How to Locate What You Want to Find

## **A Note from Freddy:**

There are 9 distinct ways to locate whatever you wanna find. I hope you have read through the Basics section as the language here can be sophisticated.

## **A** **Brief Look at Server-Sided Values**

Are server-sided values highly secured and impossible to find? No, at least one address out of billions of addresses connect to a server-sided address/value; also, if the value isn't server-sided, it's likely to be encrypted. Either way, it's hard to find, but NOT impossible. Why? Your display in the game will never update itself if there's not a display value, but this value can be randomizing at all times. As seen from the Lordz.io hacks, despite the game being multiplayer, you can still change a lot of display values, although you aren't changing the actual bytes that store the values.

## **Summary**

1. Knowledge You Must Learn (Changing RAM vs Changing Encrypted Values)
2. The “Active” Method
3. The Elimination Method
4. The Double-checking Method
5. Enumerate DLL's Method
6. Pointer Scanning Without Using Pointers
7. The Memory Viewer Trick
8. The Display Type Trick
9. Pinpoint Flags

## **#1 Knowledge You Must Learn**

#### **Knowing What to Change**

To find what we want, we must first understand “how”.

Example: In Minecraft with cheats enabled, CE can detect values stored in your commands, and whenever you do something like “/weather set rain”, these values change. But every time you use a command, the actual weather changes, too. Do we want the values stored in commands? Can we use commands in survival? Nope.

#### **RAM and Encrypted Values**

Example of encryption: in Minecraft servers, you can’t use the item duplicate hack due to the difficulty of finding encrypted/server-sided values. RAM stands for Random Access Memory. Those are the values that can be easily changed. This is because it lacks updates (e.g. mov r11d,[rdx+000002A4]), comparisons (e.g. cmp r11d,esi), or encryption (xor r11d,[esi]). Since it lacks support, we can easily change its value. E.g. running speed, anti-gravity, and health.

## **#2 The Active Method**

Scan for changed values whenever something changes. Repeat until you are left with the least number of values possible. Say I am left with 100 addresses. ‘Ctrl+a’ half of the addresses and copy to addresslist. In your addresslist, ‘ctrl+a’ again and press ‘space’. Now try to change your weather. If nothing changes, then keep all addresses in your addresslist repeat the above. If something changed, delete all addresses in the addresslist and repeat the above.

## **#3 The Elimination Method**

Works for big Double values. Wdym by big? Anything greater than Double 0.09. Or float values greater than 1. All 4 Bytes work. Why do we care? It can easily crash if you try to access significant values. If the application is programmed by Java, it throws ACCESS\_VIOLATION\_EXCEPTION. Similar to #3 but instead of using “Active”, change the values. What’s the advantage of this? It’s much faster to hack.

## **#4 The Double-checking Method**

If you can find one address that contains the same AoB in both 4 Bytes and Double, then this is the value that you are looking for (significant values are often stored in multiple ways).

What’s AoB? See https://docs.google.com/document/d/1OtoQ8kG2cjLZa9utGBJCUskXkozlaky1BozGY6NJHvo/edit?usp=sharing

## **#5 Enumerate DLL's**

Once you connect CE to Minecraft (or any game, application), click on Memory Viewer. On the toolbar click on "View" and then click on Enumerate DLL's and Symbols. Double click on "java.exe" usually at the top. And right click on it and select Find. You may look for words like “potion”, “effect”, "jump", etc.

## **#6 Simpler and Alternative Ways to Pointer Scan**

**What's pointer scanning?**

This is covered later, but you don't need to know it for now.

**My method that triples the efficiency:**

Screenshot the list of addresses you find each time, and I want you to look at the ENDINGS of each address. It's just ridiculous (point scan for each hack? seriously?). Let's say the first time (before reloading the game) in the addresses you found, you find the endings: 0,0,4,0,4,4,4,0,8,8,8,C. If you change the values of addresses ending in 0s and the game crashes...the next time you won't be stupid enough to change the 0s again (you know the endings won't change). When you find the final address, record the ending of the address (and a brief description: e.g. health). I usually do this on a Notepad.

## **#7 The Memory Viewer Trick**

As you are in-game and after finding a value, expand your Memory Viewer to full-screen, and minimize your game. When you jump, place a tower, lose health, or whatever (just do something in the game), I want you to look for yellow or red flashing Bytes. Those are the significant values (well at least in Minecraft or BTD 5). Scroll up or down and look for more red-flashing Bytes. Locate the one that has an effect on your game display. If the game crashes when you test out a value, it's NOT the right one.

## **#8 Locating Values By Changing Display Types**

Sometimes, significant values crumple up together. In simpler games, they always do. Once you find a significant value, e.g. your Ammo. Right click on the Memory Viewer and select "Display Type". Play around with "4 Bytes DEC", "Bytes HEX", and "Float" (rarely Double). Scroll up and down to look for Flag values (taught in #9), small integers, small float values, and long integers that begin with "1" and do not have the number "4" in them. I usually test out the "11XXXX" and "12XXXX" first. It's just a trick that I found useful.

## **#9 Identifying Flags**

A flag by definition is a boolean value that signals on or off. If it's on, aka a value of "01", something starts! If it's not on, it's a "00". Usually, any byte in the form "01" is likely a flag. Change it to "00" and see if anything changes.

In Minecraft 1.15.2, my weather hack is based on this idea. A thunder-storm in bytes is "01 01"; rain in bytes is "00 01"; and clear weather is "00 00". Sometimes, some important values follow right after the flags, such as the time countdown for the next rain or thunder-storm.

## **Bonus Information**

Online (aka server-sided) games do protect vital game values, such as xp, health, etc. by storing them on the game servers instead of in RAM or can be accessed using a Memory Viewer.