recursal/Fanatic-Fandom huggingface dataset:
Uswium

> [Return to Locations]
>
>
> Uswiumi is a medium sized Tortle settlement residing in the **Ocean Name,** with an estimated population of 123456. Uswiumi is predominantly populated by Tortles, there are some who have brought themselves to Uswiumi to learn more about the ancient culture of Tortles.
>
>
>
>

## History

### Origins

The Uswi, a tribe of nomadic Tortles, settled on the island naming it Uswiumi, meaning '*Tortle Raft'.* As the Uswi tribe grew, the land began to expand outwards into the sea through stilt and shanty boat houses. Not long after the establisment of Uswiumi, more Tortle tribes began to migrate there as if something was drawing them in. The "Great Passage" would go on for centuries until all known Tortle tribes had traveled to Uswiumi.

### Birth of an Alliance

During the early decades of Uswiumi post-Great Passage, Tortles began to establish their own identiy as a society that would maintain the their free-spirit and philosophical ambitions. \*\*\*\*Insert info about govment\*\*\*\*. Once there was an established agreement amongst their people, an alliance was formed with the recently formed Busta Dynasty. The two factions share an intertwined birth regardless of their opposing mainstream cultures.

### Present day

While their society remains unchanged, the physical growth has not gone unnoticed. Through their usage of stilt houses and shantyboat houses, Uswiumi has created a bridge to the neighboring continent of Uskain. Through this geographic advancement, Tortles have become more curious of the worlds beyond their coastline leading some to become adventurers. Uswiumi continues to support the Busta Dynasty and now partner with the free Elves of Uskain.

## Geography

Located north-east of Uskain and south of Xaiven, Uswiumi is a rocky shore island that is relatively flat as you go more inland. Approximately 75,000 Tortles call Uswiumi their home. Though the island became nearly overpopulated within the first few years of the "Great Passage", Tortles began to use their carpentry skills and create raft towns made of shanty boathouses and stilt houses. While the island is approximately 702.176x109 **tortle measurement** (226,658 mi²)

### Location

Uswiumi is located in the Easter sea, nested between Xaiven and Uskain. It is now surrouned by tortle-made land through housing. With the great expansion of living space, a bridge was formed to connect Uswiumi and Uskain, becoming a major trade route between the two.

### Climate

The climate of Uswiumi is very mild compared to the rest of the world. Travelers deem it as a paradise as the water around the island seem almost impossibly calm. Tortles do not know storms within their homes, they do get rain regularly but almost as if its exactly as much as they need to continue their agricultural ventures.
Samuel Bellerive

Samuel at 24, dated 1873

Elizabeth Summers - Wife

Lillian Bellerive - Daughter

Albert Bellerive - Brother

John Bellerive - Uncle

Henry Bellerive - Uncle

**"Samuel Snyder Bellerive,"** was a log worker and union soldier, who lived in the town of Marshall, Nevada. He ran from his home in his childhood after his father was hanged and his mother was murdered by his uncle Henry, and met Elizabeth Summers. They eventually fell in love, but his willing departure to the army increased her fear of losing him after he had witnessed the apparition of his uncle John. Samuel then found out about her leaving him for his own brother once returning, and despite this, still married her eventually in time. However, her murder at the hands of Albert sent him down a path of dark depression as spirits and specters tormented him in his solace. He was able to make amends with Elizabeth's spirit and but took forgiving himself harder. Later on in his life, he became a miner, and set out to make a fortune for himself and his daughter after becoming estranged from her. The determined Samuel learned of a reserve of gold around the Grand Canyon and attempted to find it with his young companion Alo. The journey was long and tumultuous, and even having his team leave him, Samuel pressed on while Alo followed him. The two reached the gold, but Samuel was bitten by a rattlesnake. Having no choice but to succumb to his fate, Alo left him with a single bullet from a revolver while he left Samuel for good to return the gold to his daughter, also writing a letter to her as a goodbye. He then stared out at the sunset, thought about his life, and gave himself mercy pulling the trigger. Due to the path to the mine being buried by a mudslide, Samuel's bones were left sitting in the sun for over one hundred years. When they were rediscovered in 2001, the mine was renamed the Snyder mine, and his remains were buried by his descendants.
Brett Connor

Brett Connor was a private Military Leader During the Great Discordian War.

Brett Connor and his army would end up fighting on the side of De Clan, Adopting a similiar uniform with their own insignia.

Instead of Entrenchment and Line Warfare that the De Clanians experiment with early on, the BCA focused on advanced tactics, and were able to pull flanking manuvers to capture sectors easily. As a Liuetenant, Dustin Dunkley described the Brett Connors army soldiers as Defient and claimed they boosted moral during the winter months in Ornlo.

Brett Connor was hung in 18 AGR for "Impersonation of a High Ranking Army Officer" and warcrimes against the Ornloians and Mercadians.
Assembler:Commands:ADDSD

**command** addsd *destination, source*

Adds the source to the destination. Used for Adding Scalar Double-Precision Floating-Point Values. The addsd command can only be used with xmm registers.

```
Destination = Destination + Source
```

Adds the low double-precision floating-point values from the source operand (second operand) and the destination operand (first operand), and stores the double-precision floating-point result in the destination operand. The source operand can be an XMM register or a 64-bit memory location. The destination operand is an XMM register. The high quadword of the destination operand remains unchanged.

c9x.me/x86/html/file\_module\_x86\_id\_8.html

## Examples

```
addsd xmm0,xmm1

```

```
addsd xmm3,[edx+110]

```

```
addsd xmm15,[rdx+10]

