19 replies to this topic

[Zorg]

Bit Slicer

Description:
Bit Slicer is a universal game trainer that allows you to cheat in video games by searching and modifying values such as your score, lives, ammunition, and much more.

Features:

• Memory Scanner
  
  • Search & narrow down values of several types: integers, floating-points, strings, byte arrays, and pointers
    
  • Add, delete, and modify variables with ease
    
  • Freeze variable's values
    
  • Store a process' entire virtual memory space and search for values based on incremental changes
    
  • Manipulate pointers by dereferencing variable addresses
• Memory Viewer
  
  • View memory live in a hex editor style window
    
  • Dump memory to files on disk for manual inspection
    
  • Modify memory protection attributes
• Debugger
  
  • View live disassembly of instructions
    
  • Modify instruction's bytes directly, or by assembling instructions (including nopping)
    
  • Set breakpoints, resume from them when they're hit, view backtraces, manipulate thread registers, and step into/out/over instructions
    
  • Watch for what instructions access a variable in a document
• Save slice documents so that you can send cheats to your friends
  
• Pause and un-pause current process
  
• Undo & Redo many kinds of changes, including searches
  
• Evaluate mathematical expressions automatically (eg: in a flash game, search for 58 * 8)
  
• Run as a normal user, not as the superuser (root)!
  
• Enjoy OS level features such as auto-saving, document versioning, window restoration, notification center, etc.

Requirements:

• A 64-bit Mac running OS X 10.6 or later
  
• Administrator password to allow Bit Slicer to access memory

Download Bit Slicer:

http://dl.dropbox.co...it%20Slicer.zip

[Zorg]

Changes in 1.0:

• Initial Public Release
  
• Search values with various data types and functions
  
• Search options such as searching within a range, or with a floating-point epsilon, or by ignoring string case, or by comparing the initial values from the last search.
  
• Add, Edit, and Remove values in the table
  
• Freeze values
  
• Pause target in Bit Slicer or by using a hot key configured in the preferences to pause the frontmost application.
  
• Dump memory into a file with a desired range

Changes in 1.0.1:

• Added dumping all memory of a process

Changes in 1.0.2:

• Added support for exact length searches for UTF-16 strings.
  
• Added a calculator that evaluates mathematical expressions. For example, if you enter 100 * 8 in the search field, it will search values of 800.
  
• Fixed writing permissions when dumping all memory of a process.
  
• Fixed some functionality with editing variable values via the edit variables window.
  
• Fixed issues searching for large unsigned values for 32/64-bit integer data types.

Changes in 1.1:

• Added feature for storing all values from a process at any given time, and then being able to compare the current values with its previous stored values.
  
• Fixed several small bugs and memory issues.

Changes in 1.2:

• Added feature to edit a variable's address in a dynamic way (useful for dealing with pointers).
  
• Added a name column.
  
• Variable type can now be changed in the table.
  
• Fixed critical bug when dealing with variable addresses in 64-bit processes.

[Zorg]

Changes in 1.3:

• Added pointer data type for searching for pointers.
  
• Added 'options' UI that allows you to expand more search options.
  
• Added option to search for unwritable values.
  
• Added an option to specify what address range to search data inside.
  
• Added an option to ignore data alignment (will result in slower searches, but will find data that is mis-aligned).
  
• Optimized searching for doubles/64-bit integers when data alignment is not ignored.
  
• Fixed permissions with saving documents.
  
• Fixed rare-ish bug where a variable's value may not update if it has been changed outside of Bit Slicer.
  
• Fixed a bug where changing an address of a UTF-8 String to point to an empty string may not immediatley update the value in the table.
  
• Improved some reliability of search progress bar.
  
• Replaced calculator dependency for evaluating arithmetic expressions in fields, taking Bit Slicer down to less than 1 MB in size.

[Zorg]

Changes in 1.4:

• Added a lightweight memory viewer.
  
• Added option to change the protection of an area in memory (eg, making a region writable)
  
• Added support for Byte Array datatype.
  
• Searching for unwritable values is now set by default.
  
• Bit Slicer will try to prevent one from modifying a variable that is not writable.
  
• Fixed a bug when un-doing immediately after manually adding a variable.
  
• Changed format for the function types to choose from.
  
• Removed compare stored values checkbox in favor for adding functions that compare against stored values.
  
• Added '= Stored Value +' and '≠ Stored Value +' functions (i.e. search for variables that have increased/decreased by a certain value).
  
• Fixed a bug where the table may have not instantly updated a variable's value after it has changed.

[Zorg]

Changes in 1.5.1:

• Fixed [address] functionality (Tools -> Edit Variable Address), which broke in 1.5.

