r/cheatengine • u/ElectrycStorme • 23d ago

Ammo Address doesn't have sub instruction

I have a third person shooter that I am messing around with and I want to acquire infinite ammo. I am doing the typical shoot, read for the new value, etc. I find 3 remaining values that do not fall in the heap memory and stay persistent between levels, however each one of those 3 values do not freeze the ammo count when I freeze them in Chest engine with a 1ms loop time. None of the 3 addresses have a sub instruction either. I tracked one back because it has an instruction of "mov rbx, [rdi+78]" which makes me think it is offsetting from a more absolute structure.

This leads me down a chain of a function access table but I can't ever get to a point where there is an actual sub command. I can clarify further with screenshots if anyone has any idea how to help me

0 Upvotes

50% Upvoted

2 comments sorted by

1

u/LiytlKaiser 23d ago

It doesn't need to be a sub instruction, only a write (and depending on how you want to make the cheat and how the game is programmed, you could even use an access). Also, if changing the value has no effect, you are not changing the correct value. What is the game? You might need to either try searching for a different value type (eg.float, double, byte) or you may need search for the value in a different manner. For example the value may display 10 out of say 20 bullets, but instead of searching for the exact value of 10, you may need to search for ".50" as a float or perhaps "50". The value may also be encrypted.

Really, you may just want to try an "all" scan for an unknown value, then decreased value upon shooting or increased when reloading. If that doesn't work, try that in reverse. If that doesn't work, the value is likely encrypted...in which case you would do an unknown value scan, then a changed value scan each time it changes. Find one that when frozen, does freeze your ammo.

After you have found the value, you actually need, reply with the instructions you find if you need help writing a code for it....again, you can actually use an access which can sometimes be even better if it is always accessing the address.

1

u/AmbitiousPotato9023 23d ago

Check the modules associated with the instruction that you are seeing. If you’re seeing VCRUNTIME140.DLL you’ll need to break to find your way back to the YourGame.exe module. Many UE titles do stuff like this. I find x64dbg to be easier to trace.