[Guide] Basic Memory Editing in TSearch

[Dragon[Sky]]

This is a guide on basic memory editing, written by me, Dragon[Sky].
First, what is memory editing:

It would be recommended that you have at least some programming knowledge to understand this tutorial, but it's optional,
would be easier for you to understand.

--=An introduction to Memory Editing=--

Almost all programs use variables which they store values in, known as memory addresses. They change upon request, they can be static, they can be dynamic, depends on the program's instructions.
For example, health values are stored in a dynamic address (not tested, not sure), when you get damaged or healed, your health value increases or decreases.
You can alter these addresses with a memory editor, personally I prefer using TSearch. For example, you can change your health to 110000, you can alter your movement speed, and much more. You can pretty much change the whole game's data with memory editing.
All this is only client side, in a game like WoW it's visible to you, and only you, it doesn't really affect your server side health. Server side edits are made with packet editors, I believe there's a guide somewhere around.
But you can use memory editing as an advantage when altering client side actions, like movement.

--=PermEdit=--

This program is mostly used for granting system privileges to any running process. It is a cheat tool designed to search for parameters in memory. Usually it's used for memory/packet editors, such as TSearch and WPE Pro because sometimes they are not able to target certain processes.

Download link (TSearch+PermEdit)

Also, some anti viruses read memory and packet editors as viruses or malicious code, so I'd recommend you turning off any running anti virus, so you don't get interrupted while working.

--=TSearch workspace=--

1. Table of entries: The table of your chosen entries you selected from the search box. You can alter, save, open, freeze, unfreeze, delete, add addresses in this table. These addresses regulairly refresh. You can edit refresh/freeze time in Options > Cheat List.
2. Search results: Pretty much self explanatory, displays addresses. Usually you have alot of addresses, so you can do various searches to decrease them. You can add lines from this table to the cheat list. These addresses refresh regulairly as well. Go to Options > Search to edit search priority, refresh time, max addresses, search range etc.
3. EasyWrite: This is used to code inject or to hex edit, you can disable/enable cheats with this etc. You can write ASCII as well. You need to specify memory offset, f.ex offset 0x450000. You have several commands, like hex, asc, ascn and rem.
Remember to check for errors. You can also convert it to hex with the Tmk button.
4. Hex editor: You can edit the hex code of the process, can be used to change your character's name using ascii. You can search for both hex and ascii. There are refresh, search, go to a specific memory location, and a few other buttons, which allow you to view memory as float, double, bytes, longs etc.

Once you've downloaded TSearch+PermEdit, run WoW or whatever game you wish to hack, and log in.
Make sure you have given TSearch system privileges with PermEdit, otherwise you wouldn't be able to alter game memory.
How to do this, once you have launched TSearch, launch PermEdit, find TSearch in the process list and hit Grant Permissions.



Use the search engine to find your desired address/value.
Here's a little explanation of the search types.
You can search for an Exact value, means you know what you're searching for, ex, health.
Range, self explanatory, you know the value you're searching for is between two different values.
Unknown value, you don't know the value. This search usually finishes in 1-10 seconds, spitting out a few million results.
1 byte : value between 0-255 stored in 1 byte.ex 5 = 05 in memory
2 bytes : value between 0-65535 stored in 2 bytes.ex 5 = 05 00 in memory
4 bytes : value between 0-4294967295 stored in 4 bytes.ex 5 = 05 00 00 00 in memory
8 bytes : value between 0-18446744073709551615 stored in 8 bytes.ex 5 = 05 00 00 00 00 00 00 00 in memory
Float : value between 1.2E-38-3.4E38 stored on 4 bytes.ex 5 = 00 00 A0 40 in memory
Double : value between 2.2E-308-1.8E308 stored in 8 bytes.ex 5 = 00 00 00 00 00 00 14 40 in memory
It is quite certain that you won't get the result you're searching for in the first search, that's why you search next.
And so you go next search.
If you're looking for a health value, then do something which will decrease your health, then search for a value which has decreased, when you're back at full health, you search for a value which has increased. If you're looking for coordinates, search for a value which has changed, has not changed, has changed, has not changed and so untill you have around 200 addresses left (coordinate addresses are always separated 4 bytes from each other, 00 - 04 - 0
You can limit search range in Options > Search, where you can define two addresses between which the search will be.

--=Autohack=--

Autohack is used for games/processes with dynamic addresses, f.ex, addresses which change every time you start the game or enter an instance, map, or whatever.
This is known as DMA, dynamic memory allocation. Mostly found in multiplayer games where each player stats are allocated at runtime. You have to set a memory breakpoint on the address you have found and make the game change the value stored at this address , the asm instruction that caused the changed will be display in the autohackwindow and the user will be allowed to disable this instruction by checking the check box at the left of the line.
To enable Autohack, you must have enabled the debugger as well.
Use the green arrow button to set a break point.
Type Write : breakpoint's occur when the game modifies the value at the address .
Type Read/Write : breakpoints occur when the game reads or modifies the value at the address.
Enable button enables or disables the memory breakpoints(by default it's enabled)
Delete button deletes the selected line(s)
Patch button disables the selected line(s) by nopping
Unpatch button reenables the selected line(s) by undoing the nopping.
Check the box left of the asm line to disable it and uncheck to undo.
Debug event windows display debug messages. After setting a breakpoint on an value, and after modification of this value, the value will change in the game.
Press the Dis button or click on the asm line to disassemble the address.

That should be enough on Autohack, I don't know much about it either.

Hmm, this should be enough for now, I might update this guide someday.
Thanks to WoW_King for helping me with memory editing and an unknown website which I got a part of this tutorial from.
Feel free to add anything you want.
And I'm sorry, but I can't make this any simpler.
Please move it if it's in a wrong section.

Enjoy!

[Ermok]

:|Amazing !thanks vey good =)+rep if i can >.

[Croak]

Wow TSearch brings me back to the days when the game Gunbound was starting to get popular.