```

```
addsd xmm5,[00123abc]

```

```
addsd xmm7,[UserDefinedSymbol]

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Cheat Engine:Speedhack

The speedhack lets a user speed up or slow down a game.

Useful for games where you have to be quick, or when you have a long walk ahead of you and don't want to waste time

One myth is that the speedhack can speed or slow down physical occurrence like download speed, or the speed other people connected to the server experience time. It does not.

If you're interested in how it works, check out Speedhack internals

Cheat Engine **does not** and **can not** speed up internet times. Tutorials about doing so simply trick your downloading software into thinking that your internet times are better. It does this by telling you to slow down your downloading software, and when the software is slowed down, the software has a longer idea of what a "second" is(setting your software to half would make it think it's double, etc). This means that more data is downloaded in the software's "second" as opposed to a real second, making the software think that a lot more data is being downloaded in a shorter amount of time than actually is being and the software will show a faster download time when the real download time is a lot slower. As this happens, the user will think that the software is downloading faster when it isn't.

Google Chrome runs plugins in a sandboxed environment, blocking file access, including loading the speedhack-i386.dll file. For 6.2 you can use the forced injection plugin to load the speedhack, but this plugin has not been ported to 6.3 yet.
For those that do wish to use speedhack on chrome, launch chrome with the parameter "-no-sandbox". Obviously chrome will bitch about this, but you will be able to use the speedhack without a problem
Assembler:Commands:MOVSS

**command** movss *destination, source*

Copies the data from source operand to destination operand. Used for Moving Scalar Single-Precision Floating-Point Values. The movss command can only be used with xmm registers.

Moves a scalar single-precision floating-point value from the source operand (second operand) to the destination operand (first operand). The source and destination operands can be XMM registers or 32-bit memory locations. This instruction can be used to move a single-precision floating-point value to and from the low doubleword of an XMM register and a 32-bit memory location, or to move a single-precision floating-point value between the low doublewords of two XMM registers. The instruction cannot be used to transfer data between memory locations.

When the source and destination operands are XMM registers, the three high-order doublewords of the destination operand remain unchanged. When the source operand is a memory location and destination operand is an XMM registers, the three high-order doublewords of the destination operand are cleared to all 0s.

c9x.me/x86/html/file\_module\_x86\_id\_205.html

## Examples

```
movss xmm0,xmm1

```

```
movss [edx+110],xmm4

```

```
movss [rdx+10],xmm8

```

```
movss xmm3,[edx+110]

```

```
movss xmm15,[rdx+10]

```

```
movss xmm5,[00123abc]

```

```
movss [00123abc],xmm12

```

```
movss xmm7,[UserDefinedSymbol]

```

```
movss [UserdefinedSymbol],xmm10

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Auto Assembler:registerSymbol

**Auto Assembler** registerSymbol(*SymbolName*)

Adds a symbol to the user-defined symbol list so cheat tables and the memory browser can use that name instead of an address.

Note: The symbol has to be declared in the script when using it.

Note: Use unregisterSymbol to remove the symbol from the user-defined symbol list.

## Examples

```
aobScan(SomeSymbol, 00 53 48 8D 64 24 E0)
registerSymbol(SomeSymbol)

```

```
aobScan(someAobSymbol, 00 53 48 8D 64 24 E0)
define(SomeInjectionSymbol,someAobSymbol+C)
registerSymbol(SomeInjectionSymbol)

```

```
define(SomeSymbol,00123ABC)
registerSymbol(SomeSymbol)

```

```
label(SomeSymbol)
registerSymbol(SomeSymbol)
```

## See also

* Auto Assembler
* Auto Assembler Commands

### Related Commands

* aobScan
* aobScanModule
* alloc
* dealloc
* createThread
* define
* fullAccess
* globalAlloc
* include
* label
* loadBinary
* loadLibrary
* readMem
* unregisterSymbol
* LUA ASM
Cheat Engine:Cheat Tables

Cheat tables are xml configuration files used by Cheat Engine. They can contain a list of addresses, which you might have to relocate yourself, or pointer based addresses that will find the new address automatically.

They can also contain Auto Assembler scripts which the user can easily enable/disable

You can add an address to your list two ways. *Automatically*, which can be done by double clicking an address in your scan-list, or manually, which means you'll fill in the address and type yourself. The "Add address manually" button can be found above your Cheat Table in Cheat Engine's main screen.

To save a list of addresses, just click the Disk icon at the top left of your CheatEngine. (Or press Ctrl + S)

To load a list of addresses, click the Open Folder icon at the top left of your CheatEngine. (Or press Ctrl + O)

Cheat tables are files ending in .CT

## Cheat Table Keys

The following keys can be used when the address list has focus:
Lua:Class:Addresslist

Addresslist **class**: (**Inheritance**: *Panel*->*WinControl*->*Control*->*Component*->*Object*)

Class for manipulating the Cheat Engine form's address list.

