Cheat Engine

[chris17585]

Hey guys... I have been trying to get my head round this for sometime. I have seen it done in a few tables, but can't seem to replicate it for myself. I have seen tables that assign the base pointer to a created address eg :-

alloc(newmem,2048)
label(store)
label(pointer)
label(returnhere)
label(originalcode)
label(exit)

registersymbol(pointer)

newmem:
pointer:
dd 0

store:
mov [pointer],esi

originalcode:
mov eax,[esi]
mov ecx,[ebp-14]

exit:
jmp returnhere

This was a reverse of the backpack space used option on technojackers borderlands the pre sequel table (hope I'm not upsetting anyone by posting this). I get that the base address is copied from esi to the created [pointer] address, and I COPIED the option successfully. What I don't get is how he even got to that memory address that contains the bass address in a register. I tried manually pointing and looking out for the base address in the registers as I go, but that didn't work. If someone could explain were I am going wrong, I would be very grateful.

Thanks

Chris

[Dark Byte]

Just find out what accesses anything in the structure you're interested in(It doesn't have to be the address you're looking for). You will find some code that accesses it exclusively (e.g gui updates)

tip: Use page exception, then go to memoryview, highlight all the bytes of the structure and then do a data breakpoint->find what accesses on them all.
it will be slow, but it'll find all accesses to every single entry in the block you've selected. (page exceptions have no size limit like debug registers do)

[chris17585]

Sorry Dark Byte, I'm not sure I'm understanding you correctly. It sounds like you want me to reverse the function I'm interested in using memview. After setting the debugger on page exception. Should I then be looking for the base address as I slowly go through. I will have already pointed to them and have the address... it's just finding a code that lets me assign it to an address.

Thanks again for the help

Chris

[Dark Byte]

First you find the address you're interested in.
Then find what accesses it to get a general idea of the structure size and structure start
then use a access breakpoint on the memory the structure is in
The results you get are codes that have the base address in a register

From that list find one that only accesses the structure you're interested in (use normal debugreg breakpoints for that)

[chris17585]

Ok I think I understand you now, thanks for the help.

Chris