Cheat Engine

[bartek_s2]

When in memory view, after dissecting the code, I got it to show addresses like "SFLB_1_MechForceFeedback_Initialise+56B", but after restarting the game (with many restarts) I haven't been able to get the same result ever since, and I don't remember how I did that.

I know the information is there available to cheat engine, as can be seen in attached screenshot.

(also, yes, this is windows XP. In VirtualBox.)

[Dark Byte]

view->show symbols

[bartek_s2]

It is already enabled. All except userdefined sumbols.

[OldCheatEngineUser]

if its a mono game and mono features enabled, then you will see mono symbols otherwise not.

also you might be looking in module address region and not the on-fly compiled byte-code, maybe your current process is not mono.

[bartek_s2]

When I tried to use CheatEngine on this exact game for the first time yesterday, this exact code in the screenshot (exactly the same address) had it's name shown as I said initially, but I'm unable to make it happen again.

I'm pretty sure the game does NOT use mono/.NET/C#, it's this is a game from around 2005 9Colin McRae Rally 2005), so that doesn't really apply.

[OldCheatEngineUser]

ehm, then its microsoft symbols. (probably)

[bartek_s2]

I was able to re-create this effect, but I don't know why it works.

Starting fresh, in memory view, using "view->referenced functions" and agreeing to do "code dissect" did the right thing.

Any idea why just "code dissect" doesn't do it?

[OldCheatEngineUser]

dissect code:
locate and analyze every jmp/jcc and call to any address in memory.

ref' functions:
how many call instruction calls that function by count.

[bartek_s2]

My question is, why "dissect code" results in what I show on the first screenshot, while after "referenced functions" it shows what I see in the attached one?