Как найти оффсеты через cheat engine

Join Date: Jan 2016

Posts: 144

Reputation: 2724

Rep Power: 183

Hello everyone. Many people have trouble finding offsets in games and understanding what an offset is (talking to beginners here not you leet haxors). So I want to make an over kill tutorial to clear any confusions on offsets and a simple way to find them. This tutorial is aimed at the very beginner who is just looking to get into hacking but doesn’t know the basics of offsets and is having trouble starting off. This tutorial is not designed to target internal or external game hacking specifically but general(and simple) memory concepts. You should have an understanding of programming (I will be using C++ in the short code examples) or else this will be useless.

What Is An Offset?
So you might be thinking what is an offset or you might have used an offset to hack a game but not known what it is doing (sad life if so). To understand how to use offsets and find them we must understand what an offset is so we will look at a simple example. Lets take a look at a very simple structI will provide.

struct player {
int health;
int ammo;
float x;
float y;
float z;
};

So here we have a struct. Now when we create a variable of a struct in memory a very awesome and simple thing happens. Every member in the struct gets created in memory back to back to back. Meaning our z coordinate is always the same distance to the beginning of the struct. The struct might start at a different memory address every time you run an application BUT the members in the struct are always the same distance away relative to each other. ammo will always come after health and nothing is declared in between them and so on and so forth. So what is an offset. An offset is just how far away something is (in bytes) relative to something else. In game hacking when we say offset we are often referring about offset from the start of our player (if we are talking about our player of course). Lets look at the struct but lets comment in the offsets that each member is.

struct player {
	int health;		//0x0
	int ammo;		//0x4
	float x;		//0x8
	float y;		//0xC
	float z;		//0x10
};

how do we know what the offsets are though? Well think about this for a second. If all of these members are in a struct, they will be allocated in memory right next to each other. If you know how many bytes each data type is we can do some simple addition. The first member in the struct is where the struct starts. So health is offset 0 bytes from the start of the struct because it is the start. And the next member is 4 bytes away from that (since health takes 4 bytes because its an int) so it is said to be offset 4 bytes. As long as you know the data type you can simply add how many bytes it is away from your reverence point (which is the start of the struct for us also called the start of local player). So an offset is just the number of bytes away from a reference point and in this case that’s the start of player. This is extremely simple but many «programmers» who make hacks use offsets but don’t understand what it actually is.

Pointer To Local Player And Local Player
To understand why offsets are use full we have to take a look at the bigger picture and how we get to a spot in memory where our offset will be useful. When hacking games we usually have a pointer to local player usually denoted as pLocalPlayer and that address points to local player. Then from there we have offsets to the things we want to access such as ammo. Lets look at a picture of this to give you a visual of how all that stuff works.

We know the address of pointer to local player or pLocalPlayer. That address is 0x509B74(this could be anything we use this for reference). If we find out what that address points to it will always point to local player or localPlayer. localPlayer is a dynamic address so it will change every time we start the game and that’s why we need a way to find it every time we start the game.. Once we know where our localPlayer address is we know how to get to health, ammo, x, y, and z. We just add the number of bytes it is offset to localPlayer! Pretty simple. Now it is important to note that usually the player struct or class is way bigger and can contain thousands of variables so this is just extremely simplified so you can understand the concept of what all this means. I am not going to show how to find pointer to local player today but I might come back in a fill in how to do that if people want. For now lets focus on finding the offsets. The whole purpose of all the stuff mentioned above is in order to make a hack we need some way of getting to variables in memory every time. It would be ridicules if had to change the memory addresses in our application every time we started the game. That would defeat the purpose.

Finding Offsets
So lets open up assault cube for this example. I am going to give you the address of pointer to local player since I did not explain how to find that. The address is 0x509B74 that points to local player (it’s the same as the one i used in the picture but the player struct in assualt cube is different so don’t mix that up). Attach cheat cheat engine to assault cube. Now lets get to local player. Go to add address manually in the bottom right of cheat engine. check pointer then add 0x509B74 (since the address of pointer to local player).

Now if we hit okay we now have what localPlayer is. Remember if you close the game and reopen it the address will change since its not static but dynamic.

I renamed the description to pLocalPlayer so I can remember what it is. Under where it says address there is a memory address. That is what pLocalPlayer points to and that is localPlayer. So now we know what address localPlayer is lets find some offsets. There are several ways to do this and I will show you one simple way. We will want to find the dynamic address of what ever offset we want to get. So lets look at ammo and get that offset. You will want to set scan type to exact value and value type to 4 bytes and the value is 20. Since we did not fire and our ammo reads 20.

