Create Your Own Game Cheats: Developing a Trainer in C++

Choosing a Game

Let’s start by choosing a game. I’ve selected Hyper Light Drifter (referred to as HLD). If you plan to experiment with a commercial game, check out the PCGamingWiki website as well as games with open source code.

Value Search

To find the values that the cheat will modify, we will use Cheat Engine (hereafter referred to as CE).

Start the game and select windowed mode in the settings. This allows space on the screen for other content aside from the game.

As we can see, in windowed mode, there is no title bar that allows us to drag the game window across the screen. To fix this issue, we will open the debugger x64dbg, specifically its 32-bit version (x32dbg), and run HLD under it.

Let’s set breakpoints on the functions CreateWindowExA and CreateWindowExW, which are responsible for creating a window. You can find these functions under the Symbols tab by selecting the user32.dll library.

We see that our window is created with the parameter dwStyle, which has the value WS_POPUP = 0x80000000.

Change this value to WS_OVERLAPPED = 0x00000000.

And here’s the result: we can now move the window.

After setting up the game window using the debugger, we’ll set it aside for a bit. To find the necessary values in Cheat Engine, let’s delve into some theory.

What is a Static Address?

A static address is one that changes predictably relative to the module it belongs to. If a variable is global, it can typically be found in the data segment.

Static addresses are specified in the format [module+offset]. For example, in library.dll, we might find a value at the address 0x700004C0 (base = 0x70000000, offset = 0x4C0). Since library.dll can be relocated and its base loading address might change, we don’t use this address directly to access our value. Instead, we use the address [library.dll + 0x4C0]. Consequently, when library.dll loads at the base address 0x10000000, [library.dll + 0x4C0] translates to 0x100004C0, allowing us to access our value.

If the variable is local, it should be sought in the stack. To do this, obtain the TebBaseAddress of a specific thread, and then the second pointer from this structure (FS:[0x04] or GS:[0x08], depending on the process’s architecture), which contains the stack’s top. The TebBasePointer can be acquired using NtQueryInformationThread (for a 64-bit process) or by using Wow64GetThreadSelectorEntry (for a 32-bit process in a 64-bit system).

Finding Health Values

Launch Cheat Engine and connect to the game’s process.

Since the type in which the health metric is stored is unknown, we set the following parameters for the initial scan.

Next, we continue scanning, while intentionally losing health points (HP) in the game. We do this to monitor the changes in the HP value in the game’s memory using Cheat Engine (CE) and to reduce the value in subsequent scans. We will keep doing this until we reach a manageable number of values in the CE window. In this context, a manageable number means a number of addresses that can be checked in about five minutes.

I found these two addresses interesting and added them to the lower window by double-clicking on them. They caught my attention primarily because the values at these addresses have the largest data type — double. It’s always important to check from the largest type to the smallest. So, first we check addresses holding the double type, then float, followed by integer, and so on. For more detailed information on data type sizes, you can refer to the Microsoft documentation.

If we change the value at address 0x36501940, a health bar will appear on the screen, but the amount of health will not change.

If we now change the value at the address 0x36501A30, an HP bar will appear on the screen and the value will change. This means we have found the address where the health value in the game is stored. The value is stored in double format, following the IEEE 754 standard.

Let’s name the addresses we found as hp_bar and hp, respectively. However, as I mentioned in the section about static addresses, the address we found will become useless once we return to the menu or restart the game.

Searching for a Static Address for the Health Indicator

To continue searching for the static address, let’s go back to the debugger. In the dump window, navigate to the previously obtained address 0x36501A30, where the value of hp is stored.

Set a hardware breakpoint at address 0x36501A34 to trigger on write operations and then lose some health in the game. When the breakpoint is activated, we observe that the new health value is taken from the EDI register. This value is the first parameter of the current function.

After exiting this function, let’s trace where it gets its first parameter from. We will see that the parameter being passed is the return value of the function located at address 0x003EFCE9.

Let’s set a breakpoint at the function call located at 0x003EFCE9, and then continue debugging until the call is reached. Once inside the function, execute it to the end. When we reach address 0x00F88E19, we’ll see that the EAX register contains the address of the hp value. It’s clear that this function accesses our address through pointer arithmetic involving structures, specifically by adding offsets to a pointer and subsequently dereferencing it. You can read more about this process here. We will need to step through this function again to determine the exact address and offsets it uses to obtain the hp value address.

Once we discover the address 0x353F9BB0, which leads us to the address storing the value of hp, we begin unwinding from the functions. During this process, we carefully monitor the parameters being passed to them. After a few exits, we’ll encounter the following.

We’ve located a static address! If you examine its position in memory, you’ll find it in the .data section.

Knowing all the offsets, add them to Cheat Engine by clicking Add Address Manually.

