Alarm for cobra 11 : Crash time - hacks and hacking

[Sethioz]

now this was tough one id have to say.
maybe im missing something, but there's no easy way to find it. took me over 200 searches to find right addresses.

the time you see on screen, dont even bother to freeze it. It doesnt work !
you are able to freeze timer on screen, but it makes no difference.
first i searched for the time on screen and froze it, still ran out of time.
ok then i noticed the ''time limit'' when pausing the game.
time limit is based on the difficulty you select (it is not important).
lets say that time limit is 1:30
when your time expires, you will see that your time there is 1:31 (on pause menu where it says you failed)
so i started thinking that ...wtf is that ?!

i figured out that time doesn't actually run out, but it runs into the limit.
so when you start the mission, time is 0. when time starts running, it increases (towards the time limit)
time is long value and uses 2 addresses (2 addresses for each mission)
value is something like 4641658458642597 (8 bytes)
it is still confusing because the two addresses have +-4 between.
for example if first address is:
1229BC1
then other would be:
1229BC5
so when both are 8 bytes, then first address overwrites half of second. so in theory the first address can be 4 bytes only and 2nd 8bytes (makes no difference at all, still need to freeze both)

how to find it ?
only way i can think of so far...search 0 when time havent ran at all. (when you start mission and 3,2,1 is still on screen) simply pause and search 0.
then let time run 1 or more seconds and search for increased.
do that couple of times, then restart mission and search for 0 again.
to eliminate more wrong addresses you can quit game, start it again (SAME MISSION!!!) and then search 0 when time aint running. that should eliminate few more wrong addresses.
its confusing and harder than normal memory hacks, but its possible. ive done it and seen it. also when you freeze time and then time runs into 00.00.00 and you unfreeze...you still dont run out of time. yes the visual timer on screen runs into 00.00.00, but as i said before, makes no difference at all. important is the invisible timer that runs from 0 up to ''time limit''.

I also did quite lot research on google and i found absolutely nothing about this game. amazing, isnt it ?! no trainers, no hacks, no cheats, no nothing ! ..well i did find some unlocker, which turned out to be a simple savegame. so i guess im first to post infinite time hack out in pubiic. it actually made me quite mad tht theres no trainer for this game. its a good game, only that stupid time limit ruins whole game.

NOTE-all missions have their own time limit address ! if you find time limit in one mission then it doesnt work on other missions. YES it has similiar value running there (just like it is time), but when you freeze it, you still run out of time.
i am not sure about difficulty levels, but to make sure that you find the right addresses. use only 1 mission and 1 specific difficulty to search.

[Sethioz]

updates.
it seems that i was wrong about few things. some mission DOES use the visible timer. so freezing it will give you infinite time in some missions, but in others you need to find that invisible timer that runs from 0 to ''time limit''.

Droog discovered (in demo) that when you use float search type, then the value is easier to see.
for example if you have played for 10 seconds then float value is 8-11. it is not precise. well it is not 8 - 11, its something like ''8.320342390342'' ..etc. but when you only LOOK at it, you will see that its the right thing. unpause game and keep eye on those values. they should increase just like seconds. you cant filter them down on 1. you end up with 20 or so. then pick up the ones that are same as your time (time you have player, not on screen) and add them. then chagne them to 8 bytes and freeze (i freezed on float, but it didnt work at all, had to change to 8 bytes and freeze)

really intresting game to hack i'd have to say. never seen anything that complicated before.
It also wont allow me to use debugger and/or code injection.

[Droog]

But that was in "Alarm for Cobra 11 - Nitro". Took me only a few minutes... But "Alarm for Cobra 11 - Crash Time" is completely different.
In "Crash Time" there are MANY timers...
For example, one starts from 0 when any mission starts (even if it still counts down "3, 2, 1" beforf the actualy mission timer starts). When the mission timer starts (the one that counts down from 3:00 minutes, for example) another timer starts from 0 AND one timer which starts to count DOWN from 3:00 - 0:00 minutes.

it is still confusing because the two addresses have +-4 between.
for example if first address is:
1229BC1
then other would be:
1229BC5
so when both are 8 bytes, then first address overwrites half of second. so in theory the first address can be 4 bytes only and 2nd 8bytes (makes no difference at all, still need to freeze both)

how to find it ?
only way i can think of so far...search 0 when time havent ran at all. (when you start mission and 3,2,1 is still on screen) simply pause and search 0.
then let time run 1 or more seconds and search for increased.
do that couple of times, then restart mission and search for 0 again.
to eliminate more wrong addresses you can quit game, start it again (SAME MISSION!!!) and then search 0 when time aint running. that should eliminate few more wrong addresses.

That takes far too long...
In "Crash Time" you can find the timers just as easy as in "Nitro". Just search for floating values. All timers count in 0.5 second steps...
So if a mission starts, there is one address that contains a timer that roughly changes like this: 0.000000000 --> 0.436598796325 --> 1.0023659874 --> 1.4226365987 --> 2.0056985548...
If the actualy mission timer starts (visible on screen), a second timer will start the same way...
And the third timer counts DOWN, but also in 0.5 second steps (roughly). So if the difficulty level is set to "Easy" (time limit of 3 minutes), the value in the address will be 180 (float) at the beginning of the mission (when it counts down "3, 2, 1")... And when the counter becomes visible on the screen, you can easily calculate the next value to search for (so if the counter says "2:40", the value will be something like "160.45699856"... Just seach for "Has decreased" and then filter the results by setting a "Range" between 159 and 161).
This way you can find each timer within 2-3 minutes...

so i guess im first to post infinite time hack out in pubiic.

