Cheat Engine

[AJMansfield]

How can I trigger Branch Mapper to start from a Lua script?

Background: I'm currently developing cheats for a game that seems to perform a sort of 'normalization' each time it loads saves from disk, that wipes away some types of previously-cheated progress and makes everything more complicated. There's a lot of other things that it also does during save load, though, and trying to locate this specific normalization routine in order to bypass it is as yet an unsolved problem.

I can't trigger Branch Mapper before I start the save load, as the single-stepping causes the UI to chug to the point that I'm then literally unable to even click the 'load' button, but the load process itself is so fast on modern hardware that it's impossible for me to trigger Branch Mapper on a normal save file.

I've managed to get a bit of success by synthesizing a save files that includes a bunch of extra junk data in 'comment' directives to slow down the save load process, hitting 'load', starting Branch Mapper, and then letting it run overnight. I messed up the DLL load order that time, though, and a save with this junk data is always going to trigger this normalizer, so I can't map out the alternative path that bypasses this normalizer using this approach.

Therefore, I want to trigger Branch Mapper to start directly from a lua-scripted breakpoint directly at the underlying windows API call that opens the save file for reading.

So far, I've managed to cobble together a function for setting a single-shot breakpoint when opening a particular named file. However, I'm at a loss for how to actually trigger Branch Mapper to start mapping branches from this breakpoint:

[Dark Byte]

hmm, not very easily, but theoretically it's possible.

There's no build in lua code that does this automatically for you, but you 'could' execute the GUI controls that lead to the branch mapper dialog, parse the threadlist for the thread you're interested in, uncheck all other checkboxes, and execute the OnClick code of the start button. (requires form create notifications and timers)

but yeah, it's not really a neat solution and you'd first have to resume the current breakpoint before it'd work. So you'll end up placing an infinite loop at your breakpoint location (eb fe), start a timer that does all this above, resume from the current breakpoint, and let the timer run, in which, after the branch mapper has started, you restore the original code so it the thread you broke on continues without interfering with the debugger.

And one more annoying thing, because why not, the infinite loop you first placed will be stored in the branch mapper results, so you'll have to remove that one entry. (maybe lua command 'pause/unpause' might work instead of a infinite loop)

[AJMansfield]