Cheat Engine

[BenInSweden]

So a bit of background.
I have written a LiveSplit Autosplitter, that handles multiple Sega Genesis/Mega Drive and Master System games, in multiple emulators.

It is designed in such a way that games or emulators can be easily added, as the emulator portion of the code essentially finds the start of the Genesis/SMS memory, and then the code for the games just use the offsets from there to find the right values for splitting.

This works fine for the 5 emulators currently supported - Fusion, Retroarch (both 32 bit and 64 bit), the two emulators used in the Steam "SEGA Mega Drive & Genesis Classics" release, along with Gens (which can be used to test the autosplitter using Tool Assisted Speedruns).

I want to add support for BizHawk, as this would allow me to more easily find and test values for splitting for any Master System games (and also be able to use some of the more recent Genesis TASes for testing).

I've extensively tried using CheatEngine to find PointerPaths to the memory in BizHawk, but either I get 0 results or THREADSTACK ones.

I was hoping that logically if I could find the byte code that accesses the memory then I should be able to hone in on the memory block used by the two emulation cores used.

SMSHawk is the core that BizHawk uses for SMS games, and it is written in C#.

it has the following portion of code:

[ParkourPenguin]

Threadstack base addresses are likely your best option if you want to avoid code injection. You probably won't find a good static base address in JIT-compiled / interpreted languages.

The code is at the very beginning of the function, so it isn't terribly hard to figure out what's going on:

[BenInSweden]

Thanks for the reply, and the asm commenting on what's going on.

I did think that Code Injection was out of the question really, however, after some further digging it appears that LiveSplit has functions to assist with Code Injection including a "WriteDetour" helper in their ProcessExtensions.cs source file (which I can't link to currently).


So I'm thinking that's probably the easiest route here, with something like the following?

[ParkourPenguin]

If you already have code to do all that for you, it's not terribly difficult. You need to find an AoB pattern, allocate memory, possibly change memory protection, and write bytes to the game. I don't know what writeDetour does, but I wouldn't trust it especially since this is a 64-bit process and jumps outside a +-2GiB displacement can be tricky.

You can use CE to see how the bytes would look:

[BenInSweden]

Awesome ParkourPenguin,

Thanks so much for the help, wouldn't have been able to work it out without your guidance.
It was a struggle with getting it working in the C# code for a while, but here is essentially the working code I have now after injection: