by olivier pasqualini

SUMMARY :

 	You MUST choice 65 536 colors or more, smaller font in display properties

and like use 800 x 600 or more.FOR USE MTC.

Introduction

The  trainer

PID LOCK (choice the program in memory)

Search modes:	     Normal     Progressive     The hunter

Module for analysising an address     Use

Write in memory after the search

File editor

Editing the memory

Calculator

Editor hexa/ascii

Module easy write

Scan (see the structure of a memory ‘s game)

         	Memory’s map of the game

Copy the memory on an file

                Search for chains ascii or hexa

            Trainer’s maker

Patch’s maker

Magic editor creator

Use hot key for call the trainer

Write in the memory during a game with hot keys

search during the game

Config menu

Infos

Read me

F1: HELP in each module.

MOUSE: click on the right button on the trainer when you are not on a control for see the

fonction of each button in the main window.

This program don’t work on CYRIX CPU.


INTRODUCTION

This program don’t work on CYRIX CPU.

The 22 MAI 1997

For  Windows95 (i never try on NT but if the trainer work the start address will be 100 000)

 This program is a freeware, and must be distributed freely.

this program or the trainer made by magic trainer creator don’t must use for illegal action!!!!!!!!!!!

When you use this software you do so at your own risk. If you do not agree with these terms delete this software now.

and don’t ask me for sources!!!!!.

The Official Magic Trainer Creator Site is located at : http://www.redbox.at/cheats/mtc.html

    and don’t forget to visit this cool cheat page at :  check out http://www.redbox.at/cheats/

This trainer is made for cheating in win95’s and dos’s game.and this trainer need to be run under W95.

---------

- v1.0 -

---------

- 3 search modes.

- Freeze.

- Save et load fonction.

- You need the pid of the program to cheat

- A moniteur for see the memory.

---------

- v1.1 -

---------

- Save the memory on file (bku).

- The search progressive and advance are not limited at 10 000h now .

- Fast search.

----------

- v1.12 -

----------

-  The save of the memory is not limited at 10 000h and more fast now.

-  Add  egale at the search.

-  Bugs fix.

----------

- v1.14 -

----------

- Module for scanning.

----------

- v1.15 -

----------

- Module for search hexa/ascii chain.

- Moniteur now en ASCII.

- FIX a bug of the v1.14.

-----------

- v1.16 -

-----------

- Module for write ascii/hexa chain.

-----------

- v1.17 -

-----------

- Trainer ‘s maker.

-----------

- v1.18 -

-----------

- Module for search Pid of program in memory.

-----------

- v1.19 -

-----------

- Double click on the ligne in the module "values to write in memory" for change the value.

- ?

-----------

- v1.20 -

-----------

- Module "the hunter" for tracking change of value.

-----------

- v1.21 -

-----------

- Fix a bug on the hunter.

- search for chains  hexa / ascii :FAST.

- search normal :FAST.

- Module for analysing.

- Hot key for call the trainer in a game.

- Fix bug on the copy of memory.

-----------

- v1.22 -

-----------

- Module for searching during the game (expérimental , need a good computer).

- Module for write in memory during the game with hot keys.

- New trainer’s maker.

-----------

- v1.23 -

-----------

-Module easy write (read a .txt (like diablo hack) ,and use hot keys and freeze)

-----------

- v1.24 -

-----------

-You can modify the sensibility of the search with an track bar, don’t put the bar at the extreme left for don’t have a search too long.

-Fix a bug on easy write with hot keys.

-help : click on the right bouton of the mouse for have a new cursor and see the fonction of all buttons.

-trainer generate in english.

-----------

- v1.25 -

-----------

-Auto end address.

-Fast search.

-choice between ( NONE(AUTO choice between numbers of bytes)  ,1 byte,2 bytes,3 bytes,4 bytes,  float (ex: for AOE,...))

-Module for display the map of the memory.

-Replace all hexa chain found by another chain.

-Now the trainer can be use on DOS PROGRAMS.

-----------

- v1.26 -

-----------

-Remove the limit of 69000 addresses found on the normal,advance,progressive searchs.

-Editor hexa /ascii.

-Api call catcher (not finish).

-Calculator.

-you can selecte more 1 addresses in : Values to write in memory (shift,ctrl).

