2011년 10월 20일 목요일

How to use TSearch Memory Editor

 I think TSearch program is the only one has powerful functions after Gamehack 2.0. It can search in-memory-values on both 32bit and 64bit OS.


Step 1. Find Program and Install it

 The developer or studio of TSearch has no homepage. But many people has it in their PC. Search at Google or your favorite search engine. You must be careful, there are so many fake or infected programs on the net.








This is TSearch Program.










Step 2. Select your process.

 Click "Open Process" on the tool bar. And select the process name. Now we can access its local memory area.







This is selecting process.

I erased some process names related to my privacy.







Step 3. Find a value.

 Now let's find somethins. Click maginifying glass icon below toolbar. Most cases you know the exact value. Then choose exact value. But if you don't know the exact value,  choose "Unknown" or "Range". We can check the differences after modifying it in the game or program.






"4 bytes" is enough for me long ago.












I found so many results. I typed "0".








Step 4. Change its value and Research

 The mechanism of tracking the memory location is "difference check". Now we must make its value to be changed.

 For example, in game, your character has one-bucks in his pocket. But you don't satisfy such a poverty. Then you search a value "10" at TSearch. And sell something to increase money amout to 11$. Now you search "11" on previous search result.







Never be confused with left icon.
We can search again, on previos result.







Step 5. Reduce the count of result as less as possible.

 Repeat change and research. Because some values are so common on the memory.
After repeating any times, you can find only 1~3 result. Its count will not be changed.

 This is the real location of your value. Doubleclick the result line, and modify it at right table. And check the modified value has been applied exactly in your program. If it is not, select another location at left table and modify again.

Trick1. Encrypted value

 Some programs store its value with encryption. If you are lucky, you can find its location. Because TSearch provide the difference check feature.

 For example, value "10" is stored as "1A0A" after encryption. And you change its value to "11". If the algorithm of encryption is simple, the encrypted value would be "original" + 1.

Trick2. Long Range value.

 Sometimes you want to find the series of values. Then use the Hexeditor. You can find it on the tool bar. For example, one record of DB table can be mapped to a chunk of memory. So the value of field may be stored linearly. This situation, Hex editor is more useful.

2011년 10월 19일 수요일

FIFA Manager 12 Player Character Byte order

The footballers character is consist of 8 byte.
( = 4digits of Hexadecimal XX XX )

1st Digit

10 Flexibility
20 Inflexibility
30 10 + 20
40 Ambitious
50 40 + 10
60 40 + 20
70 40 + 10 + 20
80 High work rate
90 80 + 10
a0 80 + 20
b0 80 + 10 + 20
c0 80 + 40
d0 80 + 40 + 10
e0 80 + 40 + 20
f0 80 + 40 + 10 + 20


2nd Digit



01 Attitude win
02 Complacent
03 01+02
04 Nerves of steel
05 04 + 01
06 04 + 02
07 04 + 01 + 02
08 Week nerves
09 08 + 01
0a 08 + 02
0b 08 + 01 + 02
0c 08 + 04
0d 08 + 04 + 01
0e 08 + 04 + 02
0f 08 + 04 + 01 + 02



3rd Digit

10 Sportsmanship
20 Hardman
30 10 + 20
40 Introvert
50 04 + 01
60 04 + 02
70 04 + 01 + 02
80 High club identification
90 08 + 01
a0 08 + 02
b0 08 + 01 + 02
c0 08 + 04
d0 08 + 04 + 01
e0 08 + 04 + 02
f0 08 + 04 + 01 + 02

4th Digit


01 Low club identification
02 Language genius
03 01 + 02
04 Media darling
05 04 + 01
06 04 + 02
07 04 + 01 + 02
08 Scandal prone
09 08 + 01
0a 08 + 02
0b 08 + 01 +02
0c 08 + 04
0d 08 + 04 + 01
0e 08 + 04 + 02
0f 08 + 04 + 01 + 02


For example, the 4-digit value is "9096".
Then the character of player is,

High work rate + Flexibility + High club identification + Sportsmanship + Media darling + Language genius

This post can be helpful for you. --> Go