## Properties

Count : integer
The number of records in the table.
SelCount : integer
The number of records that are selected.
SelectedRecord : MemoryRecord
The main selected record.
MemoryRecord[*index*] : MemoryRecord
Array to access the individual memory records.
[*index*] : MemoryRecord
Default accessor.
## Methods

getCount() : integer
Returns the number of memory records in the address list.
getMemoryRecord(*index*) : MemoryRecord
returns a MemoryRecord object based on it's index.
getMemoryRecordByDescription(*description*) : MemoryRecord
returns a MemoryRecord object based on it's description.
getMemoryRecordByID(*ID*) : MemoryRecord
returns a MemoryRecord object based on it's ID.
createMemoryRecord() : MemoryRecord
creates an generic cheat table entry and add it to the list
getSelectedRecords() : MemoryRecord
Returns a table containing all the selected records
doDescriptionChange()
Will show the GUI window to change the description of the selected entry
doAddressChange()
Will show the GUI window to change the address of the selected entry
doTypeChange()
Will show the GUI window to change the type of the selected entries
doValueChange()
Will show the GUI window to change the value of the selected entries
getSelectedRecord() : MemoryRecord
Gets the main selected memory record.
setSelectedRecord(*memrec*)
Sets the currently selected memory record. This will unselect all other entries.
## Examples

```
local addressList = getAddressList()
if addressList.Count >= 1 then
  local mrHealth = addressList.getMemoryRecordByDescription('Health')
end
local mrMana = addressList.createMemoryRecord()

```

## See also

* Lua
* Script engine

### Related Functions

* getMainForm
* getAddressList
Assembler:Commands:MULSS

**command** mulss *destination, source*

Multiplies the source operand by destination operand. Used for Multiplying Scalar Single-Precision Floating-Point Values. The mulss command can only be used with xmm registers.

```
Destination = Destination * Source
```

Multiplies the low single-precision floating-point value from the source operand (second operand) by the low single-precision floating-point value in the destination operand (first operand), and stores the single-precision floating-point result in the destination operand. The source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The three high-order doublewords of the destination operand remain unchanged.

c9x.me/x86/html/file\_module\_x86\_id\_214.html

## Examples

```
mulss xmm0,xmm1

```

```
mulss xmm3,[edx+110]

```

```
mulss xmm15,[rdx+10]

```

```
mulss xmm5,[00123abc]

```

```
mulss xmm7,[UserDefinedSymbol]

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Lua:AOBScan

**function** AOBScan(***...***)

**function** AOBScan(*AOBString*, *ProtectionFlags* OPTIONAL, *AlignmentType* OPTIONAL, *AlignmentParam* HALFOPTIONAL)

Scans the currently opened process and returns a StringList object containing all the results.
Don't forget to free this list when done.
Byte value of higher than 255 or anything not an integer will be seen as a wildcard.

### Function Parameters

 ProtectionFlags
 AlignmentType
 AlignmentParam

* ***protectionflags*** is a string:
	+ Add a + to indicate that flag MUST be set and a - to indicate that that flag MUST NOT be set. (\* sets it to don't care)
	+ X = Executable
	+ W = Writable memory
	+ C = Copy On Write.

Examples:

```
 +W-C = Writable memory exluding copy on write and doesn't care about the Executable flag
 +X-C-W = Find readonly executable memory
 +W = Finds all writable memory and don't care about copy on write or execute
 "" = Find everything (is the same as "*X*C*W" )

```

* ***alignmenttype*** is an integer:
	+ 0 = No alignment check
	+ 1 = Address must be dividable by alignmentparam
	+ 2 = Address must end with alignmentparam

## See also

* Lua
* Script engine

### Related Functions

* autoAssemble
* disassemble
* getInstructionSize
* getPreviousOpcode
* allocateSharedMemory
* mapMemory
* unmapMemory
* readBytes
* readPointer
* writeBytes
* readBytesLocal
* readPointerLocal
* writeBytesLocal
* wordToByteTable
* dwordToByteTable
* qwordToByteTable
* floatToByteTable
* doubleToByteTable
* stringToByteTable
* wideStringToByteTable
* byteTableToWord
* byteTableToDword
* byteTableToQword
* byteTableToFloat
* byteTableToDouble
* byteTableToString
* byteTableToWideString
Mono:Lua:mono findMethod

**function** mono\_findMethod(*namespace*, *className*, *methodName*) **:** integer

Returns the method Id of the given method name in the given class name in the namespace.

### Function Parameters

 className
 methodName

## Examples

### In Lua Engine form

While attached to Cuphead.
**Input:**

```
return mono_findMethod('', 'PlayerStatsManager', 'TakeDamage')

```

**Output:**

```
:284818304

```

**Input:**

```
return mono_findMethod('Assembly-CSharp', 'PlayerStatsManager', 'TakeDamage')

```

**Output:**

```
:284818304

```

## See also

* Mono
* Mono Dissect Form
* Mono Structure Dissection
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic

### Related Functions

* mono\_class\_findMethod
* **mono\_findMethod**
* mono\_method\_getName
* mono\_method\_getHeader
* mono\_method\_getSignature
* mono\_method\_disassemble
* mono\_method\_getClass
* mono\_methodheader\_getILCode
* mono\_getILCodeFromMethod
* mono\_invoke\_method
Lua:process

**global variable** process

**type** (nil, string)

A variable that contains the main module name of the currently opened process

## Examples

When **not attached** to any process:

Code:

```
print(type(process))
print(process)
print('Attached to ' .. (process or 'NOTHING'))
if process then
  print('attached')
else
  print('Not Attached')
end

```

Output:

```
nil

Attached to NOTHING
Not Attached

```

With the same code as above and **attached** to the ***Cheat Engine Tutorial (64-Bit)***:

Output:

```
string
Tutorial-x86_64.exe
Attached to Tutorial-x86_64.exe
attached

```

Note: If attached, and the attached process closes the "process" variable will still contain the last attached process' main module name. But "readInteger(process)" can be used.

