recursal/Fanatic-Fandom huggingface dataset:
Meredith

**"Meredith,"** last name unknown, was a house slave living under the Bellerive family. She was born to another woman who died in childbirth and was raised under slavery her entire life. Due to her life being made easy for her growing up, Meredith payed little attention to the real affects of slavery, simply seeing as a way of life, and naively believing she could live comfortable for the rest of her life. Upon being moved to another plantation, the outwardly spoken girl was defiant and payed the price greatly. She was also exposed to things she had never seen before, being forced to watch men die for fun. Lonely and broken, she formed a relationship with a man named Carl, and a friendship with a little girl named Jenny who grieved over the loss of her mother. This bond then grew into a mentorship, as Meredith felt herself wanting to teach Jenny things when she wanted to learn. One day, Jenny attempted to hide something from Meredith, but the young woman was frightened upon learning that Jenny's father had been abusing her. The feeling of needing to protect inside Meredith began to grow, as did her hatred of slavery and the way human beings around her were treated. Many times she tried to protect Jenny, but was pushed to the side. Once finding out Jenny had gone missing, Mery pieced together a conspiracy that lead her to believe Jenny had been killed by her own father. The grief stricken woman then poisoned the man and admitted to it. This was also when it was revealed to her that Carl was in fact the murdered spirit of her mother's boyfriend. She then convinced him to forgive himself for his own death. The action of poisoning Thomas Bellerive and his son would then cost her her life and she was lynched, vowing to meet Jenny in the afterlife having avenged her death. The could have been in vain, however, as it is uncertain whether or not Jenny actually died as her body was never found. She herself was eventually avenged, in a way, when John Bellerive tracked down Henry and shot him to death.
Evaline Wellington

**Evaline Wellington** was a De Clanian officer serving in the 2nd Lancaster Regiment of the 1st Loyal Infantry Division during the Sixth Great Crusade and Lewiston Uprising.

Lieutenant

## Military Service

### Commands

Under command of Chief of Staff : Nicholas Edward Carter II, 2nd Royal Lancaster Regiment.

### Military Awards

Sixth Great Crusade Campaign Ribbon w/ Rossette, Legion of Sante-Anna, Legion of the SMLE, Double Diamond of the Fallen (Post-Humoursly)
DBVM

If interested in booting with DBVM, see DBVM Booting

## What is DBVM?

DBVM is a ultra-lightweight virtual machine host that makes Windows run in a virtual machine
so that Cheat Engine can operate at a higher level than the OS using a device driver. Instead
of virtualizing devices it generally passes on interrupts unaltered meaning it has a very
small impact on performance.

## Using DBVM

To see if your system supports DBVM, RIGHT-CLICK on the Cheat Engine icon in the top-right corner
of the main Cheat Engine window to open the "About" screen:

If the bottom of the window says in green "Your system supports DBVM", right-click on that message
to load the kernel driver and attempt to switch to DBVM:

You should see a flashing colored message that the driver loaded and a message box saying that
DBVM may crash your system and asking if it's ok to continue. When you click 'OK' or wait for the
message box to close, the driver will attempt to switch all of your cpu cores to running in the
VM. If successful, the message will change to "Your system is running DBVM version X".

Finally, go to the "Edit" menu and pick "Settings". Under "Debugger Options" you can select
"Use kernelmode debugger":

If the message is red and says that your system does not support DBVM, then you may have an old processor that lacks the new commands required. You may also have some other virtualization enabled. If you have Windows 7 or 8, open the control panel, click on "Programs" and click on "Turn Windows features on or off" under "Programs and Features". Make sure that "Hyper-V" and it's components are all unchecked, which will require a reboot if you made changes.

## CLOCK\_WATCHDOG\_TIMEOUT BSOD

According to Dark ByteThere is about a 1:5 chance for each core that when it is offloaded to the VM it will cause a CLOCK\_WATCHDOG\_TIMEOUT bluescreen of death. This means with 1 core you have an 80% chance of being ok, with 2 a 64% chance, with 8 you only have a 16% chance of not crashing. I believe this core count includes virtual cores for hyperthreading. If you wish to decrease your chances of crashing when starting DBVM you can run 'msconfig', click on "Advanced options" in the boot tab and lower the number of processors to use, then reboot:
Betty

**"Betty,"** real name unknown, was the specter of a middle aged woman in the dark place. Her death was possibly from an overdose of drugs seeing as her face was abnormally dark blue, but it is possible she was related to, or could have possibly been the mother of Francis Moulin. Her spirit being protective of him supports this. She was known to sing and could imitate voices, drawing people in to take them to the afterlife. This made her one of the most dangerous spirits due to her actions not being intentionally malevolent as she seemed to do it to give others peace, not seeming to realize she was killing people.
Jennifer Bellerive

Meredith - Surrogate Mother

John Bellerive - Step-uncle

Charles Bellerive - Step-uncle

**"Jennifer Magdalene Bellerive,"** was the child of the oldest son of the Bellerive family, Henry Bradley. It is believed she was frequently abused by him when her mother died, although this has never truly been proven. This brought her to seeing Meredith, a house slave, as a mother figure. When Jenny witnessed her own father murdering a man, she held firmly to the fact that she had to tell her grandfather. Her own father, realizing he could find no way out of this, is thought to have drowned Jenny in the creek, as only pieces of her yellow dress were found on the ground next to it, meaning she probably fought him. Mery found out about the murder and pieced together the cover up. She attempted to poison Bradley to death but was hanged, vowing that she would see Jenny again in the afterlife. Jenny could have still survived the encounter however, as subsequent accounts of a Jennifer Calcourt began circulating in the 1850's of a woman who claimed to be the missing child. Her claims were dismissed due to a lack of actual evidence.
Henry Bellerive

