Cheat Engine

Leonidas · Posted: Mon Sep 19, 2005 1:46 am Post subject: pointer/structure scanner method

Just something I thought about, just posting here so I don't forget it

Leonidas · Posted: Wed Sep 21, 2005 3:23 am Post subject:

Add following presets:

crazy scan: all [xxxx] addresses in executable code 512 byte structure default, estimated time: few hours
psychotic scan: all values that represent a readable address in executable code, estimated time: a day
psychotic and retarded scan: all values that represent a readable address, don't care about allignment, estimated time: several days

insane psychotic and retarded scan: same as above but with structsize of 1024 or higher, estimated time: couple of years and requires a 128bit memory management, and couple of TB harddisk

Dark Byte · Posted: Sun Sep 25, 2005 1:05 pm Post subject:

usefull as last resort:

Turtle · Posted: Mon Oct 17, 2005 12:31 am Post subject:

Interesting.

Dark Byte · Posted: Mon Oct 17, 2005 10:53 am Post subject:

It certainly is, but keep in mind that it's almost the same as brute forcing a password. The more levels, and bigger structures, the longer it'll take

Dark Byte · Posted: Fri Oct 21, 2005 4:18 pm Post subject:

Actually, I managed to get a decent speed increase by making use of dual threading (I got a dual core cpu) and deciding to give a fuck about memory

Dark Byte · Posted: Fri Oct 21, 2005 5:10 pm Post subject:

Update: I managed to scan dungeon siege 2 in less than 30 minutes, and found the mana pointer for the the 4th character and the currently selected character (including monsters)

(level 5 pointers, structsize 512, base level size 4)

Turtle · Posted: Fri Oct 28, 2005 5:57 pm Post subject:

How much of a difference do dual cores make?

Also what do you think of the static pointer searcher in L.Spiro's program

It's one of the search options, and there is a tickbox to only find static pointers. Why does his do a direct search based on a given address or range of addresses, but yours does a full scan? Just wondering.

Are some static pointers more reliable than others?

Dark Byte · Posted: Fri Oct 28, 2005 6:24 pm Post subject:

pointers found by looking at the code instead of the data (and determining if it is accessible or not) returns less wrong addresses.

e.g the text 'this door goes to hell' may contains some addresses that point to accessible memory, while the static scanner only looks at code like 'mov esi,[00900000]' and then records 00900000 as a possible pointer

but for the pointer scanner you'll have both methods to choose from, it's just that with the method of scanning through the data instead of code you'll get a lot of extra wrong results, and that is especially a problem when you're applying it to base pointers.

e.g with a structsize of 512 disection of a base pointer would require in the worst case scenario 34359738368 compares(512/4=128 possible pointers in each structure, 128*128*128*128*128) if it is a pointer and if it points to the right address. (of course by filtering out duplicates and non pointers you can bring this down a lot)
and each wrong base pointer would result in a big time loss