Finding the Ammo Count Value

Now let’s proceed to finding the ammo value. Conduct the first scan using the same search parameters we used when searching for health.

In this case, we were only able to identify one value, which is the indicator displaying the number of ammunition rounds.

In the game, this indicator did not appear. Unlike the health bar, it only shows up after pressing the E button or during shooting.

Finding a Static Address for Ammo

We understand that the readings of the indicators in the game are always compared with actual values. If one of the bars doesn’t display the correct value, its length is adjusted. Therefore, we return to the debugger and start with a hardware breakpoint on write at the address 0x365014C4. As noted in the comments, we have encountered this function before.

Similarly to how we handle the search for hp, we exit the function.

Since we already know that the indicator must derive its value from somewhere earlier, we’ll need to scroll up in the disassembler window until we find a function that likely obtains the actual ammo value.

We can observe that we’ve already been in this function, which means it’s receiving a value as well, but in this case, it’s ammo — 365014E0. However, this value seems a bit unusual.

By adding this “strange” value in Cheat Engine and then changing it, say, to 100, you’ll notice the on-screen ammo indicator changes accordingly. This means we’ve identified the address where the ammo value is stored in the game.

Once you know all the offsets from the static address to the ammo values, you can add them in Cheat Engine by clicking on Add Address Manually.

Verification of the Obtained Static Address

To verify if we have correctly identified the addresses, exit the game menu and return to the gameplay or restart the game.

Testing for HP

Here is our cheat table for HP.

This is what it looks like after restarting the game.

Ammo Check

Here is our cheat table for ammo.

Here’s how it looks after restarting the game.

What Will Our Pointer Look Like in C++

In our cheat, access to the discovered value addresses will be as follows.

Developing a Game Trainer

Cheats can be divided into two categories based on their functionality: internal and external. External cheats are separate applications running in the system as a process. Internal cheats are typically implemented as dynamic libraries injected directly into the game’s process.

We will be developing an internal cheat, which means we’ll need not only the library itself but also an injector to insert our library into the game process. The injector will list the processes, identify the game process, allocate memory within it for our internal cheat, and then create a remote thread within the game to execute the cheat code.

Injector

Here’s what the code for our injector looks like.

DLL

Our library will consist of the following modules:

• Main module (dllmain.cpp)
• Hook module (directx_hook.cpp and directx_hook.h)
• Callback module (directx_hook_callbacks.h)
• Memory management module (memory.h)

Main Module

When our library is loaded via the LoadLibraryA function, a thread is created where two functions will be executed. The first function sets up a hook, and the second one renders the cheat menu and alters previously found values through keyboard inputs.

Hook Module

This module is designed to intercept the EndScene function, which is responsible for rendering scenes. This is necessary to render our menu.

Hooks

There are many types of hooks, but we will use the simplest one from this list—byte patching/inline hook. The choice is straightforward: our game only supports single-player mode, and other hooks are designed to bypass anti-cheat systems in multiplayer games, which we simply don’t need.

In the other modules, we will perform the following actions:

• Create a temporary Direct3D device and obtain its VF (Virtual Function) table to find the address of the EndScene function.
• Set up a temporary hook on the EndScene function.
• Upon executing the hook, perform a callback and pass the address of the device used to call the EndScene function. Then, remove the hook and restore normal execution of the EndScene function.
• Execute our run function.
• Return to the second step.

The purpose of all this is to ensure that our code renders the cheat menu and allows changes in the values of HP and ammo when buttons are pressed.

Callback Module

This module contains the function inline hook called endscene_trampoline, as well as the function init_endscene, which is the target for the hook to transfer control to. This function, in turn, will launch init_hook_callback to set up the hook. The function my_endscene will call endscene_hook_callback, which is responsible for executing the run function.

Memory Management Module

The Direct3DCreate9 function returns a pointer to the IDirect3D9 interface, which contains the virtual method table (VMT). The function we need, EndScene, is located at index 42 in this table. Therefore, we’ll write several functions to obtain the VMT, as well as to read, write, and change memory access permissions. You can find more details about virtual method tables on Wikipedia.

Functionality Check

We activate our cheat, take some damage, spend some ammo, press F1-F2, and watch as the HP and ammo values are restored to maximum. This means the cheat is working!

Conclusions

Using Cheat Engine, we learned how to search for the actual value of the variable we want to modify. Then, by using a debugger, we found static addresses for the values determined with Cheat Engine, allowing us to understand how the game engine operates. For example, there is a general function for obtaining player values such as health (hp) and ammunition (ammo), as well as a general function for recording changes to these values. With this knowledge, searching for other values will be much easier and faster. The code we’ve written can serve as a foundation or base for cheats in other games.