Jennifer Bellerive - Step-daughter

John Bellerive - Brother

Charles Bellerive - Brother

Unknown - Wife

**"Henry Bradley Bellerive,"** was a moonshiner and gangster. He was the oldest son of Thomas and Sarah Bellerive. As a child, he became friends with a male slave, Carl, but pushed him off of a cliff when he began talking to a woman he was jealous of. His father helped the boy cover it up and this haunted him for years. Once his wife died later on in his life, he was left with only a young daughter, Jenny, whom he was abusive toward. He grew especially jealous of his daughter's relationship with a slave named Meredith which was only stoked more due to his racism. It is believed he killed a man who owed him money but only realized afterward that Jenny witnessed the crime. The deluded man took it upon himself to realize that his daughter would carry knowledge of this murder forever and might have drowned her. He was poisoned after this by Mery but was just able to cling onto survival, albeit after the loss of his father from the same thing. The cowardly man then headed out westward, hoping to make his fortune swindling those enticed by the California Gold Rush. He did not anticipate the arrival of John Bellerive, his younger brother, who had been tracking him for years. His gang eventually killed the family of another one of his siblings and in a blind age, Charles hunted and killed them on his own. Then Henry, a man who had ruined his reputation beyond repair, made an attempt to flee after finding out that John was coming for him. He fled into the woods but was caught, making one final toast before being shot through his glass by John and dying instantly.
1838

The year 1838 was a year with many events. These include but are not limited to:

* The houseslave Meredith became the surrogate mother of Jennifer Bellerive
* Jennifer Bellerive went missing
* Henry and Thomas Bellerive were poisoned by Meredith, leading to Thomas' death
* Meredith was lynched
* John and Charles Bellerive ran away from home
* Sarah Bellerive was beaten to death in retaliation for Meredith's hanging
Sarah Bellerive

John Bellerive - Son

Charles Bellerive - Son

Jennifer Bellerive - Step-granddaughter

**"Sarah Lillian Bellerive,"** was the matriarch of the Bellerive family, alongside her husband Thomas. She was known to be especially physically cruel to slaves, hurting them for amusement when they would not meet her demands. She was responsible for the death of Meredith, and in retaliation, was beaten to death by the slaves she abused.
Charles Bellerive

Henry Bellerive - Brother

John Bellerive - Brother

Jennifer Bellerive - Step-cousin

Samuel Bellerive - Son

Alfred Bellerive - Son

**"Charles William Bellerive,"** was a catholic preacher and youngest of the Bellerive family. He was difficult in his younger years, learning a racist mindset from his father and mother and being jealous of Meredith's relationship with Jennifer, whom he was friends with. Meeting a young child like him, Juba, who was black began to change Charles's beliefs. He became much nicer and started to appreciate slaves and feel for them, but began to despise his family for mistreating them. Juba then began an argument with Charles after he became irrationally angry at him for not being able to save his mother and not being his friend because of it. Charles was protected by his older brother Johnny, who accidentally broke Juba's arm after taking him down for pushing Charles. Juba was then punished for simply getting angry and Charles was forced to watch as Juba was whipped into unconsciousness and later died from sepsis. Charles, prior to this, did not want to leave with Meredith and Jennifer and go on the run, believing they would be caught and punished. The death of Juba changed his mind and he was going to leave with them before Jenny's disappearance. Her subsequent death attracted great rage at his older brother Henry, and after he had survived being poisoned, and his mother had been killed, Charles decided to leave the past in the past, and left the plantation with Johnny. However, he still lived with the guilt of Juba and Jennifer's deaths for a long time afterward, becoming an alcoholic until finding his religion within a black community, and building a church in Juba's honor. He then took in Johnny, who had become an outlaw. He was cautious of Johnny, knowing his desire for revenge could blind him to the consequences. After Jennifer Calcourt appeared, claiming she was Jennifer and that Henry had truly tried to murder her, Charles decided to help Johnny. This action, however, led to the capture of one of Johnny's men, who subsequently revealed the location of Charles' home to Henry. To punish Johnny, Henry personally sought out Charles. In his living room, Samuel and Albert, his two sons, watched as he and his wife were murdered in cold blood by Henry.
Wiki foro

**¡Bienvenidos a Wiki Foro!**
Foro wiki

Somos una comunidad web colaborativa sobre Foro en la que cualquiera, incluyéndote a ti, puede contribuir. Los wikis como este dependen de que los lectores se involucren y añadan contenido. ¡Haz clic en el botón de *"CREAR UN NUEVO ARTÍCULO"* o *"EDITAR"* al comienzo de cada página para comenzar!

## Artículos importantes

ImagenWiki Foro:AyudaImagenWiki Foro:Normas del wikiImagenEl primer episodioImagenUna ubicación importanteImagenUn evento claveImagenWiki Foro:Anuncios del wiki

*¿Necesitas ayuda para construir esta comunidad?*

* Normas del wiki
* Primeros pasos
* Cómo contribuir
* Dirigiendo tu comunidad
* Guías
* Todos los artículos de ayuda

También puedes ser parte de la mayor familia de comunidades de Fandom. Visita la Comunidad Central de Fandom!

