Cheat Engine

[cooleko]

I'm not certain what I'm looking for because I am outside of my comfort zone on how to accomplish my goal.

My Goal: Find a structure A that holds or points to all of the structures B I want to access.

My Haves: an instruction that accesses all of the structures B I want to access

My Needs: Find how the game increments through the unknown Goal structure A to provide my known function having the instruction with address to the structures B I want to acccess.

To this end, I have break and traced the instruction to find where the function X returns (just a mere 5 lines below) and where the function Y that calls this function X returns (another 30 lines). I stepped up one line after second return to see the function Y that calls my function X in its entirety (reproduced below). In the hopes that I may see how the address that gets used by my instruction is set.

Unfortunately, after about an hour of just breaking and tracing function Y randomly, I have yet to get a trace that actually calls function X, instead, it seems to always jump over it.

Frustrated, but not deterred, I scrolled through the trace and found where the function Y jumps over function X, went one line past the jump and break and traced from there. This also jumped over function X. I rinsed and repeated this until I essentially have to break and trace only my function call because the jumps happen too frequently for my random luck. This means I don't get a live walk through of how the address is populated.

My bright idea, I need to break and trace the function that calls my function and only save the trace if EIP reaches the address of my instruction. OR perform the same procedure on a further parent function until it is shown. However, I don't see how this is possible using the tools available to me in CE.

Any suggestions on how to proceed? Should I learn a new technique? Try looking at the code without the trace?

I recognize that I could use CE to store the base address of the structures using the AOB template, but I want to solve this rather than cheat out the end result.

Essentially I have a function that gets called 1000s of times a second. The function that calls my function gets called 100000s of times a second and I want a trace where it does call my instruction so I can see what the trace tells me (if anything) about where the game is getting the addresses from.

Function that calls my function: (my Function is called at 1404635E2)

[ParkourPenguin]

I'd try looking at the code first.

[cooleko]

I continued scanning through each function call, one by one, ended up in the parent's parent and found where the structure is. Thanks for telling me to just do it the hard way. No secrets needed, just a little elbow grease.