-With the new pid lock : dos programs are display with the name WINOLDAP.

-File editor.

-----------

- v1.27 -

-----------

-Patch maker

-Magic editor creator for file and memory.

-Bugs fix (calculator,file editor)

-Easy write in english

This program can be use same game wizard or action replay

                          ***********************************************************

                          *                    W95 ‘s programs start all at 0x400000     to  0x7FFFFFFF               *

                          *                    DOS’s programs start all at 0x80000000 to   0xBFFFFFFF              *

                          *                                                                                                                                     *

                          ***********************************************************

ALL addresses found on dos programs can change!!!!!!!!!.it’s why you can ‘t build a trainer for dos.

INSTALLATION

Unzip in a directory .magic trainer creator.exe must be always in the same directory of bibliotheque.dll.

Choice small fonts and 65 536 colors .!.

like use 800 x 600.

If you use pkunzip or wzinp for w16: the right names are :

MAGIC TRAINER CREATOR.exe

MAGIC TRAINER CREATOR.HLP

bibliotheque.dll

bibliotheque2.dll

bibliotheque3.dll

bibliotheque4.dll


THE TRAINER


PID LOCK(choice the program in memory)

figure 3

Press the button near  PROCESS ID for open this window and double click of  the program in memory for open the trainer on this program.

NOW DOS PROGRAMS ARE DISPLAY WITH THE NAME : WINOLDAP


SEARCH MODES

Introduction:

*WARNING : AVOID TO SCROLL THE GAME FOR FOUND THE LESS OF ADDRESSES BETWEEN THE FIRST START AND CONTINU .!THE FIRST START and CHANGE!.

* stop the music of the game for have a fast search ,because the  management of the cd-rom slower the cd-rom.

* IF YOU USE THE AUTO END ADDRESS.OPEN THE TRAINER ON THE GAME JUST BEFORE START AN SEARCH.

Data type:    1 byte  :   0 -> 255                 0->FF

                    2 bytes:   0 -> 65535             0->FFFF

                    3 bytes:   0-> 16777215        0->FFFFFF

                    4 bytes:   0-> 4294967295    0->FFFFFFFF

                       float:    4 bytes  1.2E-38 to 3.4E38  for some games like AOE for exemple.

memory map:

Ms-dos compatibility      0x00000000  to 0x003FFFFF.

Win32:                           0x00400000  to 0x7FFFFFFF.

DOS,Win16:                  0x80000000  to 0xBFFFFFFF.

system of exploitation :    0xC0000000 to 0xFFFFFFFF.

the first search mode

---------------------

NORMAL

launch the trainer, launch a game , remember the value who is interresting

 (for exemple the life = 100). then next press ALT-TAB.

*Use PID LOCK (fig 3) for open the trainer on the game in memory.

* choice NORMAL search.

* after write the value to search always in decimal here : 100

* press "START".

* after the end of the search return to the game with ALT-TAB.

* lost few life (for exemple you have now  : 89).

* return to MAGIC TRAINER CREATOR with ALT-TAB.

* write the value to search always in decimal here : 89.

* press CONTINU

* at the end of the search press ALT-TAB for return to the game.

* repeat this  for found the less of addresses.

remember: an value life or other can be write in memory like 1 bytes..to 8 bytes

P.S. :never search 0 for the first search.

        Value max to search  : 999999999 in décimal.

2 nd search mode

-----------------------

ADVANCE

For search on a difference between 2 search.

ex:

you have a life = 100

press start

return to the game,lost few life,and now your life is = 90

write 10 and press the button for show sign -

3 rd search mode

-----------------------

PROGESSIVE

For search on a varitaion  (+,-,=).

ex:

you have a life = 100

press start

return to the game,lost few life,and now your life is = 90

press the button for show sign -

A search between 400000 to 560000 need  1.408 meg on your hard disk.

The module of search :   THE HUNTER


SEARCH NORMAL

Search’s exemple on the program  : PROGRAMME TEST.EXE

1st search

Start the program : programme test.exe

1- press the button near process id,and choice the prog test with double click.