*Fundadores de la comunidad*: Escribid un buen párrafo describiendo el tema de la comunidad aquí. Permitid que vuestros lectores sepan más del tema sobre el que trata este wiki y algo de información general sobre el mismo. Luego visitad el panel de administración para más consejos.
Auto Assembler Example 1

Take the following simple example:

```
alloc(MyCode, 512) // allocate 512 bytes inside opened process and store address in the MyCode label
label(MyData)      // MyData is defined later, set value at the location where the assembler hits it
registersymbol(MyCode) // make MyCode available everywhere
registersymbol(MyData) // make MyData available everywhere

MyCode:       // start assembling in allocated memory
mov eax, [400000]
mov [MyData], eax
mov [MyData+4], 12345678
ret

MyData:       // value will be set to address after ret
CreateThread(MyCode) // create new thread in open process

```

This allocates 512 bytes and assigns the label MyCode to it. It then lets the assembler know that MyData is used as a label later, and the autoassembler should set it's value to wherever it left off assembling code (the byte after ret). It then registers MyCode and MyData as symbols, letting you enter them when you "Goto address" in the Memory Viewer window, or you can use an address of "MyData" or "MyData+4" for example in your cheat table.

It then assembles the code into the memory pointed to by MyCode (5F60000) and sets MyData to point to the address after it assembles the ret instruction (5F60016). Finally, CreateThread creates a new thread inside the process and starts executing code at the MyCode address. The results are here, notice the 4 bytes after the ret are the 4 bytes at 4000000 inside the process and the 4 bytes after that are 78 56 34 12 from the second mov:

```
MyCode - A1 00004000                  - mov eax,[00400000] : [00905A4D]
05F60005 - 89 05 1600F605             - mov [MyData],eax
05F6000B - C7 05 1A00F605 78563412    - mov [05F6001A],12345678
05F60015 - C3                         - ret
MyData - 4D                           - dec ebp
05F60017 - 5A                         - pop edx
05F60018 - 90                         - nop
05F60019 - 00 78 56                   - add [eax+56],bh
05F6001C - 34 12                      - xor al,12

```

When you click the "Add Address Manually" button on the main Cheat Engine form (just above the table on the right below the scan info), you can use MyData as the address because we registered the symbol:

And it will show in the table:
Auto Assembler:dealloc

**Auto Assembler** dealloc(*SymbolName*)

Deallocates a block of memory allocated with alloc.
It always gets executed last, no matter where it is positioned in the code, and only actually frees the memory when all allocations have been freed. Only usable in a script designed as a cheat table. (e.g used for the disable cheat)

## Examples

```
dealloc(SomeSymbol)

```

## See also

* Auto Assembler
* Auto Assembler Commands

### Related Commands

* aobScan
* aobScanModule
* alloc
* createThread
* define
* fullAccess
* globalAlloc
* include
* label
* loadBinary
* loadLibrary
* readMem
* registerSymbol
* unregisterSymbol
* LUA ASM
Assembler:Commands:SUBSD

**command** subsd *destination, source*

Subtracts the source from the destination. Used for Subtracting Scalar Double-Precision Floating-Point Values. The subsd command can only be used with xmm registers.

```
Destination = Destination - Source
```

Subtracts the low double-precision floating-point value in the source operand (second operand) from the low double-precision floating-point value in the destination operand (first operand), and stores the double-precision floating-point result in the destination operand. The source operand can be an XMM register or a 64-bit memory location. The destination operand is an XMM register. The high quadword of the destination operand remains unchanged.

c9x.me/x86/html/file\_module\_x86\_id\_311.html

## Examples

```
subsd xmm0,xmm1

```

```
subsd xmm3,[edx+110]

```

```
subsd xmm15,[rdx+10]

```

```
subsd xmm5,[00123abc]

```

```
subsd xmm7,[UserDefinedSymbol]

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Assembler:Commands:CVTSI2SS

**command** cvtsi2ss *destination, source*

Converts doubleword integer to single precision floating point value. Used for Converting Doubleword Integer To Scalar-Single-Precision Floating-Point Values. The cvtsi2ss command must be used with xmm registers.

Converts a signed doubleword integer in the source operand (second operand) to a single-precision floating-point value in the destination operand (first operand). The source operand can be a general-purpose register or a 32-bit memory location. The destination operand is an XMM register. The result is stored in the low doubleword of the destination operand, and the upper three doublewords are left unchanged. When a conversion is inexact, the value returned is rounded according to the rounding control bits in the MXCSR register.

c9x.me/x86/html/file\_module\_x86\_id\_59.html

## Examples

```
cvtsi2ss xmm1,eax

```

```
cvtsi2ss xmm3,[edx+110]

```

```
cvtsi2ss xmm5,[00123abc]

```

```
cvtsi2ss xmm7,[UserDefinedSymbol]

```

```
[enable]

 ; ...

 alloc(newmem,$100)

 ; ...

newmem:
 mov eax,00001388
 cvtsi2ss xmm0,eax

 ; ...

 jmp return

 ; ...

return:

 [disable]

 ; ...
```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Cheat Engine

You'll find information about Cheat Engine here

like:

* Memory Scanning
* Debugging
* Auto Assembler
* Lua
* Cheat Tables
* Data Dissector (Structure definer/compare)
* Speedhack
* Plugin System
* Cheat Engine Internals
* DBVM
* Building Cheat Engine
* Help file (from the program)
* Main Form Shortcut Keys

Website: www.cheatengine.org
Auto Assembler:unregisterSymbol

**Auto Assembler** unregisterSymbol(*SymbolName*)

Removes a symbol from the user-defined symbol list. No error will occur if the symbol doesn't exist.

Note: Use registerSymbol to add a symbol from the user-defined symbol list.

## Examples

