| View previous topic :: View next topic |
| Author |
Message |
xedc How do I cheat?
Reputation: 0
Joined: 06 Feb 2022 Posts: 4
|
Posted: Sun Feb 06, 2022 7:10 am Post subject: Pointerscan yields only THREADSTACKs |
|
|
I am new to cheat engine and I am trying to read the memory of a game to make an AI.
When scanning for the pointer of the player position, the only results I get are from THREADSTACKs and not from the game process. I tried this multiple times and even with the max level on 12, but the results weren't different.
Is there some other settings I can tweak to make it work? Or is there a way for me to consistently use THREADSTACKs for my purposes?
Any help will be appreciated.
|
|
| Back to top |
|
 |
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4725
|
Posted: Sun Feb 06, 2022 12:31 pm Post subject: |
|
|
Objects near the beginning of the stack of the first few threads are usually consistent. It's not uncommon to store some global game state in the stack when the game first starts.
How you can find threadstack addresses yourself:
https://forum.cheatengine.org/viewtopic.php?p=5487976#5487976
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
 |
xedc How do I cheat?
Reputation: 0
Joined: 06 Feb 2022 Posts: 4
|
Posted: Sun Feb 06, 2022 5:27 pm Post subject: |
|
|
Thank you for your reply!
So, I've been playing with threadstacks all day and I still don't quite get them.
First of all, how do I get the base address of the threadstack? CE says the pointer is in "THREADSTACK0"-0000089C, and if I open memory view and use the "Goto address" function looking for "threadstack0", it leads me to the address 0x8FFD10. So if I add 0x89C to this address would that be the base address?
Also, I don't understand what is stored at the address 0x8FFD10, I was expecting to see the value 0x03F3B204 since this is the actual memory address of the player position, so I figured the pointer would be pointing to this address, but turns out the actual value stored at 0x8FFD10 is 0x10FA5E76 and I really have no idea what this is supposed to mean. I also tried 0x8FFD10 plus and minus 0x89C, but they also have seemingly random values.
(Also, sorry if those are dumb questions that shouldn't be asked here, but I was searching and experimenting the whole day and couldn't figure this out)
| Description: |
|
| Filesize: |
17.71 KB |
| Viewed: |
3557 Time(s) |

|
| Description: |
|
| Filesize: |
3.39 KB |
| Viewed: |
3557 Time(s) |

|
|
|
| Back to top |
|
 |
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4725
|
Posted: Sun Feb 06, 2022 8:43 pm Post subject: |
|
|
| xedc wrote: | | First of all, how do I get the base address of the threadstack? | See the link in my previous post.
| xedc wrote: | | CE says the pointer is in "THREADSTACK0"-0000089C, and if I open memory view and use the "Goto address" function looking for "threadstack0", it leads me to the address 0x8FFD10. So if I add 0x89C to this address would that be the base address? | That address is "THREADSTACK0"-0000089C - emphasis on the minus sign. You need to subtract 0x89C from the base of the first thread's stack to get to the base address.
This makes sense given stacks grow downwards. i.e. push subtracts from esp/rsp, and pop adds to esp/rsp
| xedc wrote: | | Also, I don't understand what is stored at the address 0x8FFD10, I was expecting to see the value 0x03F3B204 since this is the actual memory address of the player position, so I figured the pointer would be pointing to this address, but turns out the actual value stored at 0x8FFD10 is 0x10FA5E76 and I really have no idea what this is supposed to mean. I also tried 0x8FFD10 plus and minus 0x89C, but they also have seemingly random values. | 0x8FFD10 is THREADSTACK0. It isn't your base address- it's not important. I'd guess 0x10FA5E76 is the reference to ExitThread as mentioned in the linked post.
The base address, "THREADSTACK0"-0000089C, is only the first node in the pointer path to your value. You need to go through 5 other nodes before you can get to the address of your value.
See this old topic for how pointer paths work:
https://forum.cheatengine.org/viewtopic.php?t=422516
(In 64-bit processes, pointers are 8 bytes, not 4)
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
 |
xedc How do I cheat?
Reputation: 0
Joined: 06 Feb 2022 Posts: 4
|
Posted: Thu Feb 17, 2022 9:11 am Post subject: |
|
|
Thank you so much for your help!
Now I am able to get the values I need with a script. I gave up on trying to get the address of threadstack0 though, because for my purposes it's good enough to find it with cheat engine and manually insert it in my code.
|
|
| Back to top |
|
 |
|