Cheat Engine

[Felheart]

Hi again

I'm, reversing a game and "Memory Dissect" is a huge help.
But can you add a option so the "guess offset types" will only generate a list of ALIGNED offsets?

I know for sure the game aligns all of its variables on 0,4,8,C
and it's so much work to go trough the list fix it up.

And why does CE sometimes guess that something is a pointer, even though it doesn't reference anything?

And how do I resize the struct, without recreating it completely?
Sometimes the struct is to big and it takes ages to remove 2000 unneded entries with DEL + ENTER

[Dark Byte]

guess offsettypes does guess based on alignment. If the address is 12345677 it will guess it's a byte instead of a dword, causing the next guess to be on 12345678 which is aligned and thus a 4 byte type (except when the value is too big for human interpretation which then gets handled as either a pointer, or split up into 4 bytes)


A pointer is a pointer if it points to a block of memory, even if it is filled with 0. If it points to a memory location that is not correct then check the time you did the autoguess because back then it had to point to valid memory (else it would have picked the dword type)

Deleting multiple lines will be in next version

[Felheart]

ok, so it processes the start, then advances, based on what it guesses the previous typesize was.
But in the game I'm hacking I know that every datatype-address ends on 0,4,8 or C. Even strings only start at addresses which are a multiple of 4 and strings are also always the size of a multiple of 4.
So that means I know there aren't any strings of the length, 2,3 or FF.
Which in turn means there can't be any "alignment breaks" because of strings.

I mean I'm absolutely sure I won't miss any data when I only search every 4 bytes with datatsizes of 4 or multiples of 4

Maybe you could make it an option that is disabled by default.
There are quite a few structs in the game which aren't arrays but are very big (sizes of over 3000). And it's a pain to go trough the whole struct, checking if every offset ends with 0,4,8,C


As for the pointing to a memory block, thanks for clearing that up.
I already thought it would be someting like this.



edit:
by the way I have a bug to report.
go to memory dissect, set the update intervall to ~10ms. The next modal dialog box won't react to anything (OK, Cancel, ...)
So you cant change the intervall again, or add, change or delete offsets.
I could reproduce this on 2 computers, both running windows7 x64, and x64 version of ce


edit2:
and a second little bug:
open more than one memory dissect windows.
create one definition in the fist window and one in the second window.
delete the second definition in the second window.
now the first window won't show anything anymore, it seems you'll have to reopen the window.

[Felheart]

Ok, forget about the additional feature if you dont want it

But could you please fix these two bugs?

Fist one:
The auto guess is broken for me. I don't know why. It worked as supposed for a long time, but now it's "guessing" everything as pointer to 4bytes

The other bug is the "refresh bug".
Memory dissect -> View -> Update Intervall.
Set it to a number lower than 50 ms and CE freezes on the next modal dialog that pops up. (for example if you want to add or change an element in the memory dissect window, the window freezes)

It could be that those errors are just on my pc. I have not tried to reproduce them on another machine. But on my computer it's broken all the time.

How can I at least fix the screwed up guessing ?? It worked until a few days ago (same pc, same target app)