```
unregisterSymbol(SomeSymbol)

```

## See also

* Auto Assembler
* Auto Assembler Commands

### Related Commands

* aobScan
* aobScanModule
* alloc
* dealloc
* createThread
* define
* fullAccess
* globalAlloc
* include
* label
* loadBinary
* loadLibrary
* readMem
* registerSymbol
* LUA ASM
Assembler:Commands:MOVSD

**command** movsd *destination, source*

Copies the data from source operand to destination operand. Used for Moving Scalar Double-Precision Floating-Point Values. The movsd command can only be used with xmm registers.

Moves a scalar double-precision floating-point value from the source operand (second operand) to the destination operand (first operand). The source and destination operands can be XMM registers or 64-bit memory locations. This instruction can be used to move a double-precision floating-point value to and from the low quadword of an XMM register and a 64-bit memory location, or to move a double-precision floating-point value between the low quadwords of two XMM registers. The instruction cannot be used to transfer data between memory locations.

When the source and destination operands are XMM registers, the high quadword of the destination operand remains unchanged. When the source operand is a memory location and destination operand is an XMM registers, the high quadword of the destination operand is cleared to all 0s.

c9x.me/x86/html/file\_module\_x86\_id\_204.html

## Examples

```
movsd xmm0,xmm1

```

```
movsd [edx+110],xmm4

```

```
movsd [rdx+10],xmm8

```

```
movsd xmm3,[edx+110]

```

```
movsd xmm15,[rdx+10]

```

```
movsd xmm5,[00123abc]

```

```
movsd [00123abc],xmm12

```

```
movsd xmm7,[UserDefinedSymbol]

```

```
movsd [UserdefinedSymbol],xmm10

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Auto Assembler:Commands

This is a list of all the Auto Assembler commands

* aobScan: Will scan the memory for the given array of byte (Wildcards are supported) and places a label at the first match
* aobScanModule: Will scan the specific module for the given array of byte (Wildcards are supported) and places a label at the first match
* aobScanRegion: Will scan the specific range for the given array of byte (Wildcards are supported) and places a label at the first match
* label: Enables the word labelname to be used as a address
* alloc: Allocates a region of memory with a label that points to it
* dealloc: Deallocates a block of memory allocated with alloc
* globalAlloc: Will allocate a certain amount of memory and registers the specified name
* kAlloc: Kernal allocate
* fullAccess: Makes a memory region readable, writable and executable
* reassemble: Reassembles the given address, writing at it's declared location.
* readMem: Read a memory region and writes it at the location this instruction is placed
* registerSymbol: Adds the symbol to the userdefined symbol list
* unregisterSymbol: Removes the symbol from the userdefined symbol list
* define: Will replace all tokens with the specified name with the text of whatever
* assert: Will check the memory address for the given bytes
* include: Includes another auto assembler file at that spot
* createThread: Will spawn a thread in the process at the specified address
* createthreadandwait: Will spawn a thread in the process at the specified address and waits till it returns
* loadLibrary: Will inject the specified dll into the target process
* loadBinary: Will load a binary file at the specified address
* struct / endStruct: With STRUCT and ENDSTRUCT you can define an internal structure in your auto assembler script
* luaCall: Executes the given Lua code
* {$LUA} / {$ASM}: {$LUA} (Lua) and {$ASM} (Assembler) will begine the given parser
* {$STRICT}: {$STRICT} will force label declaration, by throwing an error
* align: Tells the assembler to align for a given byte size.
* {$TRY} / {$EXCEPT}: Code between {$TRY} and {$EXCEPT} blocks will jump to the {$EXCEPT} part when an exception happens
* {$LUACODE} / {$ASM}: Execute the given lua code inside CE's context whenever the target process executes this code
* {$CCODE} / {$ASM}: Execute the given C code inside the target's context whenever the target process executes this code
* {$C} / {$ASM}: Compile the given code within the C block inside the targer process
Tutorials:AttachToProcess

## How to attach to a process

1. **Open the process / game** to be attached to, if it's not already opened.
2. **Open Cheat Engine**, if it's not already opened.
3. **Click the *computer icon* in the Cheat Engine form tool bar**, it should be blinking if Cheat Engine was just opened, or on the Cheat Engine main form menu select *process*.
4. **Select the process from the list**.
5. **Click the *open* button** or double click the process.
You should **see the process name at the top of the form**.
6. **You are now attached to the process**.
And from here the sky is the limit, or maybe it's the sky box is the limit.
Debugging

## About

Debugging is the process of finding and removing glitches and bugs in a process or library. For this people use programs called debuggers. The debugger (as in a person who is debugging) can place breakpoints to check or change the values of variables. Some known tools are OllyDbg and SoftICE. Some IDE's come with a debugger as well, such as Borland's Delphi 7 and Microsoft Visual Studio. Cheat Engine has a debugger as well, which is, unlike others, not based on OllyDBG's debugger.

## Breakpoints

Breakpoints are forced stops in a process to check or change the variables in a process, like the memory. Breakpoints can be placed after the execution of a codeline, or when a certain condition has been reached.

On intel architecture breakpoints can be controlled by the Debug Registers, which provide the ability to not only break on execution, but also when an address is being read, or written to. In debugging terms, these are called "Hardware breakpoints". Another way of specifying a breakpoint is using the int3 opcode, (0xcc) which is only 1 byte long and can be placed at the start of an instruction causing a breakpoint to be generated when executed. The debugger, in this case, must restore the original byte, execute a single step, and restore with the breakpoint opcode. These kind of breakpoints are called "Software breakpoints"

## Stack

The stack is important when debugging. It contains the address of calling routines and, in 32-bit, contains the parameters that have been passed down to the function you are currently debugging. Note though, that in 64-bit debugging, parameter passing happens with registers, so the only way to find out the original parameters then, is a breakpoint at the start.
Forum

A forum is an online message-based community board where people can chat about certain events or subjects.
In this case, it's the Cheat Engine Forum. In this forum we discuss current events, gamemodding and other computer discussion.

