How to update addresses

So, TekkenBotPrime has stopped working after a patch. This is a tutorial on how to fix-it-yourself if you know how to operate basic Cheat Engine stuff.



What can CE do? It can read the RAM of a running game process to understand what’s going on. In a nutshell, say you have 4 apples in-game → scan 4, now 5 apples → scan 5 boom now we have a little number that keeps track of how many apples we have. If my explanation made no sense download CE from cheatengine.org and do the tutorial bundled within the installation (Tutorial-i386.exe), the first 3 steps should teach you enough and shouldn’t take longer than 10 minutes to complete.

The bot (usually) only needs one file to be updated after patches: memory_address.ini
With the help of CE_TekkenBot.CT we’re gonna do that. Use that Cheat Table file to see what needs to be updated and what doesn’t.

The bot needs 4 different pointer addresses to function:
- player_data_pointer_offset
- OPPONENT_NAME & OPPONENT_SIDE
- P1_Movelist (not 100% necessary)
- P2_Movelist (not 100% necessary)
With a bit of luck, the patch was small so these were the only ones we need to update.

Here is how you do a pointer scan. This is for player_data_pointer_offset (the most important one):
VIDEO TUTORIAL BY roguelike2d: https://youtu.be/wqY3A6R-gVM
TEXT TUTORIAL:
1. find any address like p1_jump_flags (explained later, this is the easiest one to find)
2. right click -> Pointer scan for this address -> OK, hopefully the pointer scan will find something
3. order the list by clicking the second to last column (this is to grab shortest offsets already used in the previous patch), copy whatever comes after "TekkenGame-Win64-Shipping.exe"+... that’s our player_data_pointer_offset
Now open CE_TekkenBot.CT, navigate to Memory view -> View -> Userdefined symbols and update it from there.

Every address in the CT has to work correctly in order for the bot to work, except for the IGNORABLE ones which are unnecessary. If we were “unlucky” and the patch was big so it changed a lot of things, we’ll also have to fix many player data related offsets, but not necessarily all. If you suspect an offset only “moved” very slightly, you can right click -> Browse this memory region to locate the new address by “naked eye”.


Now I’m going to document how of how each address is supposed to “look like” with short descriptions. Value Type is 4 Bytes unless specified otherwise. All addresses update once every 8 frames. Ignore green (static) addresses. Everything was tested with Akuma vs Akuma (unless specified otherwise), left side. Help yourself by pausing the game in order to freeze values for easier scanning (use the speedhack set to 0.00 if pausing is unavailable). ALWAYS PICK THE FIRST ADDRESS IN THE “Found” LIST.

frame_count
- increases continuously during a match
- stops when the game is paused
- resets every round and every character intro
- in arcade/treasure/VS, during "ROUND ONE FIGHT" phase, frame_count is always smaller by 1 compared to p1_move_timer

p1_move_timer
The current animation frame that is playing.
66	= briefly frozen at this number during hitstop of full charged focus attack (AP)
10	= briefly frozen at this number during hitstop of 623LP (Goshoryuken)
12	= briefly frozen at this number during hitstop of 66RPLP (the fire attack, the long pause only happens against a standing or crouching opponent)

p1_move_id
The current animation ID that is playing.
32769 	= idle/standing
32770	= fully crouching by holding down
1500	= RP
1546	= LK

p1_recovery
643	= idle
43	= RP
39	= LK

p1_hit_outcome
0	= idle
1	= P1 is in blockstun
12	= RP hitstun from the front (no counter hit)

p1_attack_type
NOTE: this is a 1 Byte Value Type address
0	= no hit/unknown
1	= Low
2	= Medium (blockable standing)
3	= Special Medium (blockable standing, blockable crouching)
4	= Special Low (blockable standing, blockable crouching, low parryable/hopkickable e.g. dickjabs)
5	= High
7	= unblockable Medium (e.g. Akuma raging demon, flying laser Devil Jin)
8	= unblockable High (Devil Jin laser, Akuma full charge focus attack)
10	= Medium Throw (e.g. universal running tackle throw)
11	= Air (e.g. Devil Jin anti-air laser, Shotgun accessory)

p1_simple_move_state
3	= idle
7	= holding down
1	= RP

p1_stun_type
0	= idle
256	= getting hit by RP
65536	= hitting with RP

p1_throw_tech
NOTE: this is a 1 Byte Value Type address
Universal/standard throws are a bit bugged and show as 1 or 2 randomly even though they can actually be broken both ways, so use character-specific ones instead
29	= idle/unbreakable throw
28	= receiving a throw that is breakable with LP (Nina 3AL)
31	= receiving a throw that is breakable with RP (Nina 3AR)
30	= receiving a throw that is breakable with AP (Nina 9AP)

p1_complex_move_state
0	= idle
12	= holding back or forward
16	= teleport (623AK or 421AK)

p1_power_crush
0	= idle
100	= (super armor) charging focus attack
75	= (hyper armor) Rage Art, full screen running tackle

p1_jump_flags
NOTE: this is a 2 Bytes Value Type address
2304	= idle
260	= neutral jump at peak height

p1_cancel_window
65536	= idle
0	= LK

p1_damage_taken
Total damage received. Enable "Attack Info" in practice mode to see this.

p1_input_attack
0	= no input
512	= LP
1024	= RP
2048	= LK
4096	= RK
8192	= RA
1563	= AP (512+1024)

p1_input_direction
(numpad notation directions)
2	= 1
4	= 2
8	= 3
16	= 4
32	= 5
64	= 6
128	= 7
256	= 8
512	= 9

p1_attack_startup
0	= idle
15	= RP or LK

p1_attack_startup_end
0	= idle
15	= LK
16	= RP

p1_char_id
Full list of character ID's can be found inside MoveInfoEnums.py

p1_movelist
Not 100% necessary, when outdated the "comm (input command)" column will show as N/A.
NOTE: this is a String Value Type address
We need to do a pointer scan for this one just like we previously did for player_data_pointer_offset, this time using 2E8 as offset.
Player 2 side needs to be searched separately.
[Mr.X]	= Akuma
[NINA]	= Nina
[BOB_SATSUMA]	= Bob

OPPONENT_NAME
Another String type and another pointer scan (with offsets 0 8 114) is needed.
Search for NOT_LOGGED_IN while in practice mode.

OPPONENT_SIDE
This one uses the same base pointer address as OPPONENT_NAME, so we don't really need to search this, just copy it from OPPONENT_NAME with offsets 0 8 70.
0	= if you, the player, picked right side
1	= if you, the player, picked left side

rollback_frame_offset
Noticed how when you search for some address, you get 8 copies? You just need to calculate the difference between two adjacent addresses in memory. For example, we just found p1_jump_flags here:

6BEEABD4-6BED0554=1A680. There we have it, in this patch the rollback offset is 1A680.

p2_data_offset
This one is used to update all the player 2 addresses at once.
Find both p1_jump_flags and p2_jump_flags, then calculate the difference between the two. For example:
p1_jump_flags = 65E50554
p2_jump_flags = 65E56DC4
6BED6DC4-6BED0554=6870. There it is.

Now that you have all the updated addresses, feed them to memory_address.ini and hopefully the bot should work again. Make sure to share the new INI and the CT files with everyone here or submit a pull request.



TL;DR
The bot needs memory_address.ini to be updated after almost every game patch. All those addresses are also contained inside CE_TekkenBot.CT, which you’re going to fix. Open a CT while it still works, memorize how correct addresses are supposed to look like, and fix them next time they break. Share the fix with everyone when you’re done.