```
if process ~= nil and readInteger(process) ~= nil then
  print('Attached to ' .. process)
end

```

## See also

* Lua
* Script engine

### Related Variables

* dbk\_NtOpenProcess
* TrainerOrigin

### Related Functions

* getProcesslist
* getOpenedProcessID
* getProcessIDFromProcessName
* openProcess
* getForegroundProcess
* getWindowProcessID
* createProcess
* debugProcess
* dbk\_useKernelmodeOpenProcess
* dbk\_useKernelmodeProcessMemoryAccess
* dbk\_getPEProcess
Lua:openProcess

**function** openProcess(*processname*)

**function** openProcess(*processid*)

Causes cheat engine to open the provided processname or processid.

Please note that if you provide an integer in the form of a string openProcess will look for a process that has as name the specified number. Provide an integer if you wish to specify the PID.

Example:

```
 openProcess("game.exe")
 openProcess(7890)
 openProcess(tonumber("7890"))

```

## See also

* Lua
* Script engine

### Related Functions

* getProcesslist
* getOpenedProcessID
* getProcessIDFromProcessName
* createProcess
* openFileAsProcess
Tutorials:Lua:Setup Auto Attach

## How to setup a Lua auto attach script

**On the Cheat Engine main form press *Ctrl+Alt+L*** to open the cheat table Lua script form.

Now let's add the Lua script to auto attach to the process.

```
getAutoAttachList().add("Tutorial-i386.exe")
```

yep, that's probably all you need, it's what Cheat Engine generates for the trainers it makes. However, if you need more control for some reason, you can do it yourself with a timer and **openProcess**

## -------- Auto Attach
local autoAttachTimer = nil ---- variable to hold timer object
local autoAttachTimerInterval = 1000 ---- Timer intervals are in milliseconds
local autoAttachTimerTicks = 0 ---- variable to count number of times the timer has run
local autoAttachTimerTickMax = 5000 ---- Set to zero to disable ticks max
local function autoAttachTimer\_tick(timer) ---- Timer tick call back
---- Destroy timer if max ticks is reached
if autoAttachTimerTickMax > 0 and autoAttachTimerTicks >= autoAttachTimerTickMax then
 timer.destroy()
 end
---- Check if process is running
if getProcessIDFromProcessName(PROCESS\_NAME) ~= nil then
 timer.destroy() ---- Destroy timer
 openProcess(PROCESS\_NAME) ---- Open the process
end
 autoAttachTimerTicks = autoAttachTimerTicks + 1 ---- Increase ticks
end
autoAttachTimer = createTimer(getMainForm()) ---- Create timer with the main form as it's parent
autoAttachTimer.Interval = autoAttachTimerInterval ---- Set timer interval
autoAttachTimer.OnTimer = autoAttachTimer\_tick ---- Set timer tick call back

**Set the process name to the process you are attaching to**, use the full process name from the process list.

**Launch the process** then **click *execute script* in the cheat table Lua script form**.

You should see the process name at the top of the Cheat Engine form.

Now when ever the cheat table is opened Cheat Engine will attempt to run the *cheat table Lua script* which will start the auto attach timer. By default Cheat Engine will ask to run the *cheat table Lua script*.

Note: You can change what Cheat Engine does with the *cheat table Lua script* in the Cheat Engine *general settings*.
Sandbox

<subtab></subtab>

Some usable mark-ups for pages are: (Use Edit to see how to write most of them)

Like in HTML < br> will cause a breakline/new line.

 List Item two

 Short list item

Lists like these will have two columns, the second one starting right after the longest list item in column one.If you add more |'s per item (Items start with a "|-") you'll get more collumns.

To make a header:

## Header Name

--193.109.72.245 08:27, 9 September 2009 (UTC)

= Signature, can be done by clicking the button above, or by typing "--" followed by "~"x4. Using less/more "~" will give less/other information.

--193.109.72.245

= 3x "~"

--08:30, 9 September 2009 (UTC)

= 5x "~"

Dddddddd

## Test it out below!

poopy

cRaIg WuZ hErE

♥♥♥ Nathaniel Likes Yesenia :D ♥♥♥ <-- fake news

Template:User Block: 192.168.1.241
'***Bold text**gnfnfnnnnnnnnnnngzfz pooooooooooookkkkkaaaaaaaaaaaaa KA-MEE-HAAAA-ME-HAAAAAA!!!!*

## LUA Forms

You can create new forms using the menu "Table->Create Form". After you create a form it will show up in the menu with sub-menu options to show it and edit it.

### Forum Posts

* Post: Script for creating a LUA script from a form

Just testing that I didn't break page edits
Assembler:Commands:SUB

**command** sub *destination*, *source*

Subtracts the source from the destination.

The **OF**, **SF**, **ZF**, **AF**, **PF**, and **CF** flags are set according to the result.

```
destination = destination - source

```

Subtracts the second operand (source operand) from the first operand (destination operand) and stores the result in the destination operand. The destination operand can be a register or a memory location; the source operand can be an immediate, register, or memory location. (However, two memory operands cannot be used in one instruction.) When an immediate value is used as an operand, it is sign-extended to the length of the destination operand format.

The SUB instruction performs integer subtraction. It evaluates the result for both signed and unsigned integer operands and sets the **OF** and **CF** flags to indicate an overflow in the signed or unsigned result, respectively. The **SF** flag indicates the sign of the signed result.

c9x.me/x86/html/file\_module\_x86\_id\_308.html

## Examples

```
sub al,1

```

```
sub ax,1

```

```
sub eax,1

```

```
sub rax,-1

```

```
sub [eax],0x9

```

```
sub [rax],1

```

```
sub [rax],rsi

```

```
sub eax,[rax]

```

```
sub rax,[rax]

```

```
sub [SomeSymbol],1

```

```
sub [SomeSymbol],eax

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* wikipedia.org/wiki/X86\_instruction\_listings
* wikibooks.org/wiki/X86\_Assembly/Other\_Instructions
* c9x.me/x86/
* ref.x86asm.net
Reaper

## The Reaper

> "The bell tolls..."
>
>

> *—Reaper*
>
>

## Description

The Reaper is the fourth of twelve Legendary minions, residing in Group 2.