2- choice the normal mode

3-enter the value to search ,here 1

4-press start

2nd search:

press twice the button (1) of the progr test

1-enter the value to search, now :  3

2-press continu

if you have found more 1 address: continu the search if not press the button near the post-it and go to :  write in memory or launch the  ANALYST :

ANALYST


HOW  WRITE IN MEMORY

solution 1: stop the value in memory

1-set the freeze : 600 refresh /mn (max)

2-press twice the button freeze

press the button (1) in the prog test,and the value 3 is always write in memory.you see always 4 on the prog test.

solution 2 : change the value in memory

1.double click on the line for change the value

2.write the new value in the little module and press the button.

3.select the line and press poke for write the new value in memory.


MODE PROGRESSIVE

Search’s exemple on the program  : PROGRAMME TEST.EXE

This mode is for the energy bar or other coding values

1st search

Start the program : programme test.exe

1-press the button near process id,and choice the prog test with double click.

2-choice the progressive mode.

3-press start

2nd search

1-press the button  (2) of the  progr test,for increase the value.

2-choice  + on the trainer (value to search) because the value of progr test is increased.

3-press continu

if you have found more 1 address: continu the search if not got to  HOW  WRITE IN MEMORY


SEARCH WITH  : THE HUNTER

Search’s exemple on the program  : PROGRAMME TEST.EXE

1st search

start the program : programme test.exe

1- press the button near process id,and choice the prog test with double click.

2- launch  the module : the hunter

3- press start pour start the search.

2nd search

1- press the button  (2) of the  prog test, for increased the value.

2- the value is not the same so press : change.

3rd search

1- don’t press the button  (2) of the  prog test.

2- and press  : no change

continu the search for have the less addresses found.

and after press the button near the post-it and go at HOW WRITE IN MEMORY


MODULE FOR SHOW THE STRUCTURE OF A MEMORY’S GAME

For see values’s change:

ex:

@ 400000 - 400100 +2 -0

"@" = If value change in the area

"400000 - 400100" = area of memory

"+2" = 2 values are increase.

"-0" = 0 value are decrease.

double click on the line after a green icon for open the module below :

Memory map of the game

The view module can be display only if you have found less 300 adresses with the scan.


EDITING THE  MEMORY (hexa ascii)

Figure 1

Figure 2

This module can write ascii / hexa chain is memory  (fig 2).

 AFTER THE SEARCH ?

After you have found 1 one more values. 2 choices :

-double click on the line ,and address and value are transfer in the module below.

-press the little button near the post-it for transfer all.

You have 3 choices now:

You can enter max 197 lines

- PRESS directly the button ADD (1), and stop the value with the FREEZE button (2), set the timer (3).

- Write an maximum value.

For exemple : 2566 in hexa is write  66 25 in memory.

                      40 in decimal = 42200000 and write in memory : 00 00 20 42.

* There is a module for convert base 16<->10.

(Hexa <- > décimal)

* You can edit value in the module : values to write in memory.


BACK-UP (disk icon)

SAVE

save  the memory on a file :   .bku

LOAD

load a file .bku in the memory

If  MANUEL is selected, the file is write at the address in BEGIN ADDRESS..


Module for searching chains  (hexa or ascii)

This trainer can search hexa / ascii chains in memory

Ex: 6688   in hexa

      MOVE   in ascii

 hexa ‘s chains must be pair:

 556599 :RIGHT.

 55659 : WRONG.


MAGIC TRAINER CREATOR (made your own trainer)

You can  made little trainer (307k).

Press the button at the bottom right near a screwdrive.

You need guive informations following :

TITLE : Title of the window

MADE BY : YOU!

DATE :

FOR : The game to training

INFO : All you want.

EXE NAME: Name of the exe (the trainer generate)

GTC FILES: for made trainer more stable write your addresses in gtc files in growing order.

ex: 400045 36                 *

      400046 99                 *

      400047 22                 *         right

      400059 55                 *

      400100 66                 *

SO : the trainer write addresses and values very fast in memory

and no : 400045 36      *

               400046 99      *

               400059 55      *       wrong

               400047 22      *

               400100 66      *

Ps: The left side must be complete , the right side is only an option.

*auto pid : for found the pid of the game in memory (you need open MAGIC TRAINER CREATOR before on the game for use this option).If not the trainer generate use only hot keys.

