In most cases, it is better to modify the read than the write.
In general, read the game-specific values first, then calculate them, then write them.
Modifying the read from the source will give better results.
Especially when there are a lot of comparisons and jumps between reads and writes.
You need to learn to trace from the write address to the address of the read source.
Understand... Tracing back to the read when it is in the same function and in the range of 20 lines before than it is no problem. When I have to go to the caller and there a few lines before also no problem. But other than that I got very fast confused in Breeze. When I want to trace back and I see lots of bl instructions used I every time struggle if I should also consider the branch to address because maybe my for example x20 value can also modified or read from within the bl function and when I follow the branch to and there are also other bl involved I am very fast lost which path should I trace further... Sometimes I fire up Ghidra or IDA to have a better overview and also the compiler which helps a lot to see the control flow of the data (ifs, switch statements or loops which I not recognize very safely only from looking through Breeze ASM instruction lines).
Or wanting to know which register holds which value when a breakpoint was triggered or a few lines before my breakpoint (and I know that with Breeze I can configure to see 1 register when a Watchpoint "Watch instruction" is triggered). But I know from my profession... New programmers often needs the debugger and with more experience they are becoming better and better in static code analysis and don't have to rely so much on the debugger anymore...
So here in AArch64 I improved a lot in the last couple of months but still have so much more to learn that I can other than "Easy ASM" conquer the more complex stuff only from static analysis.
But for sure, tracing code or registers is a skill I want to improve. Thanks for that suggestion.
One quick example (fictive registers involved here) and let's say shared function:
When I see a str x20, [x8] and I trace back the x20... When I see it comes from ldr x20, [x9] then I can of course manipulate between the read and write what x20 holds.
But let's say I want to understand which code instructions wrote the value in the first place at the memory location in x9. Until now I can only answering the question when looking through a debugger e.g. remote debugging with IDA. Finding out the memory address of x9 pointing to and make a write breakpoint here etc...
Solving such a task in Breeze with "Watch instruction" on the ldr x20, [x9] maybe it is only me or I can not read the results properly but wasn't able to achieve such tasks. And having a shared function here didn't make it better to find the correct x9 Memory Address pointet to for my player object.
For example "FANTASIAN Neo Dimension"
Find HP, watch read, found that it reads all friend hp, find that max hp, mp, max mp is near by
Make code for friend fill hp and mp
Watch write, found that it writes friend and foe, since this is kind of turn base make damage x4 with conditional key
Find qty, watch read get all qty, seems like everything you once own will appear including key item. You don't get that with write. Write may give use item no decrease or use to have 99.
[Breeze beta98a FANTASIAN Neo Dimension 1.0.0 TID: 01001BB01E8E2000 BID: 7F7F24FFAAC0693B]
[hp and mp fill during combat]
04000000 01C40280 B9402008
04000000 01C40280 14C7B108
04000000 04E2C6A0 B9402C08
04000000 04E2C6A4 B9002808
04000000 04E2C6A8 B9402408
04000000 04E2C6AC B9002008
04000000 04E2C6B0 17384EF5
[ damage x4]
04000000 01B6DF14 4B130108
80000100
04000000 01B6DF14 4B130108
04000000 01B6DF14 4B130908
20000000
[qty]
04000000 01B07BDC B9401829
Thank you, I will try more to include or watch also the read instructions to find very interesting stuff/game data in the structur nearby or abbreviations where I wasn't able to make a cheat only from looking for the store instruction in the code.
Some quick examples:
Sword art online fractured daydream, lenn's ammo count - if you trace the str instruction, there is a read instruction, then subtract, followed by a store. However, the Max clip size is like +8 away, so set it to read that instead and boom, inf clip.
Enter the gungeon, again the read is a few line above the str, but again, structure-wise max ammo is nearby, so set it read that and inf ammo (with reloads) is born.
Slightly more complex example, exit the gungeon, there is a offset that only the player has data in, so when doing complex asm, you could set it to read that and make the separation.
For Certain games, once you find moonjump or gravity, you can set certain read values.
Yes, sometimes you do have to trace muiltple addresses to see if only the player is using it. However, all of this is from personal experience.
I can follow your examples and helps to understand concepts better here. I think sharing your personal experience is a great source for me to understand underlying mechanics. Because as you emphasize from the beginning of your journey, finding guides for this topic is very rare. And I do also looking through other codes, analyze them etc. and try the reverse process how someone was able to find the cheat in the first place. But sometimes hard to understand what the cheat creator was thinking of or able to achieve. But I keep going
don't forget that they know nothing about asm, they do not know how to trace or do advance asm cheats
I understand your perspective but lots of people read through these above hints and I would assume that anyone who is interested in learning the stuff can obtain some piece of information here depending on her/his skill level.
I would be very interested in how you would tackle the challenge nowadays when you would start from zero
maybe the same path maybe tackle more fields where more content is available on the internet and coming to understand Switch games months or years later? Maybe on other consoles it was another way of learning?
Looking to PC games where Cheatengine is available (I have only little experience here) my progress was way more faster because searching and live debugging was all in one place and I would say it is a shortcut for learning.
So long post, sorry for that.
