Windows Game Hacking with Ghidra and Cheat Engine

[@Luca-iq4ev]

7:24 A pointer does not always move by 4 bytes on 32 bit, it moves by the size of the type it points to, so a pointer pointing to a char will increase by only 1.

[@perc-ai]

common mistake

[@kipchickensout]

oh?

[@rarityaeon4759]

i was literally about to write the same thing.

[@iProgramInCpp]

Some C programs are optimized so that the program runs faster (basically, all variables under 32/64 bits in size are padded with 32/64 - their size in bits). This is done to optimize run time. You can always use things like "__attribute__((packed))" to not have this done.

[@simonsoka4428]

@@iProgramInCpp bits? not bytes? :)

[@oops9070]

Me pretending to understand “Hmm, yes this code seems to be made out of code”

[@plainblocks2]

Code is just nUmbErs aNd lEtTERs

[@lad2987]

@@plainblocks2 ok

[@potatoemaster66]

@cibu fam You're doing good buddy!

[@marcovalentinoalvarado3290]

Somehow, it does make sense, C++ is made of Assembly at some point, assembly is made of hex, hex of bin... bin of electronic pulses... etc...

[@wonkysouceaasdsad9664]

@@marcovalentinoalvarado3290 that etc... is everything

[@BobTheBob9]

i'd love to see online games that actively encourage hacking them, where a large portion of the gameplay would be reverse engineering, finding exploits, getting around anticheats and such, as well as just developing better cheats than other players, it could be pretty fun imo

[@iilwy]

would be pretty hard for devs to make a good game and then say "yeah, i think i want hackers in online"

[@BobTheBob9]

@@iilwy I was thinking moreso games that were built from the start with hacking in mind, though I think adding official servers where hacking is allowed to some games could also work

[@FreeER]

Imagine if there was an Extra-Pro rank that you got from being able to beat people hacking lol of course, this requires that the game work to give you ways to fight the basic hacks, sure maybe they get god mode from bullets and explosives, but what about poison gas, falling through the world etc. that only happens in those fights and get changed out every month or something with other effects. Or a rank for hackers beating other hackers. Of course you could also have an option for people to get cosmetic items or whatever if they'll willingly play against hackers in a separate server/game-type. That way hackers still get to be OP and lay waste to shit, but the people being slaughtered get something in exchange rather than... nothing, or worse losing rank. Obviously it doesn't make sense to design most games around hackers, but that doesn't mean there couldn't be separate servers/game-types where it's allowed and see if it decreases the number of people willing to get banned in the normal ones.

[@Entropy67]

I'm sure there are some like that, just that you've never heard of them because theres no way for them to be popular

[@codexed-i]

Cookie Clicker has even an Advancement for that

[@iWhacko]

I too started in Gamehacking with Tsearch 1.6 and Cheat Engine (around 2001), making trainers in masm :) now a senior software engineer. still love the puzzling. Hadn't heard of Ghidra, I'm gonna check it out :)

[@iWhacko]

@@UCnPE-cqd00o5SHPn0rHxphg Yeah I was actually playing with it right now and looking at some tutorials on YT. Seems pretty cool so far :)

[@ashxxiv]

Ghidra is nice. it's pretty much IDA Pro but without the price tag and it's open source. Thank you NSA!

[@valueforvalue76]

Haven't heard the name TSearch in years. Ah Memory.

[@Sakupenny]

​@@valueforvalue76I see what you did there

[@SimonNitzsche]

I am basically RE for an online game, but the good way. The online game is closed, so i am doing RE to construct a server emulator.

[@iProgramInCpp]

So then how do you build your server emulator, if the real server is offline?

[@iProgramInCpp]

@@NoTeefy it is even more difficult without the game server

[@CodeAsm]

@@iProgramInCpp And now have it all encrypted and the game only has the public key.