After press the bouton under the magic wand for made the trainer.

You will found the trainer in the same directory of  MAGIC TRAINER CREATOR.

E.X :


THE HUNTER (search for memory ‘s change)

This module can search variation of bytes in memory (like this module for search coded values or energy bar).

Press start for begin the search, and when the value interresting change press the ‘change’ button.and vice versa for the button ‘no change’ .the post-it tranfer all address in the module : ‘ values to write in memory’.

EXEMPLE : The hunter


P.S.

I’m not so good in english sorry for this bad translation.

This program is for w95 and some onlines ‘s games run under w95 .Don’t cheat on multiplayer’s games

I always on kali if you want speak.

Tested by : Nikers and BILLYBOY  (http://perso.club-internet.fr/billyboy)

------------------------------------------


email : opasqualini@mic.fr

The Official Magic Trainer Creator Site is located at : http://www.redbox.at/cheats/mtc.html

 pseudos :


MODULE FOR ANALYSING ADDRESS

With this module  you can found routines who are calling an address and after you can delete this call.

You see the modification made by the trainer (octects write in memory for delete an line).

EXEMPLE : Use


USE OF THE ANALYST

exemple on the program  : PROGRAMME TEST.EXE

1 ° press the button for start the search

2 ° lines green are for write the memory other are for read .

try to delete line one by one.

line write in memory : ex POKE 450000 90,90,90,90,90,90 ou 450000 90 , 450001 90 etc...


THE PROCESS ID IS WRONG  PRESS THE LITTLE BUTTON NEAR  A  :  PROCESS ID FOR CHOICE THE PROGRAM IN MEMORY.

PID LOCK (choice the program in memory)


LIST OF ERRORS :

THE VALUE TO SEARCH IS NULL : before press start in the normal search you must write a value not null .

THE VALUE OF DIFFERENCE IS NULL : The value between start and continue must be > 0.

COPY'S AREA IS WRONG : The difference between the start and the end address must be less 2.

MINIMUM 2 LETTERS TO SEARCH : Exemple : AB.

MINIMUM 4 NUMBERS TO SEARCH : Exemple : 1234.

WARNING DOS PROGRAM :  The trainer don’t work on dos programs.


SHORT CUT (DON’T WORK WITH DOS PROGRAMS)

CHOICE BETWEEN 4 HOT KEYS.

During the game ,press this hot key for return to the trainer.


MODULE FOR WRITE THE MEMORY DURING THE GAME  WITH HOT KEYS (DON’T  WORK WITH DOS PROGRAMS)

with the  poke : press the hot key for write the gtc’s file in memory during the game.

with  the freeze: press the hot key for actived the gtc ‘s file and another for desactived .all during the game


MODULE FOR SEARCH DURING THE GAME(DON’T WORK WITH DOS PROGRAMS)

Expérimental  , need a good computer.

1°) During the game press the hot key about start/reset (here END) for  initialing the search(press another for reset the search).

2°) After the display of  : READY. you can choice between : change,no change,increase,decrease.

STOP : stop the search.

FREEZE : if < 100 values found.

WAIT FOR THE DISPLAY  :READY  BETWEEN EACH OPERATION.


MODULE EASY WRITE (HOT KEY DON’T WORK WITH DOS PROGRAMS!)

If you want use EASY WRITE without hot keys,open MTC before on the game with the PID LOCK.And double click on the line to actived or desactived.

You can choice open the trainer on the game before and  double click on the line that you want actived or use hot keys.

here an exemple:

« # » + space +  ( Comment lines ).

«start »  + space +  (the name of the game)

«comment » + space +    action of the cheat

« KEY » + space +  (HOT KEY)

« STATUS » + space +   (POKE or FREEZE)

«offset» + space +  ( <olddata> <newdata>)

space + « ; »  at the end of the last line

------------------------------------------------------------------------------------------------------------------------

