Search the memory for pointer to that base. 
Dissect the memory around this to recognize array or linked list. Find the base (the beginning of the record). This eliminates some of the Cons.įirst Find the address you are looking for. You can search for references to the list itself and get a better way to automatically find the entities on each program restart. A lot of RE.įor at-least some of the methods I mentioned finding the pointers to all entities while analyzing the program might only be the first step. If there're any pointers involved, follow them and reverse other structures you encounter. Using Cheat Engine and IDA, manually map the structure, the elements/members, the functions that manipulate the structure. This one requires a bit more reversing work, but will let you find the best ways to search for the entities. usually harder to do (Get a good dis-assembler) better understanding of how entities are saved in memory. If we're talking about OO code, finding the virtual function table or a similar construct will let you easily find the construction functions, walk trough inheritance and find at least a portion of the manipulating functions.Īfter you get the Constructors you can easily get all the allocations, and see where pointers are being kept. usually it's easy to find - the first function called after the object is allocated, pretty distinctive assembly - mostly initialization code. you will still need to somehow find the first entities.įinding the Constructor/constructor-like functionĮither Object Oriented language like C++ or ObjC, or a procedural language like C, there must be a function that initiates the structure. will be a bit more robust than the previous method. you could also walk trough arrays you find in the structures themselves, you might be looking at a linked list. you can just as easily search the memory for the addresses of the structures you found, and detect the array/structure that holds all of the entities. There might be a pointer to each entity somewhere. stuff might change between versions, data you think is constant may actually change in some cases you haven't looked at. in the general case it should survive program restarts, you won't need to find the three structures every time you run the game. 
This is easy to implement, can be done this Cheat Engine. Some values may be constant, represent properties that apply to all the enemy entities in a more high-level class inherited. Once you have a few examples of the structures, maybe the easiest way to find the other structure instances is to find matching constants in all three structures. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex)įew ways to find the other structures come to mind: Scanning memory for signatures Looks like he assumes they aren't complex. (OP didn't specify if he knows how structures are laid out. 
Ultimately my question is, is there a way to detect a pointer array in memory from one of its addresses, for example if if I have 3 enemy coordinates can I somehow trace the memory location back to an address that accesses all 32 enemy addresses whether it is by using cheat engine or another reversing tool.
#Cheat engine mac invalid cheat table software#
I have been able to collect 3 different enemy addresses, this information is useful but searching through 32 addresses is a task which requires more effort than I believe is necessary.Īs stated I have access to the first 3 enemy addresses and if from that information it is possible to trace back to the base either through Cheat Engine or other reverse engineering software the process would be appreciated. My Objective is to find an address or a pattern that will allow me to loop through up to 32 enemies in order to read all their coordinates, in order to do this I have been attempting to find a pattern between each of their addresses with no luck. I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
0 kommentar(er)