[@SimonNitzsche]

We actually started without a live server at all. But luckely someone captures their packets with Wireshark and most of it was able to decrypt

[@Walter_]

Same! I had to reverse engineer Bloons 2 level editor with JPEXS bytecode and removed all obstacles like the sitelock, mochigames preloader that crashed the game, etc. I also made a python script that downloaded 150k~ of the 300k~ levels that were available on bloonsworld and made a cool loader for them. By the time i did that massive level collecting the site was down for multiple years but wayback machine had 150k~ html pages stored and luckily the level data was in the html. If anyone wants to try these games and BTD4 level editor, i have the download links in my discord server in the #downloads. discord.gg/hvCKSRJ

[@spicybaguette7706]

I think that one of the reasons hacking and reversing tools are so developed on windows is because basically everything there is proprietary. On Linux, if you want to figure stuff out, you read the source code. Also, gaming on Linux has only recently become more popular.

[@redouanered7950]

Nice video, there is a feature in Cheat Engine for Dissecting structures (Dissect Data / Structures), it even attempts to guess field types, and it's really useful to compare between objects (for example, to inject assembly code that patches a function common to players and enemies, and only affect enemies)

[@melody_florum]

Me before the video: oh cool I know cheat engine and programming this should be interesting Me halfway through: _what_

[@kyleyu1855]

This was right up my alley as I have been doing game hacking for years with cheat engine! Please continue this series because I could definitely learn something from your methods of debugging.

[@cod.liver.failure]

Really appreciate you going a Windows based video! 😀

[@gehteuchnixan8256]

It's impressive how you are able to do really advanced stuff, but still think back to a beginner's point of view. There a many people out there who want to throw out free tutorials, but they are loosing their audience sooner or later with dozen of fast steps that are familiar and boring to them, but hard to understand for those who never did this before.

[@ChrisFayte]

Outstanding vid in explanation of the fundamentals in using these software engines. How there are many avenues and routes to take to achieve the same goals. This channel is a treasure of knowledge and is an asset to all of us. keep up the awesome work pal!

[@badrotaibi4229]

Thx man Ive wanted to learn that my whole life I just didnt find resources Or at least an understandable resources Now i know how to start Thx again Iam gonna donate for this channel once i graduate and work

[@Hydrus808]

cheat engine wiki and cheat engine forums are great if you need ressources or tutorials

[@NOLlFE1]

Exploit developing in other words, which is basically memory editing.

[@outsider1st]

Memory editing is just one of bunch of things you could do.

[@catursura9168]

can we make bot with this method?

[@knockhello2604]

@@jakedadoge1820 your fucked

[@owotuna]

I was just about to comment about guided hacking's channel. Awesome stuff there.

[@GrandpaGameHacker]

Yesss 😍 Game hacking on windows is a life long hobby of mine

[@sebimoe]

@ 9:00 -ESI is sometimes used as a stack pointer- (ebp is used instead in some compilers) - so it may be referring to a local variable

[@iProgramInCpp]

Aren't EBP and ESP used for stack pointers? (EBP = stack base pointer, ESP = current stack pointer)

[@LiveOverflow]

I have never heard ESI to be used as a stack pointer. Afaik the CPU doesn’t support changing the stack pointer to ESI

[@sebimoe]

@@LiveOverflow Brainfart on my side, why did I confuse it with ESP? And if it were ESP you probably would have known as it's not windows specific. 🏃‍♂️

[@xTr4pSystem]

Yayy finally I always wanted you to teach it on windows!! please make a list on it, Im hella into game hacking in windows and you are my favor teacher!!

[@doomize2457]

Awesome video and topic. Your Pwn Adventure series is my favorite of all your stuff.

[@pranavgade527]

I am a teenager rn and I just wanted to let you know that I really appreciate this.