It spawns by merging two level 5 Lecterns. When spawned, you will receive a level 1 Lectern via Skully.

The Reaper produces 25 Mana and adds 20% to your damage multiplier.

It gives a 20% Time Shard bonus with a 10% bonus for each subsequent Reaper. Having the Reaper, Cyclops, and Archdemon provides a 40% Time Shard bonus.

It can be merged with the Lich to create the Cursed.

It can be fed to The Devourer with 10 or more Legendary minions inside the Lair.

## Trivia

* The total cost to summon a Reaper is 1600 Ice Runes and 640 Moon Runes.
Scripting

**CE AA**, *Cheat Engine Auto Assemble*.

Definitions:

Opcode

Bytes that are machine operational bytes and is executable.
Code

Any thing that is, or can be converted to, opcode and is executable.
Script

Text that is more human readable. To be converted to opcode and executed.
Injection

Replacing bytes in a processes memory, this term is most often used when referring to redirecting running opcode.
Assembly, ASM

Any programming language (low level language) that is processor specific. To be converted to opcode and executed.
Assembler

Any program or tool that converts assembly to opcode.
Compiler

Any program or tool that converts script/code to opcode, and saves it as an executable file.
Interpreter

Any program or tool that converts script/code to opcode, and executes the opcode.
Auto Assembler

A super sweet interpreter and assembler, that **Dark Byte** made.
Lua

A super sweet programming language, with lots of extra stuff that **Dark Byte** added. (Note: The language is not written by *Dark Byte*)

**Scripting** in general is creating/using a small piece of code to perform a required tasks. **Scripts** are usually interpreted not compiled.

In **Cheat Engine**, with the use of **Auto Assemble** you can write 10s to 100s or even a 1000s lines of instructions using either **Assembly** or **Lua** to be injected in a process memory to do some modifications.
**Auto Assemble** is the IDE where you write your code and there is nearly no limitations, you have the choice to either mix your code using both **Assembly** and **Lua** or to use one of them.

* Using Assembly Language
* Using Lua Language
Cheat Engine:Debugging

Cheat engine has some basic and some more advanced debugging options at it's disposal.

* Break and single stepping/stepping over
* Find out what Accesses/Find out what writes
* Change register on breakpoint

Cheat engine also gives the ability to use some debugging from kernelside so the debugger isn't picked up as one with the normal methods of detections. This can be further enhanced with dbvm wich even cloaks the interrupt editing part.

Currently(2009) kernel debugging only works with a few but useful functions: "Find out what Accesses/Find out what writes" and "Change register on breakpoint" , currently(2009) no single stepping with the kernelmode routines are possible, but it's currently(2009) being worked on, and you may expect to see a version of Cheat Engine in the future which DOES contain the ability to single step using these routines.

Useful hotkeys while debugging:

* f4 run till
* f5 set breakpoint
* f7 step into
* f8 step over
* f9 run
Assembler:Commands:SUBPS

**command** subps *destination, source*

Subtracts the source from the destination. Used for Subtracting Packed-Single-Precision Floating-Point Values. The subps command can only be used with xmm registers.

Performs an SIMD subtract of the four packed single-precision floating-point values in the source operand (second operand) from the four packed single-precision floating-point values in the destination operand (first operand), and stores the packed single-precision floating-point results in the destination operand. The source operand can be an XMM register or a 128-bit memory location. The destination operand is an XMM register.

c9x.me/x86/html/file\_module\_x86\_id\_310.html

## Examples

```
subps xmm0,xmm1

```

```
subps xmm3,[edx+110]

```

```
subps xmm15,[rdx+10]

```

```
subps xmm5,[00123abc]

```

```
subps xmm7,[UserDefinedSymbol]

```

```
[enable]

 ; ...

 alloc(newmem,$100)
 globalalloc(sse,$10)

sse:
 dd (float)3000
 dd (float)5000
 ; dd (float)7000 ; can be used upon requirements
 ; dd (float)1000 ; can be used upon requirements

 ; ...

newmem:
 subps xmm0,[sse]

 ; ...

 jmp return

 ; ...

return:

 [disable]

 ; ...
```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Tutorials:Finding values:Integers

The most basic thing to do with Cheat Engine is to find Values to change or freeze.

So let's go over how to find some integer values.

Any game will work but I will be using **Windows Solitaire**.
And *Windows Solitaire* is a good game for integers.

If unsure how to attach to the process see: How to attach to a process

## Integers

Integer
Integers are whole numbers, or numbers that are not fractions.
wikipedia.org/wiki/Integer

### Score

Lets start with the score.
If you play or have played a round then you know that the visible score is an integer,
that it's increased by moves and decreased with time, and starts at zero.

Now in this small game scanning for zero should be fine but **it's best not to scan for zeros** (use *Unknown initial value* for the first scan).

#### Step 1

So **make some moves to increase the score**, I got 5 points (watch the score so you are scanning for the correct value).

On the Cheat Engine form in the value text box **enter the current score** and **click *first scan***.

You should see a list of values.

#### Step 3

Again **make some moves to increase the score**, I got 13 points.

