Cheat Engine

[ulysse31]

Hi, I've been wondering how it's done.
First I thought CE would assume the function started with
push ebp
mov ebp,esp
and from there take ebp + 04 value as the return value.
However if that was the case then CE wouldn't get dll starting with mov edi,edi
's return address right.
This gets me wondering how exactly CE does that and how likely is it to actually fail ?

[atom0s]

You can find how Cheat Engine does it in the source code in the various files like these:
https://github.com/cheat-engine/cheat-engine/blob/48da5470e306b00141c8c49056164b03cf403237/Cheat%20Engine/stacktrace2.pas
https://github.com/cheat-engine/cheat-engine/blob/5f101ea6808939be5b4c092bd9bf26987b080447/Cheat%20Engine/frmStackViewUnit.pas
https://github.com/cheat-engine/cheat-engine/blob/efb5800f3cfd87942ae3cd1434787fd80ae929d7/Cheat%20Engine/MemoryBrowserFormUnit.pas

[ulysse31]

thanks!