#                     comments

#                     ********

# TOTAL ANNIHILATION 1.2 BETA 1 CHEAT FOR MAGIC TRAINER CREATOR v1.27

# WITH THE MODULE : "EASYWRITE"

# old values & new values ex: 74 88 & eb 88

# STATUS : choice between : !POKE ou !FREEZE

# list of keys :

# F1,F2,...,F12

# A,B,...,Z

# 0,1,...9

# NUMPAD0,NUMPAD1,NUMPAD/,NUMPAD*,NUMPAD-,NUMPAD+,PADENTR,PAD. (NUMPAD0 = KEY 0 OF THE NUM PAD)

# NUMLOCK,SCROLL,DELETE,INSERT,SNAPSHOT,PRINT,PAUSE,PGDOWN,PGUP,HOME

#END,ARROWRIGHT,ARROWDOWN,ARROWUP,ARROWLEFT,SPACE,ESCAPE,CAPSLOCK,CONTROL,SHIFT

# RETURN,TAB,BACK,CTRLBREAK

# 46001e 90 90 90 90 90 90 & 90 90 90 90 90 90

# enablekey  choice an key for enable or disable all hot keys in the game (optionnal)

enablekey f10                              (key for actived all hots keys in the game)

start  total annihilation 1.1           (name of the game&begin the line)

comment control joueur 1          (action of the key)

KEY NUMPAD1                             (key for actived the cheat)

STATUS !POKE                                (!POKE or FREEZE)

509D4F 00 00 & 00 00                       (old & new values)

456d7c 74 & 74 ;                                (end of  this key  write:  ;  )

start total annihilation 1.1

comment control joueur 2

KEY NUMPAD2

STATUS !POKE

509D4F 01 01 & 01 01

456d7c eb & eb ;

start total annihilation 1.1

comment control joueur 3

KEY NUMPAD3

STATUS !POKE

509D4F 02 02 & 02 02

456d7c eb & eb ;

start total annihilation 1.1

comment control joueur 4

KEY NUMPAD4

STATUS !POKE

509D4F 03 03 & 03 03

456d7c eb & eb ;

start total annihilation 1.1

comment control joueur 5

KEY NUMPAD5

STATUS !POKE

509D4F 04 04 & 04 04

456d7c eb & eb ;

start total annihilation 1.1

comment control joueur 6

KEY NUMPAD6

STATUS !POKE

509D4F 05 05 & 05 05

456d7c eb & eb ;

start total annihilation 1.1

comment turbo off/on

KEY T

STATUS !POKE

44ef0e 13 & 09 ;

start total annihilation 1.1

comment construction rapide off/on

KEY C

STATUS !POKE

409a25 d9 87 & eb 6e

423e04 01 & 00

43a378 01 & 00

43a6a0 01 & 00

48530C 76 & eb

490ff2 01 & 00

4913bf 01 & 00 ;

start total annihilation 1.1

comment invisible off/on

KEY I

STATUS !POKE

40999f 7b & 00

4099af 6b & 00

4099CC d9 44 24 10 & 90 90 90 90 ;

start total annihilation 1.1

comment radar  off/on

KEY R

STATUS !POKE

53f1cf 0 & 2 ;

start total annihilation 1.1

comment damage x2.5  off/on

KEY D

STATUS !POKE

441475 64 & 20 ;

start total annihilation 1.1

comment vitesse jeu ++  off/on

KEY V

STATUS !POKE

53fcea 14 00 14 00 & 14 00 ff ff ;

start total annihilation 1.1

comment power and metal on/off

KEY P

STATUS !FREEZE

508eca FA 44 & FA 44

53f0e1 FA 44 & FA 44

508ed6 FA 44 & FA 44

53f0ed FA 44 & FA 44 ;


MEMORY MAP OF THE GAME.

memory map:

Ms-dos compatibility      0x00000000  to 0x003FFFFF.

Win32:                           0x00400000  to 0x7FFFFFFF.

DOS,Win16:                  0x80000000  to 0xBFFFFFFF.

system of exploitation :    0xC0000000 to 0xFFFFFFFF.

MEM_RESERVE : don’t use by the game, you can’t write.

MEM_FREE        : don’t use by the game, you can write.

MEM_PRIVATE: can be use by the game ,you can write


CONFIG MENU

Fast mode : for the : normal,advance,progressive,hunter searchs. (not in the 1.26)

Auto end address: guive you the probable end address.

all are enable by default.


IMPORTANT

- HOT KEYS DON’T WORK ON A DOS PROGRAM.