[@batlin]

I think Cheat Engine might have been inspired by MAME's built in cheat search, which has the same kind of "unknown initial value" features but with fewer options. I used to use it for all sorts of arcade games in the late 1990s :)

[@amitsides4661]

Have been a sub for over a year now. I think it's the first time I learned something new that can actually be useful to me :) I guess I haven't looked enough into cheat engine to know it is that powerful. But I wish you would make more videos with Ghidra because as a long time user of IDA I think it might be nice to see the pros and cons of each, before I really get into it and commit (and push?) to the change.

[@amirroohi4566]

YAS FINALLY, THANK YOU VERY MUCH. Can you make it to a full series? I really want to learn more about this topic, and can you a make a series where we make our own tools(very very basic) like cheat engine?

[@brainheadz]

uploaded at 13:37 :)

[@l2wtarget]

Bro , youre amazing , now ik how to use cheatengine on basics youre such a legend , New Subscriber!

[@p0pka_enota]

Thanks man! I have close to none knowledge and experience in reveng. And I was looking for information on how to deal with unpacking. But I didn't even know what it is and what is it called. I just saw strange addresses of the functions in debugger. But you mentioned GuidedHacking and slowly but steadily I found what i need for my case. Thank you!

[@DaCat1337]

If anyone wants to learn more about this stuff I recommend Stephen Chapman and cheat the game :) Edit: you already reccomended Stephen Chapman. Nice video! I'll check out guided hacking too

[@Coolsurf6]

I've had some bad experiences with cheat engine. The name just seems like it is only used for cheating when in reality it is just a very well developed memory editor and scanner for applications on Windows. I have experienced 1 ban for malicious use of that program over 1.4k days ago and have always regretted it, but has also encouraged me to get into cybersecurity at university. This video actually showed me the good and thought out uses for chest engine and has kinda given me relief as I thought it was only used for online script bunnies...

[@gloatsticks]

this is amazing, i've always wondered how to setup a bot for a video game and this is a clear example of steps to take to create that. thank you

[@LouisT1990]

This reminds me so much of when I got an ActionReplay for the gameboy as a kid and read the manual on how to find codes for games yourself

[@martinp.4797]

Back to years on WarRock game with disassembling the exe, create detour and bypass, so much learned about IT security thanks to this game. Not always for good reasons but really useful knowledges for my work today

[@AshesOfEther]

I remember using Cheat Engine to get money in Flash games.

[@bnal5tab90]

i was like haxr of the year bois but after i learned about injecting asm in the game and finding the base of the value i was the real hxor but sadly i have no friend

[@FreeER]

I remember doing the *8 thing but then I saw the cheat menus that some hacked game sites had and I never could figure out how those worked lol Oh well, flash'll be dead soon.

[@bnal5tab90]

@@FreeER isn't dead already?

[@FreeER]

@@bnal5tab90 not officially, it's slated to stop being supported by Adobe and Chrome in 2020 iirc

[@MrXSharing_is_caring]

i also learn from stephen chapman and guided hacking. And now i'm learning a lot from you thanks a lot ;)) i'm a novice hacker.

[@theowaldburg]

Oh man. I have waited too long for this! Thank you :D

[@Akandesh]

Thanks a lot! Learned a bit more about assembly and reversing.

[@N0ES]

What I like to do in Cheat Engine to understand the structure I'm working with is to compare the difference in position of two memory addresses, like finding a relative offset from one to another and see if there is periodicity or not, for example the position of skill 0 and skill 1, it can be really useful if its not an array because skills and items may have more or less information.

[@ArkanoidGaming]

would love to see more of this , totally worth learning stuffs from you everytime

[@Erarnitox]

Love the series on Pwn Adventure :) But at 14:55 you mention GuidedHacking, it would be really cool if you could link the channel in the video description (or GuidedHacking.com) we are always looking for new members which are willing to learn and to contribute :) That would help us out alot. thank you very much ^^

[@silence9804]

Ahhh I see. you are a man of culture aswell

[@ebolele]

I used cheat engine so much 10 years ago from things like Swords and Sandals to Counter Strike, not knowing what these numbers even meant, not knowing english and basically working out everything through trial and error. Never found myself interested in programming though, as I always just give up at some point.

