Cheat Engine

Erik9631 · Newbie cheater Reputation: 0 Joined: 24 Aug 2014 Posts: 10

Hello guys.

I have been trying different methods of finding memory offsets for quite a while unsuccessfully and now I decided to write here hoping to find more experienced people that are willing to point me in the right direction.

To clarify what I want. I am not looking for magical pointer scanning, or looking for values that change and backtracking where they take you, or some general do this to get that guides. I have read millions of those and I hate them, because you can not learn from it. I do not want to see just a blackbox that does something and you work with data going in and out.

This post is more oriented towards reverse engineering rather than cheat engine or using cheat engine in general.
What I am looking for is understanding how virtual memory address space in general is assigned and how to look for the things I want.

I will start with a simple example of the problem I am facing.
I created two simple applications in C++. One is called TestApp.exe and the other is called MemoryEditor.exe
TestApp.exe is a simple application with an entry point (void main) which allocates two variables to the stack (Specifically two integers) with addresses 0x012BD1F8 and 0x012BD1FC.
The offset from the first one to the second one is 4 bytes which makes sense since they are allocated in a succession.
We can also easily get the address of the .exe module which is at the address 0x00250000 (Got it using process enumeration and converting pid to handle and enumerating modules).

My first question is, why do the offsets from the base to the variables always change? They are different each time I launch the application. The module address stays the same which is not important (as it can change after system reboot). Why do they change if the structure of the program remains the same?

And this is the point where I am stuck. Since I can not figure out, nor find any general information how the memory is allocated and I am unable to find any logical pattern.
I tried different ways to get my way around which includes reading the frame pointer from the registers and scanning the stack, but it never got me anywhere reasonable.

Reverse engineering is a huge field and I would like to know which parts of it should I master, or be aware of in order to be able to fluently understand how these things work in the background.
If my question is too general to answer, I am okay with that, just point me in the right direction and I will be on my way, although I would also appreciate if someone answered the specified problem.

Thank you.

OldCheatEngineUser · Jul 26, 2020

ParkourPenguin · Posted: Wed Aug 01, 2018 8:47 am Post subject:

Probably ASLR. The OS can put the threadstack and/or the executable at a different address every time the application is run.

Get a handle to the main thread and look at the TEB for stack boundaries (search NtQueryInformationThread). The objects' offsets from the start of the stack probably won't change.

Alternatively, code injection is always an option.

Erik9631 · Newbie cheater Reputation: 0 Joined: 24 Aug 2014 Posts: 10

ParkourPenguin · Posted: Wed Aug 01, 2018 9:17 am Post subject:

Use Google.
NtQueryInformationThread
TEB aka TIB
StackOverflow example