Cheat Engine

Phenax · Newbie cheater Reputation: 0 Joined: 29 Mar 2009 Posts: 16

I've got a line of assembly that modifies five memory addresses. One of those five memory addresses is of interest to me; however, I can't really differentiate when it's modifying that particular one.

The memory address that is modified is stored in a register.

All of the registers besides the one used to store the actual memory address are the same every time I set a breakpoint. So I've set a break and looked at the first entry on the stack trace (set to non-system modules only) to see where it's coming from. It comes from the same place, with the same registers.

I'm kind of at a loss on how to continue, any tips would be appreciated. Ideally, I'd like the break + trace to be able and give me a trace of 1000 instructions backwards but I don't think that's a feature in CE. I've tried manually tracing it backwards using the stack and break conditions but after ~10 hours and getting nowhere I'm kind of at my wits' end.

The game is programmed primarily in Java and I'm using the VEH debugger (default crashes the program), if that's of any interest.

Dark Byte · Posted: Tue May 22, 2012 8:54 am Post subject:

java is an emulator, the same code tends to be used for everything else

Is there anything in the stack to differentiate between the address you need and the one that is going to be changed?
Is there a pointer(path) in there somewhere that points to a block specific only to that variable you're looking for? (e.g varname)

You could try rightclicking the stackview and do a dissect structure with that stacksnapshot locked
Or do a structure spider for a string with that stackcopy

Phenax · Newbie cheater Reputation: 0 Joined: 29 Mar 2009 Posts: 16

Hi Dark Byte, thanks for the reply.

Honestly, the stack doesn't really contain much to help. It's huge, and I've went through *a lot* of the pointers. Looked for any strings of use, etc. I guess since it's Java, the code is mutilated beyond reverse engineering in a sane amount of time (for me, anyway). I suppose I'll try a more Java-centric approach instead of memory editing and assembly viewing. I know in the end, it's definitely possible to differentiate and identify the different locations, but it seems like a huge pain.