### Some sections

* General Discussion: The section where people discuss the latest events or other occupations.
* Random Spam: The place where people go to say whatever they want.
* Art: The place where people post what they've made in Microsoft Paint or Photoshop.
* Computer Talk: The place where people ask questions that are computer or hardware related.
* Game Talk: The place on the forum where people ask game related content.
Help File:Extra (Advanced)

This page is an advanced settings page, and care should be taken before altering anything here.
This is the page of most interest to those using CE againt online targets and thus anti-cheat systems,
due to the kernelmode and stealth features available here.

**Query memory region routines**: This will have CE try and 'work out' how memory is allocated in the game.
This is needed on some unorthodox targets, particularly online games, or games protected with an anti-cheat system.

**Read/Write Process Memory**: Forces read and write access to the target processes memory space.
This is needed on some targets that are protected as above. It's also a special point of note with some emulators
such as PCSX2 for PS2 games running on a Vista/Win7 host machine. You'll need this on to come up with any results at all.

**Open Process**: This will open a handle to the current process. This is needed for the process watcher and
kernelmode debug routines to work (and will get enabled along with those if not already on).

**Enable the use of the Process Watcher**: Enable this if you can't find a target process in the list.
Enable this and then start the game. Choose the process when you see it appear. It uses kernelmode to do this,
so requires the below option. It's handy therefore, for cheat-protected titles.

## Links

* Help File

* Back

* Next
Mono:Lua:mono compile method

**function** mono\_compile\_method(*methodId*) **:** integer

JITs a method if it isn't compiled yet.
Returns the address of JITted code.

```
return mono_compile_method(mono_getJitInfo(getAddress('PlayerStatsManager:TakeDamage')).method)

```

**Output:**

```
:432511608

```

## See also

* Mono
* Mono Dissect Form
* Mono Structure Dissection
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic

### Related Functions

* mono\_getJitInfo
* **mono\_compile\_method**
* mono\_free\_method
Improvements

This is a planning page for improvements that need to be made to the wiki. Right now, we need:

* Porting the CE help file into the wiki (that includes describing the lua classes and references to one another).
	+ Help File
* Lua tutorials
	+ Tutorials
* The assembler tutorials need work.
	+ Tutorials
* The Lua functions need filling in.
	+ Lua
* The assembler commands need filling in.
	+ Assembler Commands

* This page needs to be updated as various improvements are noted or completed.
Help File:Tutorials

This section contains a collection of all useful, mainly user-submitted,
tutorials originally posted on the cheat engine forum.
This is only a small selection of what is available. There are many more,
graphic-rich tutorials on the website on the rest of the web, that are just not appropriate for this help file.
Please search :-)

* Tutorials
* Gamehack tutorials

* Forum.CheatEngine.org
	+ forum.cheatengine.org Tutorials

## External links

* FearlessRevolution.com
	+ Cheat Engine Tutorials

* wikibooks.org/wiki/X86\_Assembly
	+ wikibooks.org/wiki/X86\_Assembly/X86\_Instructions

* asmpedia.org

* Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 2A: Instruction Set Reference, A-M
* Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 2B: Instruction Set Reference, N-Z

* wikipedia.org/wiki/Assembly\_language
* wikipedia.org/wiki/X86\_assembly\_language
* wikipedia.org/wiki/X86\_instruction\_listings

## Links

* Help File

* Back Section

* Skip Section

* Back

* Next
Auto Assembler:label

**Auto Assembler** label(*LabelName*)

Enables the word 'LabelName' to be used as a symbol.

Note: The label address must be set to be used.

Tip: Use registerSymbol to use the label in other AA scripts.

## Examples

```
label(someLabel)
...
    ...

```

```
label(mylabel)

00451029:
jmp 00410000
nop
nop
nop
mov [00580120],esi
mov [esi+80],ebx
xor eax,eax
jmp mylabel

```

## Notes

By default, CE doesn't care if you label() your labels or not. It's perfectly fine to do:[1]

Code:

```
00400500:
jmp bla
something:
jmp 00400600
bla:
jmp something

```

But, for those that don't like that, they can use the {$STRICT} line in their script.

When this line is present in your script, ce will not assume that an undefined symbol is a label, and just give you an error instead.

## See also

* Auto Assembler
* Auto Assembler Commands

### Related Commands

* aobScan
* aobScanModule
* alloc
* dealloc
* createThread
* define
* fullAccess
* globalAlloc
* include
* loadBinary
* loadLibrary
* readMem
* registerSymbol
* unregisterSymbol
* LUA ASM
Assembler:Commands:SUBSS

**command** subss *destination, source*

Subtracts the source from the destination. Used for Subtracting Scalar Single-Precision Floating-Point Values. The subss command can only be used with xmm registers.

```
Destination = Destination - Source
```

Subtracts the low single-precision floating-point value in the source operand (second operand) from the low single-precision floating-point value in the destination operand (first operand), and stores the single-precision floating-point result in the destination operand. The source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The three high-order doublewords of the destination operand remain unchanged.

c9x.me/x86/html/file\_module\_x86\_id\_312.html

## Examples

```
subss xmm0,xmm1

```

```
subss xmm3,[edx+110]

```

```
subss xmm15,[rdx+10]

```

```
subss xmm5,[00123abc]