- ADDRESSES FOUND ON A DOS GAME,CAN CHANGE WHEN YOU RELOAD THIS GAME AGAIN.

- REMEMBER: AN ADDRESS FOUND CAN BE WRITE IN MEMORY WITH 1,2,4,8 bytes.

                                                             Data type:    1 byte  :   0 -> 255                 0->FF

                                                                                   2 bytes:   0 -> 65535             0->FFFF

                                                                                   3 bytes:   0-> 16777215        0->FFFFFF

                                                                                   4 bytes:   0-> 4294967295    0->FFFFFFFF

                                                             float:    4 bytes  1.2E-38 to 3.4E38  for some games like AOE for exemple.

- REMEMBER: IN MEMORY ALL IS WRITE IN HEXA,AND REVERSE.  EX : 1568 decimal = 620 hexa and write in   memory : 20 06 .

- MAP OF THE MEMORY :

                                                            Ms-dos compatibility      0x00000000  to 0x003FFFFF.

                                                            Win32:                               0x00400000  to 0x7FFFFFFF.

                                                            DOS,Win16:                      0x80000000  to 0xBFFFFFFF.

                                                            system of exploitation :   0xC0000000 to 0xFFFFFFFF.

- A PROGRAM CAN HAVE MORE 1 ADDRESS FOR AN VALUE.

- DON’T ASK ME FOR SOURCES.

- IF YOU USE THE AUTO END ADDRESS.OPEN THE TRAINER ON THE GAME JUST BEFORE START AN SEARCH.


EDITOR HEXA/ASCII

<<<<<<  : back  -0x10

button between <<<<< and >>>>> : refresh or display at : the address in the edit field.

>>>>>> : forward   +0x10

you can call the editor from : search ascii/hexa chain (double click on the line to edit)

                                                         analysis (double click on the line to edit)


CALCULATOR

DEC/HEX : CTRL


API CALL CATCHER(win95 games only)

THIS MODULE IS NOT FINISH AND IN HEAVY CONSTRUCTION

linked library are only for program linked with mcf42.dll


FILE EDITOR

Goto

Find


GOTO (go to an address)

Choice between hexa or decimal, enter the address to display and press GO


FIND (ascii,hexa,decimal)

HEXA:

Just enter the chain to search (pair)

ASCII:

Enter the chain to search and choice between:

                                                      Not case sensitive:  ABC  = abc

       Case sensitive      :  ABC different of abc

  	       Not Unicode:  ABC

       Unicode       :  A.B.C

DECIMAL:

enter the number to search  :

        1 byte  = 0 - 255 (hexa: 0 - FF)

        2 bytes = 0 - 65535 (hexa 0 - FF)

                                4 bytes = 0 - 4294967295 (hexa 0 - FFFFFFFF)


PATCH MAKER

You can enter max 197 lines and 4k of hexa chains

BUTTONS:

-ADD : add an line : offset + chain to write (hexa).

-DELETE : choice the line to delete and press this button.

-EDIT  : choice the line to edit and press this button.

-LOAD : load an mpc file.

-SAVE : save an mpc file.

-ERASE : delete all line.

-WRITE : write all line in the file to patch.

STEP FOR MADE A PATCH:

-Have more 0 line.

-Choice the file to patch with the open button.

-Choice the exe name of your patch.

-In the edit zone at the top ,put your info.

-If you want be sure that the file to patch is the same your,click checksum.

-Finally press the build button, You will found your  patch  in the same directory of  MAGIC TRAINER CREATOR.

IMPORTANT:

-The length of a name under dos are max : 8 and must don’t have space so if this name is more 8 and have space : a patch for win95 is made.


MAGIC EDITOR

You can enter max 197 lines

press the build button for create a magic editor

-Choice the type of magic editor (file or memory).

-Enter the window name of your editor.

-Enter the name of the exe.

-Enter your info in the edit zone at the top.

-Choice the mec file.

-Choice an gtc file (optional,you can write this file with the skull button in the magic editor)

-Finally press the build button, You will found your editor in the same directory of  MAGIC TRAINER CREATOR.

* if  always updated is check: the magic editor refresh always the values , if not : magic editor refresh them only when it ‘s at the foreground.


INFO


-description

-offset

-type of value


-offset

-chain (hexa)