Now we want to hit scan and thousands of results will show up. To limit that down shoot a couple bullets and then under value change it to how many bullets you have left and hit next scan. This will throw out all the addresses that don’t have that value meaning it will limit down the possibilities. Keep doing this until you only have a couple addresses. On my second try I got 2 addresses.

you can double click on the address to bring them down to our address table. Now double click on one of the addresses values and change it to what ever you would like. If it changes the value of your ammo in game then you found the dynamic address of your ammo and you can shoot and test this out.
Now lets think about this logically. If the members of a struct or class is always declared in memory together and in the same order we can find an offset. Now if we know some address that it starts at (localPlayer in this case) and we know an address of one of the members in the struct such as our ammo, then we could subtract localPlayer address from ammo address and it would leave us with how many bytes away that member is in the struct from the start of the struct! Its just taking two numbers and finding how far apart they are. So here are the addresses I have for local Player and Ammo

If we take ammo address which is 0xE7A4E0 and subtract localPlayer from it which is 0xE7A390 we get 0x150. That means that the ammo address is 150 bytes away from the start of localPlayer and since ammo is part of the player struct in assault cube the offset will always stay the same even if we restart the game since how structs and classes and things are declared in memory. Now if you did this your addresses would be different but you would get the same offset once doing the math. Now you can go and find any other address and do the same. Go try finding your health, x, y, z coordinates and any other thing you want. Remember that there are other methods of scanning in cheat engine. You probably won’t use exact value for your x, y, and z coordinate cause you don’t know them and also coordinates are usually floats so under type you would change 4 bytes (an int) to float.

The Bigger Picture
This stuff isn’t hard! If you do some research about how things are allocated in memory and you use your brain you can figure stuff out easily. Just by knowing subtraction and how a struct is allocated in memory we found an offset. Its very simple. If you have any doubts about memory make an application and look at it in cheat engine to clear your confusion. Also why do all of this if you can go to a forum post with all the addresses? Well because knowing how to get things in memory strengthens your understanding and you won’t always have a post with information you need so start learning how to do things yourself! Good luck on the beginners starting out I hope this helped in some way or another.

Last edited by aixxe; 14th January 2017 at 07:31 PM.
Reason: fix image links

Join Date: Jun 2013

Posts: 4,818

Reputation: 122812

Rep Power: 413

Points: 236,129, Level: 59

Level up: 20%, 257,871 Points needed

Activity: 42.9%

__________________

Threadstarter

Join Date: Jan 2016

Posts: 144

Reputation: 2724

Rep Power: 183

Sorry about that. Thanks for the fix!

Join Date: Jan 2016

Location: USA

Posts: 1,297

Reputation: 17363

Rep Power: 209

Points: 37,008, Level: 29

Level up: 29%, 1,792 Points needed

Activity: 2.1%

Looks neat, but definitely add or update this and touch on finding pointers. Very important skills. Otherwise, this was simple and neat, great explanation!

Kudos,

~Slayer1250~

__________________

Join Date: Aug 2014

Posts: 12

Reputation: -37

Rep Power: 0

Points: 6,013, Level: 8

Level up: 56%, 487 Points needed

Activity: 2.3%

Threadstarter

Join Date: Jan 2016

Posts: 144

Reputation: 2724

Rep Power: 183

thanks. there is so much on finding pointers that I feel it is not worth the time to say what can easily be found with a quick search.

Join Date: Jan 2013

Posts: 104

Reputation: 955

Rep Power: 254

Join Date: Jun 2017

Posts: 53

Reputation: 162

Rep Power: 145

Points: 4,738, Level: 7

Level up: 27%, 662 Points needed

Activity: 8.6%

Join Date: Dec 2017

Posts: 22

Reputation: 23

Rep Power: 134

Points: 1,061, Level: 2

Level up: 33%, 339 Points needed

Activity: 1.3%

Join Date: Jan 2018

Posts: 1

Reputation: 10

Rep Power: 131

Join Date: Jan 2018

Location: HA NOI

Posts: 9

Reputation: 10

Rep Power: 131

Points: 2,131, Level: 4

Level up: 5%, 669 Points needed

Activity: 1.8%

Join Date: Jul 2007

Posts: 171

Reputation: 858

Rep Power: 388

Points: 15,227, Level: 16

Level up: 17%, 1,173 Points needed

Activity: 4.8%

There’s many videos on this already, just open up youtube and search.

Good guide btw. +rep

Join Date: Feb 2018

Posts: 8

Reputation: 10

Rep Power: 130

Join Date: Feb 2015

Posts: 78

Reputation: 132

Rep Power: 202

Points: 5,101, Level: 7

Level up: 67%, 299 Points needed

Activity: 2.3%