```

```
subss xmm7,[UserDefinedSymbol]

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Cheat Engine:Data dissector

The data dissector is one of the more hidden features of Cheat Engine, but it is one of the more useful features.

It'll allow you to document a region of memory and how it in different datatypes. You can let Cheat Engine determine what kind of types they are, or manually add them yourself. After that you can compare different blocks of memory with each other so you can see the difference between the two, this is marked by making the line red. This is especially helpful when trying to find a way to figure out if something belongs to the player or the computer, and also helps with finding other useful data that might be stored in the same region of memory (e.g player stats are usually stored in the same structure).

The structure dissector also handles pointers, so if the defined structure has a pointer to another structure, you can just expand the pointer to see the structure it points at.
Auto Assembler:align

**Auto Assembler** align(*AlignByteSize*, *FillerByte* OPTIONAL)

Tells the assembler to align for a given byte size.

## Examples

```
alloc(memTest, 0x400)
registerSymbol(memTest)

memTest:
	nop
	align 2 CC
	nop
	align 4 CC
	nop
	align 8 CC
	nop
	align 10 CC

	nop
	align 2 CC
	nop
	align 4 CC
	nop
	align 8 CC
	nop
	align 10 CC

	nop
	align 2
	nop
	align 4
	nop
	align 8
	nop
	align 10

	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
	nop
```

Output

```
memTest       - 90                    - nop
01720001      - CC                    - int 3
01720002      - 90                    - nop
01720003      - CC                    - int 3
01720004      - 90                    - nop
01720005      - CC                    - int 3
01720006      - CC                    - int 3
01720007      - CC                    - int 3
01720008      - 90                    - nop
01720009      - CC                    - int 3
0172000A      - CC                    - int 3
0172000B      - CC                    - int 3
0172000C      - CC                    - int 3
0172000D      - CC                    - int 3
0172000E      - CC                    - int 3
0172000F      - CC                    - int 3
01720010      - 90                    - nop
01720011      - CC                    - int 3
01720012      - 90                    - nop
01720013      - CC                    - int 3
01720014      - 90                    - nop
01720015      - CC                    - int 3
01720016      - CC                    - int 3
01720017      - CC                    - int 3
01720018      - 90                    - nop
01720019      - CC                    - int 3
0172001A      - CC                    - int 3
0172001B      - CC                    - int 3
0172001C      - CC                    - int 3
0172001D      - CC                    - int 3
0172001E      - CC                    - int 3
0172001F      - CC                    - int 3
01720020      - 90                    - nop
01720021      - 00 90 00900000        - add [eax+00009000],dl
01720027      - 00 90 00000000        - add [eax+00000000],dl
0172002D      - 00 00                 - add [eax],al
0172002F      - 00 90 90909090        - add [eax-6F6F6F70],dl
01720035      - 90                    - nop
01720036      - 90                    - nop
01720037      - 90                    - nop
01720038      - 90                    - nop
01720039      - 90                    - nop
0172003A      - 90                    - nop
0172003B      - 90                    - nop
0172003C      - 90                    - nop
0172003D      - 90                    - nop
0172003E      - 90                    - nop
0172003F      - 90                    - nop
```

## See also

* Auto Assembler
* Auto Assembler Commands
* forum.cheatengine.org/viewtopic.php?p=5735366#5735371
Mono:Mono Structure Dissection

* Mono

When using the structure dissector and adding a new structure you might seee a name
pop up instead of "unnamed structure". If this happens then when you let Cheat Engine
automatically generate the structure it should be based on the field definitions for
the class at that address.

## See also

* Mono
* Mono Dissect Form
* **Mono Structure Dissection**
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic
Tutorial:CodeInjection Integers

This tutorial builds on the topic of Code Injection:

* Code Injection - Basic injection
* Code Injection - Full injection
* Code Injection - Adding Editable Values
* **Code Injection - Working with Integers**
* Code Injection - Working with Floats

Let's say you have an integer and some code that increases the value.

```
add [eax+10],ecx

```

>
> What if what writes to the value is only a MOV. Try to find a spot above the write instruction that has an ADD (or a SUB depending on what you want to do).
>
>
>
>
> ```
> add ecx,ebx
> //...
> mov [eax+10],ecx
>
> ```
>
>

## Hardcoded value

We could just hardcode a value for this.

```
add dword ptr [eax+10],(int)100 // #100 //// "#" is a short hand for integer

```

## Editable value

We could use a label, giving it some memory. And optionally register it so the label can be used on the table as an address.

```
//...
alloc(someMem, 0x400)
//...
label(someSymbol)
registerSymbol(someSymbol)
//...
someMem:
  //...
  mov ecx,[someSymbol]
  add [eax+10],ecx
  //...
  jmp return
  //...
  someSymbol:
    dd (int)100
//...

```

## Adding a Multiplier

We could add an editable value like above but use IMUL to add a multiplier to the script.

```
//...
alloc(someMem, 0x400)
//...
label(someSymbol)
registerSymbol(someSymbol)
//...
someMem:
  //...
  imul ecx,[someSymbol]
  add [eax+10],ecx
  //...
  jmp return
  //...
  someSymbol:
    dd (int)10
//...

```

## Fractional Multiplier

But what if we wanted to be able to multiply by a fractional number (i.e.: "0.5"). Well this can take a bit more, but we can use CVTSI2SS and CVTSS2SI to convert the value from an integer to a float and back a gain. Then we can just use MULSS to do the multiplying, but we will need an XMM registry to work with. So we will need some extra memory and use MOVUPS to save and restore the XMM registry.

