Cheat Engine

[sdecorme]

HI,
I have a software that I would like to snif some data .
In the main directory I've found a .pdb file and I've decompiled it.
I've found this

Function : static, [00475E50][0001:00474E50], len = 0000013A, public: virtual bool __thiscall DynamicObjectsProcessor::ExtractState(class NET::BitStream &)
Function attribute:
Function info:
FuncDebugStart : static, [00475E5C][0001:00474E5C]
FuncDebugEnd : static, [00475F81][0001:00474F81]
Data : enregistered ecx, Object Ptr, Type: class DynamicObjectsProcessor * const, this
Data : ebp Relative, [00000008], Param, Type: class NET::BitStream &, o_stream
Data : esp Relative, [FFFFFFC3], Local, Type: bool, objectRecorded
Data : esp Relative, [FFFFFFC4], Local, Type: const unsigned int *, it
Data : esp Relative, [FFFFFFC8], Local, Type: unsigned int, instanceIndex
Data : esp Relative, [FFFFFFD8], Local, Type: class GEM::GVector3, CameraAngle
CallSite : [0x0001:0x00474ef3] 0x00475EF3 void (class GEM::GVector3 &, class GEM::Position &)


And Would like to know how can I use cheatengine to track this data :
CameraAngle & Position .


Thanks you

[Dark Byte]

These are local vars so first need to be initialized by the function first.
Try setting a breakpoint at process.exe+00475EF3 and inspect the stack there. (Also look at the assemblercode there)

[sdecorme]

Hi,
How can I set a breakpoint at this address if the game is not launched ?
I suppose I've to launch CE and after the game and I make a pause to search the good address.
Is it the good way ?
Thanks



Happy birthday Dark Byte

[sdecorme]

Hi back again with mytracking data, as you tell me I've open the memory viewer with the info I've found in the .pdb

[Dark Byte]

I think your pdb is outdated or wrong (check that the filedate of camprocess.exe and the specific .pdb file are exactly the same)


Anyhow, I think the offsets are off by 1d0 or 310, so check
CamProcess.exe+00475c80 ( CamProcess.exe+00475E50-310 )
and
CamProcess.exe+00475b40 ( CamProcess.exe+00475E50-310 )

or scroll up till you see a "int 3"

here's a tip, keep in mind that this functions makes use of esp relative addressing, and PUSH modifies esp

so

[sdecorme]

what is the filedata ?

[Dark Byte]

filedate

[sdecorme]

Ok,
You're right not the same modified date
I will try to track my data with pointer scan , now I know the structure is will be more easy.
Thanks you