[@DerHody]

Mega geiles Video. Hab selber bisschen mit Cheat Engine rumgespielt, aber mich nie an das reverse engineering gewagt. Mega informativ.

[@avi12]

The best Cheat Engine tutorial yet

[@hectorbas9850]

Whoop more Pwn adventure stuff! Love it! One day I'm going to give it a go. Wonder if there'll be another iteration of it in the future?

[@foggylight187]

Me, as he finds the memory address for the inventory slot: hmm, seems interesting, we can use this to possibly rapid spam weapons... Live: opens up "what accesses this address" Me: Oh, that's interesting! You can actually use this to modify weapons, I never thought about that! Live: finds out everything about the player in memory regions me: 0-o

[@AdriGDev]

Jus the tutorial I was looking for ages. Thank you !,

[@tank2543]

Face palms. He did a great job reverse engineering without information. But please for the love of all that is unholy don't use this as a guide for cheat engine. (probably ghidre to because he didn't explain that at all.)

[@strategycube770]

Great video, just hope in the future I understand the concepts better in your videos

[@manuelb__r]

I want to become a security analyst and I started learning computer science because I was inspired with game hacking. Someday I will get there! Also, I've waited for this content on this channel. Thanks!!

[@thogameskanaal]

The first time I discovered the hex editor and cheat engine in CWCheat on my modded PSP shaped my future :P That might sound silly, but just messing around with that, I self-taught myself so many low level concepts. I cheated the system, haha

[@metalpachuramon]

Ohhh the memories, I also remember using cheatengine, granted I didn't understand most of that stuff and could only hack basic stuff like amo counters hahaha

[@OrangeC7]

Dude, I remember back in the golden days of Geometry Dash how people would use Cheat Engine to cheat at the game. There was so much drama and investigation and people talking about how to catch a cheater, it was great. I miss those times...

[@miroslavpokorny7145]

Sounds very similar in functionality to how Action Replay and similar devices used to "find" cheats on the Amiga and other machines like the consoles. You enter the current "value" it finds locations that hold said value, then you continue playing and ask the engine to scan again and tell it the current "value". Eventually it narrows down the lots of memory locations that match until you get a very small number. WIth a bit of assembly looking around or experimentation like changing each memory location you can eliminate the others and figure out the true memory location.

[@justabbygal4777]

It's almost like its efficient to do it this way

[@metl_play]

I am learning to mod my PS2 Game and use Ghidra too, i didn't thought about Cheat Engine but i gess with that i can actually find some useful information for finding some Variables in Ghidra. btw i have no clue about assembly and so on, thats my way to learn Programming, all i know is a bit (Java + JS) = nothing useful for that XD Thank you for sharing all the work with us, in that way i learned some cool stuff and get some nice clues for my Projects

[@iQKyyR3K]

I use arch btw.

[@outsider1st]

Oh nobody cares

[@l0venp34ce5]

@@outsider1st thats the joke u dip

[@guerra_dos_bichos]

@@outsider1st you seem to care enought to feel compeled to answer

[@amrojjeh]

@@guerra_dos_bichos Well I'll have both of you know that I care about how much I don't care.

[@car-go9zc]

Amr Ojjeh that makes no sense whatsoever

[@GameTimeWithVargaArmy]

You should code a very basic MMORPG using a combination of C# and cheat engine, that'd be really cool to see! :-)

[@actualFix]

If you're looking for a Cheat Engine equivalent on Linux - try GameConqeror. It's not perfrect, but it does the job!

[@nagitokomaeda3237]

Pwn adventure 3! You're amazing

[@darkcrox]

club penguin hacks with cheat engine and wpe pro... rip club penguin 🐧 great video btw.

[@connorjackson5037]

For me it was speedhacks in Roblox lol

[@270jonp]

Sweet, Looking forward to this.