Maybe, but, it's not very useful if the only way to do it is by freezing the DMA's. The average gamer who's just looking for some cheats doesn't really want to bother with downloading a memory scanner and doing searches for unknown values over and over again, every time when a new mission starts, you know...
The real hard part is making a trainer for this game...
If you take a look at the assembler code, you'll see that the game code ADDS something, so the value in your address will be increased. If you simply eliminate this code line (nop), the game crashes. This probably means that this code line affects many more things (that's what I meant in my PM).
Now you can change the part of the code that contains the value that will be added to your address, so instead of adding 0.5, the game will just add 0.0.
BUT if you do that, not only the timer will freeze, but also the whole game itself will freeze...

[Sethioz]

Now you can change the part of the code that contains the value that will be added to your address, so instead of adding 0.5, the game will just add 0.0.
BUT if you do that, not only the timer will freeze, but also the whole game itself will freeze...

never tried this method. i simply tried to nop the lines first, but it just crashed (window closed).

about the float, yeah i tested it and as i mentioned in last post..it is easier to find time, but instead of unknown its possible to search:
1 - float value of 0
2 - float increased
and then do few more increased and/or not changed (pause and wait for 10 secs so time wont change and search not changed)
in this way i was able to find timer very fast. it seems that game has very static memory. ive had this game at least for week now and addresses are still same, but there's another problem.

mission called ''meree chance'' or something like that. this mission uses the on screen timer. so you just have to freeze on screen timer and you are good.

in the mission ''series of accidents'' game uses this invisible timer (one that counts from 0 to 'time limit') so there you have to freeze this invisible timer to get infinite time. on screen timer runs to 00.00.00 and mission wont end (i finally uploaded tht demonstration video into youtube).

now i tought im good to go. was messing around on one mission...just cruising and stuff. then next part of mission started...
ofcourse the timer wasnt same anymore. i mean freezing the onscreen timer i found wasn't the one used in this part of mission. so there i have to find it AGAIN.
it really is a bitch game when it comes to hacking .. doh. but its intresting..took me almost 2 days to figure out that there's invisible timer lol. and another 2 days to figure out that each part of game uses different addresses.

at end i should mention that my game never froze. it totally shuts down (game window simply disappears, like when u click x button) it doesnt matter what address im debugging. as soon as i try to nop any line then it will crash (no matter which address). i also can't add anything into register, well i can add, but as soon as i 'poke' it, it will crash.

Now there is alternate way. in theory it should work. find and change the 'time limit' itself ! and also the mission start timer for all difficulty levels. all of my addresses that handle time seem to be beginning with 9B...so im guessing those limits are in same range.

Just seach for "Has decreased" and then filter the results by setting a "Range" between 159 and 161).
This way you can find each timer within 2-3 minutes...

aint working. already tried to do that on the increasing timer. i searched for 0 (before 3,2,1 ended, when time aint running), then i waited exactly 10 seconds and tried to search range from 8 to 12 and found nothing. to do this trick you have to search from 8.00000000 to 12.00000000. in theory it should work, but havent tried yet.

really dont want to use softice, but it seems that i really need it here.
i had similiar thing with Test Drive Unlimited. as soon as i freezed or changed the money ..then game simply ''left'' the address and took a new one (so the address i found became useless). if i tried to nop the lines that changed money...it crashed.
point - there's still trainers for TDU. prolly made with softice, because softice is not a simple memory searcher. it starts before windows and monitors everything if im correct.

[Droog]

Check your PM, I've made a little trainer.

[Sethioz]

crashing my game. i have also patched my game..so it aint same as demo.
how did you managed to debug the game ?

[Droog]

crashing my game. i have also patched my game..so it aint same as demo.

Yes, probably... Most demo trainers don't work with the retail versions.

how did you managed to debug the game ?

Try using another debugger... The one of TSearch isn't the best one.
Also you have to disable TWO timers (the one that starts from 0 and the one that counts down). If only one of these timer reaches the limit, the mission will fail.

BTW... In the game directory I've found a file called "damage.txt". In that file there are some values for the damage rates and stuff. You can simply set those values to "0.0" (you don't have to change the memory at all - just edit the file with notepad) and your car will take no damage anymore.
I've updated my trainer with some code which changes those values... But you can actually simply edit that file itself.

[Sethioz]

yup i saw the damage file too, but didnt pay much attention to it. dont like no damage anyways. started this whole thing so i would be able to cruise around in missions.
which debugger did you use then ? cheat engine has one, but its different and im not used to it. (and cheat engine sucks)

Edit
about the timers..as i said in other post. some missions use the timer that counts from 0 to ''time limit'' and other missions use the visible timer that counts ''time left''.
in the case ''series of accidents'' you need to freeze ''0 to time limit'' timer and in case ''meree chance'' (or something like that'' you need the on screen timer.
but yeah in trainer you need both timers. so none of the cases (missions) time out.

[Sethioz]

well i guess me and Droog showed that its possible to make a time hack/trainer for this game. so i deleted the game. i doubt that somebody would actually want the trainer...not popular game (dunno y, but its not). i liked the game, but just so not into playing anymore..

guess the project is closed..unless something pulls me back into that game