Cheat Engine

[SomePerson]

Hey, I'm pretty new to the memory editing world but ultimately I'm making a side program that doesn't modify any of the memory data but instead just reads it.

Every time this game is restarted, the memory location for a certain value i'm trying to lock on to moves.

(Note: Originally I used Cheat Engine to try to dissassemble the program and "catch" what wrote to it but cheat engine always crashed when I ran the "See what writes to this" command, so I instead used MemHack and it seemed to do decent enough..)

So I do a "Dissassemble when the program writes to memory address"-like exception routine and this pops out:

[EDX]+4 = 0D2B5078

Looks accurate, the value I want to read is current at the above address so it seems like the accurate pointer info.

So I do a pointer search for D2B5074, and when looking for a pointer with this value it returns 1 result. Cool. So I grab that address and monitor it's content.

Problem is, when I restart the game the pointer becomes obselete (It isn't a pointer anymore, just garbled numbers).. I'm assuming the pointer has another pointer perhaps, or something crazy like that?

Past the above I really am unsure what you can do about pointers, and since the pointer address is changing too I'm guessing there's more to this than what I can find in tutorials just yet.

Thanks for your time and I apologize if this has been addressed already..

[Dark Byte]

yes, it is a pointer to a pointer.
just treat the pointer address as a normal address and find the pointer to that address. (using find out what accesses this address is easier to use)

and about ce, make sure you are using debug registers, and not exceptions, they work better. (Unless you use windows me or earlier, which just sucks)

[SomePerson]

I'm using WinXP, I'm not entirely sure about debug registers / exceptions sadly, but I will look into that.

Update: Found that I switched the "Memory Access Exceptions" radio button at some point when trying to stop CE from crashing. So, running the test now with Debug Registers... *BELOW CRASH REPORT WAS WITH ME RUNNING MEMORY ACCESS EXCEPTIONS*


Now here's a rundown of what occured: Found my value. Did a "Watch what writes to this address" and found my first pointer.

[Dark Byte]

[SomePerson]

Ok, so I did as you said (I think?) and got all the offsets aligned so it points to the data. The pointer pointer worked fine, then I restarted game..




Now uhh, I did a "Find what Accesses" on the 015421D8 address too, before restarting the game to be sure it was the base stack. Nothing was accessing it. So I don't believe it's a triple-layered pointer stack, but for some reason I can't find the base pointer..

[Dark Byte]

it looks like it is at least a level 3 pointer. (most games have level 5 or 6 or more)
you'll have to do some code dissecting yourself at the last found assembler addresses and see how the registers get their value

or result to code injection and write some assembler code that stores the pointer in a static or registered location

[SomePerson]

Hmmm, ok thanks for all your help. Awesome program!