[@the_socompsp]

brings me back to my highschool days with the nightmare fueled stress dreams that were nite-pr...

[@nightcross4568]

Great explanation, I learned a lot from this video.

[@philipp__3671]

damm, i loved your Pwn Adventure Series, and would love to see a remake on Windows

[@Fligger]

I think also "Cheat the Game" is a nice yt channel to learn from.

[@nadavshemesh1231]

Agreed

[@StephenChapman]

Agreed. =)

[@FreeER]

as an admin there I can't not agree lol (just in case that sounded sarcastic to anyone, I'm just having fun with the reply, I definitely think it's a good place to learn)

[@vladimirmoushkov6137]

Beautiful work!

[@ididzy]

Thanks, this information is both entertaining and useful!

[@wurstmate]

Really liked this video, very understandable & interesting :)

[@mimmovisconti2559]

5:30 We dont't search in code because the write checkbox is enabled and the code sections isn't writeable. If you want to search through code you need to unset the Writeable checkbox.

[@LiveOverflow]

Ah neat didn’t see that

[@amitbh5987]

Greatest tutorial on the world, many thank you

[@pitrovsecondary9454]

Great video. Do more of these!

[@MythiPlayz]

When you didn't know the meaning of the extra variable, I think it was the character used to store the numbers in the game, that's why the bits updated incremently :)

[@aerodigital]

@11:24 I spent a while looking for the base address button in Ghidra my first time, or first few.

[@mechanical00toaster]

This is really helpful. Thank you!

[@slytherin9090]

there's a cheat engine-like program in linux, called Game Conqueror that uses scanmem at the backend. but it's less features than cheat engine.

[@magnuserror9305]

I use cheat engine to do stuff in games. For a novice "coder" like me, it really shows how nice a tool it is.

[@anghelrobert9311]

I'd really like a video where LiveOverflow explains the dll injection.

[@JensAndree]

Cheat Engine is a really versatile tool, not just for games but for every type of software! You can quickly patch running code to bypass/modify functions, like bypassing licenses, demo mode or locked features you just want to quickly bypass without making something more permanent. Or you run into a bug when developing, or you want to introduce a problems whilst neg testing - Cheat Engine is a powerful tool. The only thing that really sucks with it is that it's written in Pascal. I'm old so I've used Pascal plenty in my life, but honestly I was glad to abandon it in the early 90's because there were no descent dev tools for it. Delphi tried but compared to Dev Studio it was a joke, but this doesn't matter when you're just using it and not developing for it.

[@hoxorious]

Awesome. Please continue this Cheat Engine tutorial serious. ❤✌

[@im_kamil]

My favourite series ❤️

[@Mac_Omegaly]

The only online game I hacked with a basic "poke" poke and peek program in 2010, was Cookie Clicker, and my goal was to break the game by getting the highest number possible. after a few weeks I finally "beat" the game, as all it could do was spout messed up numbers, like a calculator. (something like that 3+48257 ) I wrote about this on an old forum. it basically came down to finding the event timer, by searching for an unknown value, and checking for decrease, until the end of the timer. Then you search for the Golden cookie timer, so you never miss a Golden Cookie. (the value can't be changed to speed this up, besides buying upgrades.) then when the multiplier rate changes you locate the value, and maximize it, while locking the timer for the bonus to never end. Even with all of this it takes several game restarts, with lots of heavenly chips to break through the barrier into too large to count numbers. I also emailed the developer of the game telling him of my achievement, and details on how I did it. I also asked him if he had anyone else break the game, he did not reply.... oh well. but the game is no longer hack-able in this particular way anymore, and I would like to try and take credit for this. lol There are still ways, depending on the browser you run the game with. (speeding up the browser clock, and looking for timers still works... but only while it is counting down. but the game cuts off timer bonus with a new timer, that you have to locate. XD)

[@Vagelis_Prokopiou]

Nice stuff man. Learning seems endless...

