Cheat Engine

[Cren]

Hi all, this is my first post on this forum thus I hope this is the right place where asking for help.

I've completed Cheat Engine 6.4 Tutorial and I'm trying my first experiment to retrieve static memory address of a value inside a true game running on my PC.

I properly get value address, but it's not green - this means it's not static and it will likely change after game restart; therefore, I'm going to use the technique explained in tutorial which is: get pointers to pointers to pointers... until you find a static address.

Problem is "More information" shows a code like this one:
>>00722C8A - mov [esi+ecx*4+00000FB4],eax

I know which values esi and ecx have, but I don't know how to deal with such an expression when making a pointer: is there any tutorial which explains how to deal with expressions? Could you tell me how to create pointers with expressions and/or if there are better and faster solutions to retrieve static addresses?

Thanks,

[Zanzer]

Right-click the address and select Pointer scan for this address. That's probably the simplest way.
http://forum.cheatengine.org/viewtopic.php?t=572465

As for your found instruction, ESI is the base of the structure.
+FB4 is the offset to a fixed-size array of similar types, most likely 4-byte integers.
ECX*4 is pointing to the specific item in that fixed-size array.

So when ECX is 0, it adds +0 to the already +FB4 offset, giving you the first item in the array.
When ECX is 1, it adds +4 (1*4) to +FB4, giving +FB8.
When ECX is 2, it adds +8 (2*4) to +FB4, giving +FBC.
etc.

So for you, you would want to do a value search for the same value held in ESI to find the previous pointer.

[Cren]

As for results obtained via pointer scan, how am I supposed to handle with Base Address retrieved?

As instance, let my pointer scan finds that the address I'm looking for is:

[Zanzer]

What are you trying to do with it that you need to handle?
Double click the address and Cheat Engine adds it to your table.

[Cren]

[Zanzer]

That is the base address. That's how it works.
When the game loads, it loads in a different memory region each time.
However, the static address is always 6DB754 bytes away from the base.
Foo.exe is the base that changes upon each load.
Cheat Engine finds the memory address of the base and then moves 6DB754 bytes to the right.
That's where it finds your base address to use as a pointer.

[Cren]

[Zanzer]

http://forum.cheatengine.org/viewtopic.php?p=5240405#5240405

[Cren]

You're pretty chatty, uh?

From your link I see an interesting C++ function; please, let me know if I properly understand its purpose: by passing PID and process' name, it should return a DWORD_PTR (which is just a typedef for unsigned __int3264, right?).

Does that mean that I can compile that function in an executable with its main and use a simple std::cout to print the information I seek in runtime window? And use that address as I've done before with 20DDDB54?

Thanks for your help, anyway!

[Zanzer]

http://forum.cheatengine.org/viewtopic.php?t=422516

The value of ModuleEntry32.modBaseAddr will be the base address of "game.exe".
Add to that address the offset value of 6DB754.
Now use ReadProcessMemory on the address.
This will return another address value. To this value, add 1C, as shown in your screenshot.
Then ReadProcessMemory at this new address. To that value, add the next offset of 0.
Continue this step until you reach your final offset of FB4.
The final address after you add FB4 will be the 20DDDB54 address in your screenshot.

[Cren]

[Zanzer]

[Cren]