

[@garbygarb31]

You left out some critical parts in this video where you start writing the script. You're not telling us where you're getting these registers from. ebx ect.

[@StephenChapman]

If you aren't aware of registers, then this video is going to leave you with plenty of questions. I talk all about registers in previous videos in the series. At 23:36, I arbitrarily chose EBX to use, which is why I push its original contents to the stack, then pop it off back into EBX at the end of the script. Check out other videos in the series; each video successively builds off the previous. And if you feel lost, it's fine; we all felt that way and I undoubtedly didn't cover every possible base, so expect to do some additional research to supplement.

[@Jacky-wn5of]

Can someone tell me how to hack medallions on BTD Battles? Im on pc btw.

[@RobloxDeadzoneHacks]

Also you are funny at the beginning lmao

[@TrayShade]

Seems to me you just pulled the "ebx" variable out of your ass. Some other guy said the same. It happens here: 23:37, would you mind clarifying? I probably missed something or i am simply ignorant of the ways of assembly. And thank you for a well made tutorial. :)

[@StephenChapman]

***** I pretty much did pull EBX out of my ass, as it were. =) There are 8 general purpose registers in x86: EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP. Unless you REALLY know what you're doing, you should always assume that every register has something in it when you go to do code injections. At that point in the script, I could have used any register *except* EDI (since the game was referencing EDI plus an offset, we don't want to futz with that; we have 7 other registers we can work with to do stuff in), so I chose EBX since the game uses a MOV instruction to move something from EAX (so I chose not to use it) into EDI+offset at the point where we're injecting code. The PUSH instruction basically says, "okay, I want you to move whatever's sitting in this register right now (EBX, in our case), to some address in memory that you'll know where it is and you'll pull it again when I'm done messing with this register." The POP instruction says, "I'm done using this register now, so go fetch what was in it when I told you to PUSH it and put that back in the register." So, PUSH EBX saves whatever might be in EBX before we start fucking with it, then POP EBX returns EBX to the state it was in before we came along! Lots of script writers will just PUSHAD/POPAD (stores/restores what's in EVERY register) and PUSHFD/POPFD (stores/restores all EFLAGS, which is a totally different topic I won't delve into), but if my script is for something like this and I know I only need 1-3 registers, then I'll just PUSH/POP them individually. There's a lot more to all this that will help you understand it all in context, but I hope the aforementioned helps you at least understand where EBX comes from in this scenario. =)

[@TrayShade]

Stephen Chapman Thank you, that did it. I love the way you explain things, because of that i am confident i could go do this myself now, though it would probably take a while longer with a different game as i would then have to apply the concept in a new scenario. All this after watching the video only once. I am not trying to brag, I am simply implying that your way of explaining is extremely efficient. :) What i can also state with confidence, is that i am sticking around for more great videos. :)

[@StephenChapman]

I'm glad you found the video so useful! It means a lot for me to know that I can help people understand this stuff better, because I had (and, with many things, am still having) a hell of a time getting this stuff to really click from the guides/videos I followed initially. As for you carrying forward with another game, I highly recommend Terraria. It's absolutely perfect for everything Cheat Engine offers (especially the data dissector). Check out my video on hacking time in Terraria; it's a good supplemental video to this AOB one!

[@TrayShade]

Stephen Chapman I will definitely do that as Terraria is a game I have experience with (outside of CE). Thanks once again.

[@canalessanaopercebi6804]

hello friend Stephen Chapman see you have a very advanced level in cheat engine you could give me a tips'm having trouble making a god game modes