Decompiling CheatEngineFiles & GamesTrainers

[punjab5]

@cw2k Can u please decompile this one with screen shots of steps then i will be able to decomple myself http://rghost.net/41559179

(11-07-2012 08:18 PM)cw2k Wrote:  Trainer are often written in asm or C.
These are zero terminate strings so it's not delphi...

maybe follow the references around ' drunk drive' like unk_100034d8.

However the API to write changes to another process is Kernel32.WriteProcessMemory find it in the Trainer and explorer what's happening around.

Or load it in Ollydebug set a breakpoint there (Ctrl+N -> WriteProcessMemory,...)
Maybe work with log-breakpoints however takes some time and is annoy to set them and write in cryptic Expression like [[esp+8]] to just get on fancy argument - and do it again to log an other.

Dumpers - well I use pretty old LordPE and somethings the little hidden dumper inside Import REConstructor(RC/advCmd/Select Code Section->Fulldump) or when in Olly the plugin Ollydump