[@pathfinder750]

OMG i remember doing this for Kingdoms of amalor when i was younger. I didn't think it would be considered hacking

[@teslastellar]

Excellent video 👍

[@Jennn]

Finally... FINALLY I GET IT~! THANK YOU FOR THIS SIR~!

[@tharealminipunch]

Awesome! Thank you!!

[@gangstasteve5753]

I like that you are using ghidra instead of the paid ida pro

[@ShadowTrolll]

"Hah, pun" 10/10

[@hhthoj]

Windows game hacking levels: - ArtMoney - Cheat Engine - OllyDbg

[@Matt23488]

I remember using Cheat Engine 10 years ago to cheat at a little game called Liero X. I'd give myself infinite health and stuff. It would only work on hosted games though, not games I joined, haha.

[@Henji96]

Thank you. I learned something new

[@Spicymuffins89]

7:37 I was thinking about how you said that the way you searched for the selected item index loaded in basically all stored memory in the game. Because of that, I think that the other value that was related to the selected item slot might be the highlight that is displayed over the selected item.

[@FreeER]

That doesn't make sense to me... a highlight is just a color and there's no way the color would change by just 1 to get a noticeable difference unless it's an enum but then I'd expect values like 0, 1, 2, 3 etc. or at least 0-255 if it's a brightness/luminescence value. Similar if it was an x position or something, 1 would be a very unlikely step value.

[@raminkhonsari2117]

Dude i love you!!! so cool tricks

[@berkcan3475]

I remember hacking adventure quest because damage variables were being calculated in client side xD

[@Coldfirebe]

Such a throwback, used to do a LOT of this and even made a few bots for online games that used memory values. But honestly, dont trust ANYONE you download from (hacking) forum. Most of them have viruses. ... hmm would make for a fun thing to analyse too !

[@nezu_cc]

GH reference on LiveOverflow , now that's just awesome. I make full blown multihacks for windows games in free time and i love the idea that you are finally interested in windows. Windows is fun, trust me.

[@nezu_cc]

and i got immediately disappointed by the fact you hate online video game hacks. But these are the only ones that make any sense for me.

[@OthmanAlikhan]

Thanks for the video =)

[@sodiboo]

0:44 casual flex

[@TheZipippino]

Great video 👍

[@Yotanido]

The bit you did with Ghidra reminds me of deobfuscating Java

[@greventlv]

Great video!

[@epoc162]

The tools for hacking games at least is more advanced on windows for a simple reason.... most games are played on windows. Because of this, it’s only natural that most tools will have been created to be used on windows.

[@gimmyp.7690]

Nice video !!!

[@Mirrowel]

This is the video i was waiting for a long time. If only you could make a series on Cheat Engine, explaining how to use this tool to hack or disassemble games. Like making making health not decrease without searching for values every time. I have tried to learn this before, but there is just not enough material on this that would be understandable to beginners. UPD: After watching Stephen Chapman's video on Lua trainers, i still didn't solve the other problem i had with cheat engine - that is when games have display value different from real value, that sometimes is behind some kind of defense(or just shitty code like in SPAZ).

[@FreeER]

There's tons of content, a lot of it aimed at beginners especially on Cheat The Game. But most are not concise well thought out courses by experts and generally later videos assume you've some experience with the earlier videos so they aren't having to make exponentially longer videos every time they cover a new concept by reexplaining every single thing that's already been covered to lead up to it. Not that it can't still be hard or that I wouldn't love a LiveOverflow CE series but there is material already. As for display values... that really has nothing to do with trainers and lua, you find a pointer or script for the real thing and then you use that in the table that you base the trainer off of. Even if you write it all yourself with custom lua the difference is basically readInteger('fake address') vs readInteger('real address'). It's all about finding the real address way before you ever get to lua or creating the trainer. Not sure what "shitty code" SPAZ does so can't really speak on that topic.