CABAL SEARCH METHODS

Requirements:
1. Cheat Engine
2. Any version of Cabal

Reccomendation:
1. At least try to get to step 4 of the Cheat Engine tutorial. (You can find these
in the map of Cheat Engine, they are called 'Tutorial-i386.exe' and 'Tutorial-
x86_64.exe')
2. If you got familiar with the way Cheat Engine works, if you know how to find the
addresses and want to gain more knowledge
What is this thread?
This thread will try to give you some insight in how to find addresses with Cheat
Engine, it does not contain all the hacks, it does contain all the different
'methods' to find the hacks. Even though, the most important ones are explained in
this 'guide'.

For what version/episode is this thread?

You can use these techniques on all versions/all episodes, but I play at EU which
is episode 8 at the time of writing, so the examples will have these addresses.

Do I gain anything more, other than there is already in the 'Episode 8 Cheat
Table'?
Knowledge

Cheat Engine
----------------------------------------------------------------------------------
Basic Cheat Engine (CE) knowledge - must read!
Scan range: This is the area of addresses you will search in, you can find this in
CE under 'Memory Scan Options', by default these values are 'Start:
0000000000000000' and 'Stop: 7fffffffffffffff'. The ranges used in this guide,
should be big enough to find the address on all versions/episodes.

Scan Type: in this guide the default 'Exact Value' is used, unless there is
something else defined at a particular topic.

Value Type: in this guide the default '4 Bytes' is used, unless there is something
else defined at a particular topic.

Static address: an address that will not change when you restart your client

Dynamic address: an address that will change when you restart your client

Value: the number an address is holding

Freezing a value: Tick off the little square box, left of the address

Map hack & Walk trough/kill gate hack

Note: Map hack only works in episode 7 or lower!

Range: 0000 0000 - 2000 0000

Range EU ep8: 0100 0000 - 0700 0000

Steps:
1. Go to Bloody Ice, search for 1
2. Go to Warp Center, search for 30
3. Go to Desert Scream, search for 2
4. Go to Warp Center, search for 30
5. Go to Green Despair, search for 3

Now you should only have a few addresses left, if not, repeat step 1-5 again, 1 is
the map hack address, 1 is the walk trough/kill gate hack address.

Note: Map hack address is one of the few 'static addresses'.

How to use it
Walk trough/kill gate hack: Go inside any dungeon you like, change value to 1
(restore original value to talk to NPC's to finish quests etc.)

Map hack: Go to 'Select Character screen', change the value to the Map value you
want to go to, log in again.
Map values
Bloody Ice: 1
Desert Scream: 2
Green Despair: 3
Port Lux: 4
Fort Ruina: 5
Lakeside: 6
Undead Ground: 7
Forgotten Ruins: 8
Mutant Forrest: 9
Pontus Ferrum: 10
Porta Inferno: 11

Range: 0000 0000 - 2000 0000

Range EU ep8: 0600 0000 - 0700 0000

Note: If you are fast you can do this with just 1 combo!
Hint: Take some distance from a dummie/mob, then start combo, gives you more time
to scan!

Always do 1 in combo
Steps:
1. Go in combo, do a skill, scan for 1
2. Break the combo, scan for 0
3. Go in combo, do a skill, do not scan, do a second skill, scan for 2
4. Break the combo, scan for 0

You should only have a few addresses left, if not, repeat step 1-4.

Perfect combo (use whole combo bar)

Steps:
1. add 1D to the address you found above
Example:
Use Windows default Calculator in 'Programming mode, hex' for example 'Always do 1
in combo' = 067C77E9, then type in the calculator 67C77E9 + 1D, which results in
067C77CC (this is the prefect combo address)
Use:
Freeze both values on 0 to 'activate' them.
No Skill Delay & Auto SP regen
Episode 7 or below
Range: 0000 0000 - 2000 0000
Steps:
1. Do /dance, search for 0
2. Stop dancing (just stand still), search for 1
Repeat step 1-2 untill you only have a few addresses left
Episode 8
Range: 0000 0000 - 2000 0000
Range EU ep8: 0600 0000 - 0700 0000

Steps:
1. Do /dance, search for 3128464
All Episode
Just stand still, freeze the value, you now have No Skill Delay. To have Auto SP
regen: dance while the value is frozen, press W A S or D to 'snap' out of the
animtion. The SP will now regen at the speed as if you where dancing.
Note: The Auto SP regen has to be re-enabled after each time an aura/bm/bm2/bm3 is
over & after each time you use a portal

Coordinate hack
Range 0000 0000 - 2000 0000
Range EU ep8 0600 0000 - 0700 0000
Scan Type: Value between...
Value Type: Float

Requirements: Map (press M)

Steps to find X-coordinate

1. Press M, look in the left corner, read the X-coordinate.
2. If it is for example '65', then you need to search for the value between '6500'
and '6600'
3. Move to another coordinate, press M, now you read the X-coordinate and it is for
example '72', then you need to search for the value between '7200' and '7300'
4. Repeat this untill you have it
Steps to find Y-coordinate
1. Same as the method to find the X-coordinate, but this time you read the Y value

How to use this

To use this, you need to assign coordinates to a hotkey (right click on the
address, 'Set/Change Hotkeys', make sure to always assign the X and Y coordinate to
the same hotkey. You need to change them both at the same time.
Note: You can use this to spawn near portals, then use those portals. If you don't
spawn near a portal, and try to walk, you will DC!

DP hack
The address is the same as the 'Walk trough gate/kill gate hack'-address.
How to use this
Join a dungeon with a NPC (something you talk to for a quest), start the dungeon,
change the value of the 'Walk trough gate/kill gate hack'-address to 57, talk to
the NPC, finish the dungeon.

NCT
to find no NCT... so simple.... cast a skill (any) then scan uknow initial value..
then cast a skill again then scan for increase value... cast a skill again then
scan increase value... hope you get it...
___________________________________________________________________________________
___________________________________________________________________________________
______________________________

For all the people who asked for it,this is my wallhack method.
This method describes how you can find out the maparea adress and pointer for your
client. Its working on all clients I know and play including official servers and
Mystery Cabal.

This is it step by step:

1.
Enter the Map Bloody Ice

2.
Scan "Array of Bytes":

01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00
07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 06 00 00 00
06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 07 00 00 00 07 00 00 00
07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00
07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00
07 00 00 00 07 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00
06 00 00 00 06 00 00 00 06 00 00 00 07 00 00 00 06 00 00 00 06 00 00 00 06 00 00 00
07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 07 00 00 00 01 00 00 00 01 00 00 00
01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00

This search matrix is complex enough to bring up only one result.

3.
Take this adress and subtract 0x42804.
This should result in an adress like 0x0???020.
This is your Maparea adress. It's changing every time the client is run.

4.
Now do a 4-Byte scan for this adress.
Cheatengine will find one green pointer for this.

btw:If you are using DE/EU Fixedmain without gameguard from our sticky thread the
pointer is fixedmain.exe+C7BF80

How to wallhack:
After 0x40000 bytes of map data and visual elements you'll find another 0x40000
bytes of collision map. If you clear the complete collision map (fill with zeros)
you'll have a perfectly nice wallhack that gameguard does not detect.

Enjoy..

And good to see you all still around here ;-)

open calculator take the hex in this thing fixedmain.exe+C7BF80 "C7BF80" then add
400,000 in HEX You get Map Area Base which is "107BF80" then all you have to do now
is just add 40814 in CE result if all steps is followed