**Reenter the current score** and **click *next scan***.

Note: You won't always get just 1 address.
Edit by ElvisDepressedly: I have discovered that instead of searching for the value. after your initial search, lets say '13', select scan type and increased value by or decreased value by, followed by the amount will locate that specific address very quickly. So, instead of searching for 13, 17, 21, 29, etc. If you search for 13, increased value by 4, increased value by 5, et cetera, you find the address you are looking for faster so you don't have to search as long.
#### Step 4

And you would do this, scanning for increased values and letting it decrease to scan for that value,
until a value or list of values that looks right is captured.

Note: To confirm a value; change it and/or freeze it, and see if it has an effect in the game.
#### Step 5

So now that you have an address **double click it in the found list**,
and **it should create a memory record in the address list** of the cheat table.

Double click the value to change it and enter 5000.
You should now have 5000 as a score.

### Basic Timer

We know that the visible timer is an integer, which isn't common but it's a good timer to start with,
and it increases by one about every second.

#### Step 1

So **click *new scan***, then **enter the current timers value** and **click *first scan***.

Tip: Click the  ***Advanced Options***  to open the form and have a  ***Pause (process)***  button.
Tip: Enter a value just above the timers value and wait for it to hit that value to scan.
#### Step 2

Then **reenter the current timers value** and **click *next scan***.

Keep doing this like with the score until a value is found.

## Freezing Values

When you have the address in the address list you can click the box to freeze the address.

Note: You won't always get just 1 address.

Note that the timer still shows '1' as a value, to change that we would need to use code injection.

See: Code Injection Basic
Tutorials:Add address to list

## How to add addresses to the address list

There are a few ways to add addresses to the cheat table address list.

The way to add addresses from the found address list is to double click the address, with the address(es) selected click the red arrow, or with the address(es) selected right click the address and select *add selected addresses to the address list*.

You can also add addresses manually by clicking the *add address manually*.

You'll see a form like the one on the left, if you check the *pointer* check box then it will look like the one on the right.

Just setup the address or pointer as needed and click the *OK* button.

Use the *add offset* and *remove offset* buttons for multiple level pointers.

## Setup

Set the address or base address, depending if it's an address or pointer.

**Types**:

* **Binary** : *integer*
* **Byte** : *integer*
* **2 bytes** : *integer*
* **4 bytes** : *integer*
* **8 bytes** : *integer*
* **Float** : *float*
* **Double** : *float*
* **Text** : *string*
* **Array Of Bytes** : *bytes*

You will get some extra options if you select one of these types:

*Binary*:

*Text*:

*Array Of Bytes*:
Assembler:Commands:MULSD

**command** mulsd *destination, source*

Multiplies the source operand by destination operand. Used for Multiplying Scalar Double-Precision Floating-Point Values. The mulsd command can only be used with xmm registers.

```
Destination = Destination * Source
```

Multiplies the low double-precision floating-point value in the source operand (second operand) by the low double-precision floating-point value in the destination operand (first operand), and stores the double-precision floating-point result in the destination operand. The source operand can be an XMM register or a 64-bit memory location. The destination operand is an XMM register. The high quadword of the destination operand remains unchanged.

c9x.me/x86/html/file\_module\_x86\_id\_213.html

## Examples

```
mulsd xmm0,xmm1

```

```
mulsd xmm3,[edx+110]

```

```
mulsd xmm15,[rdx+10]

```

```
mulsd xmm5,[00123abc]

```

```
mulsd xmm7,[UserDefinedSymbol]

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Basilisk

## Description

The Basilisk is a Forgotten Minion that can be summoned by merging a max level Snake and Golden Goose when the Ancient Tablet allows. Its effect is that it will deal a base value of 750 damage to a random enemy currently on the board whenever an egg is merged, and has up to 20 uses. Thus, it will deal 15,000 base damage with all 20 attacks, making it the minion with the highest damage potential, 50% ahead of a maxed out Stab-O.

Requires The Devourer level 55 to be offered.
Assembler:Commands:MOV

**command** mov *size* *destination*, *source*

Sets the destination to the source.

Copies the second operand (source operand) to the first operand (destination operand).
The source operand can be an immediate value, general-purpose register, segment register, or memory location;
the destination register can be a general-purpose register, segment register, or memory location.
Both operands must be the same size, which can be a byte, a word, or a doubleword.

c9x.me/x86/html/file\_module\_x86\_id\_176.html

### Command Parameters

 destination
 source

## Examples

```
mov eax,0

```

```
mov rax,-1

```

```
mov [eax],0x9

```

```
mov [rax],1

```

```
mov [rax],rsi

```

```
mov eax,[rax]

```

```
mov rax,[rax]

```

```
mov byte ptr [rax],0

```

```
mov word ptr [rax],0

```

```
mov dword ptr [rax],0

```

```
mov qword ptr [rax],0

```

```
mov rax,SomeSymbol

```

```
mov rax,[SomeSymbol]

```

```
mov SomeSymbol,rax

```

```
mov [SomeSymbol],rax

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* wikipedia.org/wiki/X86\_instruction\_listings
* wikibooks.org/wiki/X86\_Assembly/Other\_Instructions
* c9x.me/x86/
* ref.x86asm.net
Mono:Lua:mono method getClass

**function** mono\_method\_getClass(*methodId*) **:** integer

Returns the class Id a method belongs in.