```
//...
alloc(someMem, 0x400)
//...
label(someSymbol)
registerSymbol(someSymbol)
label(extraStuff)
//...
someMem:
  //...
  movups [extraStuff],xmm0 //// save
  cvtsi2ss xmm0,ecx
  mulss xmm0,[someSymbol]
  cvtss2si ecx,xmm0
  movups xmm0,[extraStuff] //// restore
  //...
  jmp return
  //...
  someSymbol:
    dd (int)10
  extraStuff:
    dd 0 //// Data double-word (4 bytes)
    dd 0
    dq 0 //// Data quad-word (8 bytes)
//...

```

## Calculate a value for a Multiplier

Let's say we just can't find an ADD or a SUB, and all we have is a MOV.

```
mov [eax+10],ecx

```

We can just do some math in the script, to calculate a value for a multiplier.

```
//...
alloc(someMem, 0x400)
//...
label(someSymbol)
registerSymbol(someSymbol)
//...
someMem:
  //...
  sub ecx,[eax+10]
  imul ecx,[someSymbol]
  add ecx,[eax+10]
  mov [eax+10],ecx
  //...
  jmp return
  //...
  someSymbol:
    dd (int)10
//...

```

## See Also

* Auto Assembler Basics
* Auto Assembler Templates
* Code Injection - Basic injection
* Code Injection - Full injection
* Code Injection - Adding Editable Values
* **Code Injection - Working with Integers**
* Code Injection - Working with Floats
Auto Assembler:alloc

**Auto Assembler** alloc(*SymbolName*, *Size*, *AllocateNearThisAddress* OPTIONAL)

Allocates a certain amount of memory and defines the symbol name in the script.
If 'AllocateNearThisAddress' is specified CE will try to allocate the memory near that address.
This is useful for 64-bit targets where the jump distance could be bigger than 2GB otherwise.

Note: Use dealloc to free the memory when done.

Note2: There are 2 other alloc variants. allocnx and allocxo. allocnx will allocate memory as non-executable. allocxo will allocate memory as execute only

### Command Parameters

 Size
 AllocateNearThisAddress

## Examples

```
alloc(SomeSymbol, 0x4)

```

```
alloc(SomeSymbol, 0x1000)

```

```
alloc(SomeSymbol, $1000)

```

```
alloc(SomeSymbol, 0x4, Tutorial-x86_64.exe+164C2)

```

From the **SunBeam**: CE actually fetches the module and allocates close to the end of the module. Additionally specifying **+164C2** does not add to it in any way :D Jus' sayin' *Tutorial-x86\_64.exe* is enough.post

```
alloc(SomeSymbol, 0x4, SomeAOBSymbol)

```

```
alloc(SomeSymbol, 0x1000, Tutorial-x86_64.exe)

```

```
alloc(SomeSymbol, $1000, Tutorial-x86_64.exe)

```

```
alloc(memloc1,4)

00451029:
jmp 00410000
nop
nop
nop

00410000:
mov [alloc1],esi
mov [esi+80],ebx
xor eax,eax
jmp 00451031

```

## See also

* Auto Assembler
* Auto Assembler Commands

### Related Commands

* aobScan
* aobScanModule
* dealloc
* createThread
* define
* fullAccess
* globalAlloc
* include
* label
* loadBinary
* loadLibrary
* readMem
* registerSymbol
* unregisterSymbol
* LUA ASM
Tutorials

## Cheat Engine Tutorials

* Value Types
* Pointers
* The Stack
* AOBs

* How to attach to a process
* How to add script to table
* How to add addresses to the address list

* Cheat Engine Tutorial Guide (x32)
* Cheat Engine Tutorial Guide (x64)

* Finding values - Integers
* Finding values - Floats
* How to break and trace code in a process

* Tutorial - Cheat Form
* Creating a cheat table - Full guide
* Tutorial Set 1

## Auto Assembler Tutorials

* Auto Assembler Basics
* Auto Assembler Templates
* Code Injection - Basic injection
* Code Injection - Full injection
* Code Injection - Adding Editable Values
* Code Injection - Working with Integers
* Code Injection - Working with Floats
* Setup auto assembler test table

* **Examples**
	+ Auto Assembler - Example 1
	+ Auto Assembler - Example 2
	+ Auto Assembler - Example 3

## Lua Tutorials

* Lua Basics
* How to setup a Lua auto attach script
* Introduction to Lua with CE: Beginner to Basic Script Writer

## Help File Tutorials

* ASM and Hexing Theory
* Basic assembler
* What is the difference in bytetype
* ASM Basics 1
* ASM Basics 2
* ASM Basics 3
* Cheat Engine specific
* Remote desktop instead of network version
* Searching Tip
* Code Injection and the auto assembler
* Find out what addresses are accessed by a piece of code
* 3D pinball for windows
* Basic packet editing
* Percentage scans and compare to saved results
Cheat Engine Wiki

* Cheat Engine
	+ Help File
	+ How to attach to a process
	+ How to add script to table
	+ How to add addresses to the address list
* Scripting
* Lua
	+ Lua Language
	+ CE Lua Basics
	+ CE Lua Functions and Classes
	+ CE Lua Debugging Functions
	+ Lua Basics
	+ Lua Object Oriented (Address class)
* Assembler
	+ Assembler Commands
		- Commands Tables
		- Commands List
* Auto Assembler
	+ Auto Assembler Commands
	+ Auto Assembler Basics
* Code injection
* DBVM
* Decompiling
* Debugging
* Ultimap
	+ Ultimap1
	+ Ultimap2
* Hex editing
* Mono Features
	+ Mono Dissect Form
	+ Mono Structure Dissection
	+ Mono Lua
		- Mono Lua Functions
	+ Mono AA Commands
	+ Tutorial - Mono - Basic
* Packet editing
* Programming

- Value Types
- Pointers
- The Stack
- AOBs
- How to attach to a process
- How to add script to table
- How to add addresses to the address list
- Cheat Engine Tutorial Guide (x32)
- Cheat Engine Tutorial Guide (x64)
- Finding values - Integers
- Finding values - Floats
- How to break and trace code in a process
- Tutorial - Cheat Form
+ Auto Assembler:

- Auto Assembler Basics
- Auto Assembler Templates
- Code Injection - Basic injection
- Code Injection - Full injection
- Code Injection - Adding Editable Values
- Code Injection - Working with Integers
- Code Injection - Working with Floats
+ Lua:

- Lua Basics
- How to setup a Lua auto attach script
- Introduction to Lua with CE: Beginner to Basic Script Writer
+ Mono:

- Mono Basics
+ Videos:

- Video Tutorials

* Generic Gamehacking Tutorials

## Contributing

Register/log in to start contributing to this wiki.

You can post any modding related information on this wiki related to

* Assembler,
* Cheat Engine,
* Code injection,
* DBVM
* Decompiling,
* Debugging,
* Generic gamehacking tutorials,
* Hex editing,
* Mono Game Hacking Tools
* Packet editing,
* Programming,
* Tutorials,

etc...

We're also looking for help with improving/updating the wiki! If you are a Lua/Assembler expert, or just want to help fill in the gaps, head over to the Improvements section and pick a topic.

There's also room for Cheat Engine forum related topics as long as it's within reason, and please, keep it in the Forum namespace (do that by adding Forum: in front of new pages).

if you're new to wikis you can play around in the Sandbox , there's less chance of being blocked for adding complete gibberish.
Assembler:Commands:ADDSS

**command** addss *destination, source*

Adds the source to the destination. Used for Adding Scalar Single-Precision Floating-Point Values. The addss command can only be used with xmm registers.

