Cheat Engine

fendrien · How do I cheat? Reputation: 0 Joined: 17 Mar 2014 Posts: 5

Perhaps one of you could help me better under stand the allocation of memory of a listbox and the subsequent placement of listitems.

When I examine memory for a list of items, I would expect some logical allocation of these items in memory (similar spacing or design). However, when I find an item in memory there are a few of them next to each other and then application function names. Then maybe a bit lower I find another block of listitems, not the same number together as the first and without function names.

They appear like ID12=item12|param1|param2|param3&ID22=item22|param1|param2|param3 drawFunctionofSomeKind ...

These params can vary in size as the item parameters are string of varying size which makes it harder to figure this out. I would imagine they have a max allocaion of space for that variable, but strings seem dynamic in nature.

No matter how I try to analyze the structure, I can't figure out why they appear in what appears to be an illogical format. I suppose because the listbox is dynamic in nature, there must be pointers from item1 to item2 and that they don't need to be next to each other. Can anyone explain how this works?

Also, do you have any advice on mapping this listbox using the data structure analysis tool user the "tools" section of browse memory?

Dark Byte · Posted: Fri Mar 21, 2014 4:18 pm Post subject:

compile python with debugging symbols, and then debug python while it's accessing those items to see how it does that

fendrien · How do I cheat? Reputation: 0 Joined: 17 Mar 2014 Posts: 5

Thanks DarkByte, I appreciate all the hard work you do. I don't have the source so this won't work for me. I am over 100 hours on this thing so I may just give up. Assembly is apparently not for everyone lol.

fendrien · How do I cheat? Reputation: 0 Joined: 17 Mar 2014 Posts: 5

Well, I am not one to give up so I will do my best to explain what I did. It is a bit foggy but perhaps this may help someone.

I found a static listitem and used dissect data structure. From there I examined it and noticed one of the auto-generated pointer that contained a changing value. I followed that to its base and then examined the structure there. I noticed more list items in the general area and found the structure I had thought existed.

There was a string value and a pointer to the next item in the list. I played around and found the entry point and exit point. From there I simply wrote code to traverse from the starting list item to the last.

Hope that helps.