## Examples

### In Lua Engine form

While attached to Cuphead.
**Input:**

```
local mId = mono_findMethod('', 'PlayerStatsManager', 'TakeDamage')
return mono_method_getClass(mId)

```

**Output:**

```
:284773608

```

## See also

* Mono
* Mono Dissect Form
* Mono Structure Dissection
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic

### Related Functions

* mono\_class\_findMethod
* mono\_findMethod
* mono\_method\_getName
* mono\_method\_getHeader
* mono\_method\_getSignature
* mono\_method\_disassemble
* **mono\_method\_getClass**
* mono\_methodheader\_getILCode
* mono\_getILCodeFromMethod
* mono\_invoke\_method
Assembler:Commands Tables

# Auto Assembler Commands

This is a list of all the Auto Assembler commands

* aobScan: Will scan the memory for the given array of byte (Wildcards are supported) and places a label at the first match
* aobScanModule: Will scan the specific module for the given array of byte (Wildcards are supported) and places a label at the first match
* aobScanRegion: Will scan the specific range for the given array of byte (Wildcards are supported) and places a label at the first match
* label: Enables the word labelname to be used as a address
* alloc: Allocates a region of memory with a label that points to it
* dealloc: Deallocates a block of memory allocated with alloc
* globalAlloc: Will allocate a certain amount of memory and registers the specified name
* kAlloc: Kernal allocate
* fullAccess: Makes a memory region readable, writable and executable
* reassemble: Reassembles the given address, writing at it's declared location.
* readMem: Read a memory region and writes it at the location this instruction is placed
* registerSymbol: Adds the symbol to the userdefined symbol list
* unregisterSymbol: Removes the symbol from the userdefined symbol list
* define: Will replace all tokens with the specified name with the text of whatever
* assert: Will check the memory address for the given bytes
* include: Includes another auto assembler file at that spot
* createThread: Will spawn a thread in the process at the specified address
* createthreadandwait: Will spawn a thread in the process at the specified address and waits till it returns
* loadLibrary: Will inject the specified dll into the target process
* loadBinary: Will load a binary file at the specified address
* struct / endStruct: With STRUCT and ENDSTRUCT you can define an internal structure in your auto assembler script
* luaCall: Executes the given Lua code
* {$LUA} / {$ASM}: {$LUA} (Lua) and {$ASM} (Assembler) will begine the given parser
* {$STRICT}: {$STRICT} will force label declaration, by throwing an error
* align: Tells the assembler to align for a given byte size.
* {$TRY} / {$EXCEPT}: Code between {$TRY} and {$EXCEPT} blocks will jump to the {$EXCEPT} part when an exception happens
* {$LUACODE} / {$ASM}: Execute the given lua code inside CE's context whenever the target process executes this code
* {$CCODE} / {$ASM}: Execute the given C code inside the target's context whenever the target process executes this code
* {$C} / {$ASM}: Compile the given code within the C block inside the targer process
Auto Assembler Example 2

I found the following code that calls a function to set the player's health when he is injured. The player's new health is in the ESI register:

```
00792B4C - 56                         - push esi
00792B4D - 8B CF                      - mov ecx,edi
00792B4F - E8 AC782D00                - call 00A6A400

```

To keep the player at full health, I decided just to change the value of ESI to be 200. Here's a script that does several things on ENABLE:

1. Allocate memory for my code inside the opened process
2. Assemble my code and write it into the allocated memory
3. Replace original code in the game with a jmp to my code

Note that since we're replacing these three instructions above with the *jmp* instruction, we have to execute them in our code.

```
[ENABLE]
alloc(GodCode,512)  // allocate memory for our injected code
label(GodReturn)    // GodReturn label is where we will jump back to
registersymbol(GodCode)

GodCode:     // start assembling into our allocated memory
mov esi, c8  // set the new health value to be 200

// this is the original code we over-wrote with "jmp GodCode"
push esi
mov ecx,edi
call 00A6A400

jmp GodReturn  // jump back to the following instruction

// now we start assembling at a new address, replacing instructions
// in Sam3.exe with a jump instruction that will call our code.
00792B4C:
jmp GodCode
db 78 2D 00 // original bytes

GodReturn:  // will be set to 792B54, where we want to jump back to

```

When disabling, we just free the memory we allocated and assemble the original instructions back into place:

```
[DISABLE]
// free our allocated memory
dealloc(GodCode)

// replace the jump instruction in Sam3.exe with the original code
00792B4C:
push esi
mov ecx,edi
call 00A6A400

```
Elizabeth Summers

Mar-(?) Summers - Unknown Mother

**"Elizabeth Lillian Summers-Bellerive,"** was the brief wife of Samuel Bellerive. She grew up in the Summers residence and met Samuel as a child. They bonded through the years and became lovers. Elizabeth then chose to marry Samuel when they were of age but fell out of love for him when he hot headily chose to join the Union army, instead taking an interest in his brother Albert. Samuel, upon returning from the war, met up with her and gained the knowledge that she had lost love for him. However, he chose not to speak to it, and was instead simply going to apologize to her for leaving. Elizabeth saw him do this and chose to leave, admitting that it was both their own mistakes and that they had to own up to them by going their separate ways. However, the two met once again two years later, and rekindled their relationship, and eventually once again planned to marry. Once alone on their wedding night, she was abducted by someone who took her out to the forest. It is here she was murdered. Elizabeth later returned as a monstrous specter, damned to walk the Earth until she was given peace. She eventually tried to take revenge for her murder when Samuel admitted to her that it was a jealous Albert, who she was still in a relationship with at the time, murdered her. He asked her to forgive herself for her mistake, but that she never deserved to die, he always loved her, and he had forgiven her as well. Elizabeth then realized what she had become and returned to herself, disappearing into the distance as she walked into the morning sunrise.
Tutorials:Videos

Basic:

* Cheat Engine and Memory basics
* Tutorial Step 1 (No video, just click next...)
* Tutorial Step 2
* Tutorial Step 3
* Tutorial Step 4
* Tutorial Step 5
* Tutorial Step 6
* Tutorial Step 7
* Tutorial Step 8
* Tutorial Step 9
* Graphical Tutorial Step 1
* Graphical Tutorial Step 2
* Graphical Tutorial Step 3

Advanced:

* Scripting
* Lua examples
* Ultimap 1/2 and Code filter
* dll injection and parameters to change the behaviour
* mono

Expert:

* Kernelmode hooking using dbvm and lua
* writing your own interrupt handler
* dbvm internals
Eye Monsters

> "I need more eyes on things."
>
>

> *—The NecroMerger*
>
>

## Description

Eye Monster components spawn from Supply Cupboards And Fridges level 1 and above. Generates Mana and can be fed to The Devourer for Food.

