Cheat Engine

samuri25404 · Posted: Sun Nov 02, 2008 4:07 pm Post subject: [CE] Static Addresses?

How does CE determine whether or not an address is static or not, without restarting the app to check if the address is still the same?

Just a bit of curiosity on my part.

DoomsDay · Posted: Sun Nov 02, 2008 5:43 pm Post subject:

"Static" addresses' ranges are defined by the PE header, the rest is allocated dynamicly(with certtein exceptions). I can only assume that CE relies on that information.

nog_lorp · Posted: Sun Nov 02, 2008 11:21 pm Post subject:

#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 // Section contains initialized data.
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 // Section contains uninitialized data.

One of these flags in being present in the section characteristics field could be used to determine this.

Dark Byte · Posted: Mon Nov 03, 2008 7:34 am Post subject:

or if you're lazy you can just enumerate the modulelist of the running process with toolhelp32 and get the size of each module. (in the same structure defining the module)

And only reload the modulelist when attaching to a new process, or when a module a address requested couldn't get found. (module base addresses usually do not change at runtime)