Changes in 1.5:

• Fixed critical bug leading to the target process or system to crash when searching for values (bug was possibly introduced in OS X 10.7.2).
  
• Added ability to use wildcards * or ? in byte array searches (eg: 1A *B CD **).
  
• Fixed modifying pointer variable values.
  
• Full-screen Lion support & better document window resizing.
  
• Lion window restoration.
  
• Improved hotkey customization for pausing processes.
  
• Added an alert to check if new updates are available.

Changes in 1.5.2:

• Fixed big memory leak when reading from memory and performing searches (bug introduced in 1.5).
  
• Fixed dumping all memory of a process onto disk, which broke in 1.5.
  
• Fixed issues with undo/redo for variable-size type variables.
  
• Fixed rare/minor issue with string variable's values not updating in table immediately.

[heliri]

Very cool and useful Thanks for this.

[TommyGun]

This is also a similar app I use is anyone is interested: http://www.macupdate...13632/the-cheat

[Zorg]

TommyGun, on 14 April 2012 - 08:53 AM, said:

This is also a similar app I use is anyone is interested: http://www.macupdate...13632/the-cheat

It's pretty similar but kind of dated and has been halted in development for a long time. It's one of the apps that influenced Bit Slicer, and motivated it to do things that The Cheat cannot.

[Kurt Nauck]

I love this product. The one thing it's missing that I really would like is a "compare to last scan" or "compare to saved scan" function set. I know that you can do = < > ~= against a scan or saved value, but being able to:
a) search for a value that is less than, greater than, equal or unequal to last scan/saved value without knowing the exact value
b) edit memory with the memory viewer!
would make this excellent. In addition, NOPing would be an amazing addition, but that'd require a disassembler/debugger module...so I don't ever expect to see that.

Anyway, thanks for the amazing product. Is there a way I can donate to you? I love this tool and have wanted to give you something for it...I finally got a massive raise and I can afford it! lol

[Kurt Nauck]

Is there a chance that we could get a command line interface for this? Or perhaps, being able to pass BitSlicer arguments and perform operations without using the gui?
For example:
BitSlicer <processID> <variableType> <variableValue> [<rangeMin> <rangeMax> <flags> etc...]

[Zorg]

Kurt Nauck, on 02 November 2012 - 04:34 PM, said:

I love this product. The one thing it's missing that I really would like is a "compare to last scan" or "compare to saved scan" function set. I know that you can do = < > ~= against a scan or saved value, but being able to:
a) search for a value that is less than, greater than, equal or unequal to last scan/saved value without knowing the exact value

Can't you do this? I'm sort of confused. That's what the "Stored Value" functions are for. You just have to save the stored values when you want to (Tools -> Store all values in menubar).

Kurt Nauck, on 02 November 2012 - 04:34 PM, said:

edit memory with the memory viewer!

I could look into this. I hadn't before due to how the memory viewer was (wrongly) implemented before. It'd be in like a hex-editor fashion.

Kurt Nauck, on 02 November 2012 - 04:34 PM, said:

In addition, NOPing would be an amazing addition, but that'd require a disassembler/debugger module...so I don't ever expect to see that.

I'm interested in seeing if I can put in a dissembler but I'm not sure if that's going to happen. I currently also use GDB and otx in conjunction with bit slicer for inspecting programs, and if there's an instruction I know I want to nop in memory, I add the byte array to a document, make the protection on it writable, and modify the bytes to 90's (in hex) [least that's how it is for x86].

Command line interface: maybe. Only advantage I see with it is being able to use bit slicer remotely.

I don't have a donation system set up right now. Sorry about not responding sooner, I haven't been checking here lately because this isn't the most active place. Thanks for the feedback though.

[edit]: I'm now following this forum, this should work better : ).

[thanoulas]

Hey, I didn't know the author of Bit Slicer hangs around in here! Massive massive thanks to you mate, the app is amazing.
I'm using it to find memory areas to develop MacAssistant RT for OS X, an Assistant tool for Football Manager 2013
(http://www.fmscout.c...ml?e=page#c7080)

Now for a few suggestions:

• Memory Viewer - when you select an area and scroll it out of view, the selection is lost, any way you can fix that?
  
• Memory Viewer - could you possibly add viewing the selected data values? (Int8 / Int16 / Int32 / Float / Pointer) like Hex Fiend does at the bottom?
  