* Used in Making Ogre and Floating Skull
## Stats

Complete stat list for Eye Monsters (Base Values, Check Buff Bonuses for Possible Multipliers)

Feed

+1

Feed

+2

Lvl 1

Makes

+2

Feed

+15

Lvl 2

Makes

+4

Feed

+35

Lvl 3

Makes

+6

Feed

+80

Lvl 4

Makes

+9

Feed

+200

Lvl 5

Makes

+12

Feed

+500

Lvl 6

Makes

+15

Feed

+1250
The Hacker

## Description

The Hacker is a post-prestige NPC who sells upgrades to the The Inventor's inventions. Each invention has two upgrades, one for prestige currency and one for premium currency. The Hacker can be unlocked using 25 Astro Coins and 150 Moon Runes to form the first Rift Item and then another 25 Energy Cubes and 150 Death Runes to open the Rift and then summon them.

The upgrades are as follows:

File:Temprobotupgradespage.png

 Stab-o
 Split-o
 Store-o

Like all aliens (except the Inventor), all purchases made in their shop remain after prestiging.
Mono:Lua:mono getJitInfo

**function** mono\_getJitInfo(*address*) **:** table

Returns a table with the properties given the address of code in memory.

method - integer
the method id
code\_size - integer
length of code in bytes
code\_start - integer
address where method code begins
jitinfo - integer
?? address of the *jitinfo* ??

## Examples

### In Lua Engine form

While attached to Cuphead.
**Input:**

```
return mono_getJitInfo(getAddress('PlayerStatsManager:TakeDamage'))

```

**Output:**

```
:table
[
   method = 284818304
   code_size = 395
   code_start = 432511608
   jitinfo = 631989424
]

```

## See also

* Mono
* Mono Dissect Form
* Mono Structure Dissection
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic

### Related Functions

* **mono\_getJitInfo**
* mono\_compile\_method
* mono\_free\_method
Guzzlers

## Description

Guzzlers can be spawned with components from the Crashed Saucer level 4 and above. Can be fed to The Devourer for Food.

Guzzlers will passively grow and gain food value with all Food you give the Devourer, basically doubling your Food yield, except when the Devourer is fed other guzzlers. The Food you feed the Devourer gets evenly divided by the number of incompletely full Guzzlers you have in the Lair.

Their base maximum capacity for holding food is 20k.
The Keeper

## Description

> *A strange alien.*
>
>

The Keeper is an NPC found in the Central Chamber he is the first NPC found after interacting with the Tip Stone after Devourer Level 35 for the first time.

He sells rifts for (in order)

1. 25 Moon Runes
2. 25 Death Runes (Unlocks the Time Machine)
3. 5 Time Shards
4. 10 Time Shards (Unlocks The Inventor)
5. 10 Cosmic Runes
6. 25 Cosmic Runes (Unlocks The Archaeologist)
7. 10 Astro Coins
8. 25 Astro Coins (Unlocks The Dietician)
9. 5 Energy Cubes
10. 10 Energy Cubes (Unlocks The Architect)
11. 50 Astro Coins
12. 25 Energy Cubes (Unlocks The Surgeon)
13. 75 Cosmic Runes
14. 150 Cosmic Runes (Unlocks The Stylist)
15. 25 Astro Coins, 150 Moon Runes
16. 25 Energy Cubes, 150 Death Runes (Unlocks The Hacker)
Cheat Engine:Internals

## Speedhack

CE has 2 different types of speedhack.
The old one and the new one.

The old one is located in speedhack.pas of the cehook project (cehook.dll)
When it gets activated it uses a simple hook on those functions (just place with a hook and never even bother calling the original function)
It then starts a very high priority thread in the game which will increase time counters for itself using timed sleeping. The speed the time increments with is determined by the speed variable

When the game then calls those functions, it just fetches the emulated timer functions and passes it to the caller.

The new one is a bit more complex, but less prone to bugs because of a too low sleeptime, or too high, and no thread that counts time for you.

The source for this is located in speedhack2.pas in the main program, and the separate speedhack project
The speedhack.dll gets injected into the target process and the dll itself has some exports, like speed, addresses of original functions, and an initialize speedhack routine

Here the hooking and controlling takes place from CE's side and it's auto assembler functions.
What it does is it first uses the API hook template script on the to hook functions. This results in a script that can be used to hook the functions and fills in some predetermined addresses with the location to call if you want to call the original function (thats what the exports for the original functions are for)

After it's hooked the export "speed" of the dll is modified to the wanted speed and CreateRemoteThread is called with the address of the Initialize function to start start the speedhack and set a base of reference (the current time)

Then when a timer function is called it will calculate the new time based on the initial time the speedhack got started , the current time, and the speed. returned time = basetime+((currenttime-basetime)\*speed)

When speed is modified the basetime itself is modified as well to make sure the time doesn't go backwards