```
Destination = Destination + Source
```

Adds the low single-precision floating-point values from the source operand (second operand) and the destination operand (first operand), and stores the single-precision floating-point result in the destination operand. The source operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The three high-order doublewords of the destination operand remain unchanged.

c9x.me/x86/html/file\_module\_x86\_id\_9.html

## Examples

```
addss xmm0,xmm1

```

```
addss xmm3,[edx+110]

```

```
addss xmm15,[rdx+10]

```

```
addss xmm5,[00123abc]

```

```
addss xmm7,[UserDefinedSymbol]

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* c9x.me/x86/
* ref.x86asm.net
* wikipedia.org/wiki/X86\_instruction\_listings
Assembler:Commands:ADD

**command** add *destination*, *source*

Adds the source to the destination. Used for adding integer operands.

The **OF**, **SF**, **ZF**, **AF**, **CF**, and **PF** flags are set according to the result.

```
destination = destination + source

```

Adds the first operand (destination operand) and the second operand (source operand) and stores the result in the destination operand. The destination operand can be a register or a memory location; the source operand can be an immediate, a register, or a memory location. (However, two memory operands cannot be used in one instruction.) When an immediate value is used as an operand, it is sign-extended to the length of the destination operand format.

The ADD instruction performs integer addition. It evaluates the result for both signed and unsigned integer operands and sets the **OF** and **CF** flags to indicate a carry (overflow) in the signed or unsigned result, respectively. The **SF** flag indicates the sign of the signed result.

c9x.me/x86/html/file\_module\_x86\_id\_5.html

## Examples

```
add al,1

add ax,1

```

```
add eax,1

```

```
add rax,-1

```

```
add [eax],0x9

```

```
add [rax],1

```

```
add [rax],rsi

```

```
add eax,[rax]

```

```
add rax,[rax]

```

```
add [SomeSymbol],1

```

```
add [SomeSymbol],eax

```

## See also

* Assembler
* Auto Assembler
* Assembler Commands

## External links

* wikipedia.org/wiki/X86\_instruction\_listings
* wikibooks.org/wiki/X86\_Assembly/Other\_Instructions
* c9x.me/x86/
* ref.x86asm.net
Mono:MonoDissect

The Mono dissector form lets you browse the classes in the game you are debugging. It
represents the code in a tree with the following structure:

* <domain> (normally just 1)
	+ <assembly>
		- <class>
			* static fields
			* fields
			* methods
			* base class

You can press *Ctrl+F* to open the Find window and use it to search for strings.

Note: Captured while attached to Cuphead.

If you select a method, you can right-click on the tree and pick *Jit* and it will cause the method to compile, and open the memory viewer at the methods address.

## See also

* Mono
* **Mono Dissect Form**
* Mono Structure Dissection
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic
Lua:getProcesslist

**function** getProcesslist(*Strings* OPTIONAL) **:** table **-** Strings

Returns a table with the processlist (pid - name ), if 'Strings' is not set.

If 'Strings' is set fills a Strings inherited object with the process list of the system.

Format: %x-pidname

## See also

* Lua
* Script engine

### Related Functions

* getOpenedProcessID
* getProcessIDFromProcessName
* createProcess
* openProcess
Mono:Lua:mono initialize

**function** mono\_initialize()

Sets up hooks, calls old open process hook if there was one,
and calls *syncrhonize("mono\_OpenProcessMT")*.

## Examples

### In Lua Engine form

While attached to Cuphead.
**Input:**

```
return mono_initialize()

```

## See also

* Mono
* Mono Dissect Form
* Mono Structure Dissection
* Mono Lua
	+ Mono Lua Functions
* Mono AA Commands
* Tutorial - Mono - Basic

### Related Functions

* **mono\_initialize**
* mono\_OpenProcessMT
* mono\_OpenProcess