• Memory Viewer - Change the offset display between Hex and decimal (see hex fiend - clicking on the values changes mode)
  
• Search - Add a between search
  
• Search - Add Pattern Search - For example: I'm looking for the following pattern: Int32 Value / XXXXXXXX / Int32 Value (3F800000 XXXXXXXX 3F800000)

That's it, if I think of anything else I'll let you know,

Many thanks again for this insanely useful app

[Zorg]

thanoulas, on 26 November 2012 - 08:33 PM, said:

Hey, I didn't know the author of Bit Slicer hangs around in here! Massive massive thanks to you mate, the app is amazing.
I'm using it to find memory areas to develop MacAssistant RT for OS X, an Assistant tool for Football Manager 2013
(http://www.fmscout.c...ml?e=page#c7080)

Now for a few suggestions:

• Memory Viewer - when you select an area and scroll it out of view, the selection is lost, any way you can fix that?
  
• Memory Viewer - could you possibly add viewing the selected data values? (Int8 / Int16 / Int32 / Float / Pointer) like Hex Fiend does at the bottom?
  
• Memory Viewer - Change the offset display between Hex and decimal (see hex fiend - clicking on the values changes mode)
  
• Search - Add a between search
  
• Search - Add Pattern Search - For example: I'm looking for the following pattern: Int32 Value / XXXXXXXX / Int32 Value (3F800000 XXXXXXXX 3F800000)

That's it, if I think of anything else I'll let you know,

Many thanks again for this insanely useful app

1. Likely fixed in latest alpha.
2. I don't recall Hex Fiend doing this, how does it do this? Currently you can just add a variable into a document table (it should default to the selected address in memory viewer), but that probably defeats the amount of convenience you want.
3. I think I actually went out of my way to disable that since addresses are represented typically in hex notation. There might have been another reason too which I'm not remembering, I will look into getting it back.
4. Probably something I should do. Currently, if you use > or < functions, you can put a lower or upper bound respectively which has a similar effect.
5. Byte array's have wildcards by using * or ?. Eg: using a byte array: 3F 80 00 00 ** ** ** ** 3F 80 00 00

Glad you found it helpful.

[thanoulas]

Zorg, on 26 November 2012 - 11:15 PM, said:

2. I don't recall Hex Fiend doing this, how does it do this? Currently you can just add a variable into a document table (it should default to the selected address in memory viewer), but that probably defeats the amount of convenience you want.

If you go to Views -> Data Inspector on the menu, you get a selection at the bottom of the document which shows the values when you highlight data in the document

Zorg, on 26 November 2012 - 11:15 PM, said:

5. Byte array's have wildcards by using * or ?. Eg: using a byte array: 3F 80 00 00 ** ** ** ** 3F 80 00 00

Glad you found it helpful.

Cool, that does the trick, thanks!

[Zorg]

Nifty. I had no idea Hex Fiend had that. Bit Slicer uses Hex Fiend's framework for the memory viewer, so I will see if I can pull that component in.

[thanoulas]

Just checked your latest code in your repository, I saw that you're doing the codesign method to get access to the task_for_pid call, and I wanted to let you know that because I've tried that with my app, while it works on your computer, if you archive the app and distribute it, it wont get task_for_pid access on another machine. (unless of course I did something wrong)

[Zorg]

thanoulas, on 29 November 2012 - 11:54 AM, said:

Just checked your latest code in your repository, I saw that you're doing the codesign method to get access to the task_for_pid call, and I wanted to let you know that because I've tried that with my app, while it works on your computer, if you archive the app and distribute it, it wont get task_for_pid access on another machine. (unless of course I did something wrong)

Have you tried the latest alpha which uses it? It's been tested to work. It should work since I obtained a developer ID from Apple.

[thanoulas]

Zorg, on 29 November 2012 - 02:08 PM, said:

Have you tried the latest alpha which uses it? It's been tested to work. It should work since I obtained a developer ID from Apple.

Ah ok, I thought you were building it with a self signed certificate. No worries then

[Kurt Nauck]

Zorg, on 24 November 2012 - 10:37 PM, said:

...
Command line interface: maybe. Only advantage I see with it is being able to use bit slicer remotely.
...

It'd be very handy if one wanted to, say, write an applescript to launch a game/program and automatically patch memory locations =D

PS: Holy ****ing ****, batman! NOP <3

[Zorg]

Changes in 1.6:

• Added Debugging features including a disassembler, assembler, breakpoints, and watching variable accesses (watchpoints)
  
• Added contextual menu support (right click menus) throughout application
  
• Added "Store all Values" into function list
  
• Added new application icon and a document icon
  
• Added Auto-saving and document versioning (for OS X 10.7+)
  
• Added Notification Center support (for OS X 10.8+)
  
• Improved overall performance, including speeding up searching dramatically
  
• Improved selection of running processes; child processes now show up
  
• Improved usability of Memory Viewer and added Data Inspector
  
• Memory protection changes are now made automatically if possible (eg: overwriting an unwritable value)
  
• Code Signed application; no longer need to run as root
  
• Using Sparkle for updates
  
• Dropped support for 32-bit Macs
  
• Many bug fixes