Cheat Engine

Ralicht

I have a region where a huge selection of functions write values temporarily. From that area, they are passed on to other places. I am tracing some values back to this region where all data is temporarily stored.

I have the address that the values are written to but I can't just watch it and see what accesses/writes because there is too many. Is there any way to see what specific function is writing to the address when the value is XX?

I thought about using normal breakpoints but it seems like you have to know or have a good idea where the value is being stored to begin with.

ParkourPenguin · Posted: Wed Jan 13, 2016 10:31 am Post subject:

Conditional breakpoints.

First of all, click on "Advanced Options" in the bottom left of the main CE window and pause the process.
Then, set whatever type of breakpoint you want on whatever you want, and open up the breakpoint list (Memory View -> View -> Breakpointlist).
Right click on the breakpoint you just made and select "Set/change condition".
I'd recommend switching over to the easy mode. For most conditions, you don't need to do anything complex. Then just write a condition.
For example, if the instruction accessing your address is mov [ebx+5],eax and your address is 0876ABDC, then the condition would be EBX+5 == 0x0876ABDC.
If you want to do that by value and the instruction is writing to your address, then just use whatever's on the right side in the instruction: EAX == 777
If you want to do that by value and it's reading from your address (i.e. mov eax,[ebx+5]), then use one of the readX functions defined in main.lua: readInteger(EBX+5) == 777
Now unpause the process, and it'll only trigger when that condition is true.

Ralicht · Posted: Wed Jan 13, 2016 2:42 pm Post subject:

I've tried custom breakpoints and it seemed like the answer at first. Maybe II am not using them correctly? However, this region is written to by hundreds of functions and the source is different each time. It could be any register writing and any address+offet writing.

Is there no way to watch a specific address for just hex values to change to a specific value and then see what wrote to those values? I don't know any of the registers. I know that a certain hex value will become the RSI for the data I am trying to trace.

Here is a screenshot of what it looks like in that area (the top starts the move for another area of code that I have traced to this: https://gyazo.com/681c4483ff288e21c606a4889cc50007

ParkourPenguin · Posted: Wed Jan 13, 2016 3:21 pm Post subject:

lol, that's the stack. You'd be much better off using break and trace to backtrace the original instruction to some call that only runs when that value changes. Then break and trace that call when it's run, find the instruction that accesses your address, and backtrace it from there.