Cheat Engine

[_Veggy]

Hey guys,

Trying to experiment with a disassembler engine using BeaEngine.

I want the output of the disassembled instructions to be shown in a listview.
For this there are two methods:

1. Using a regular listview and fill it in, this works, but after a couple thousand results the listview is starting to become incredible slow and the listview is taking a lot of system resources.

2. A Virtual Listview which can handle thousands of results but requests them.

So number 2 seems a better method.

What I tried to do is the following:
1. Disassemble the file and save all instruction addresses into an allocated memory buffer.
2. Than when the listview requests an item I traverse through the allocated buffer and pick the appropriate instruction address to disassemble.
3. Fill in the requested info.

This is working perfectly fine but the problem is the following.

Since we do not know on forehand how many instructions we will have, we can't inform the virtual listview about the amount of instructions either.
So what I tried is:

//allocate buffer to store disassembled addresses for our listview
mov r14, [ImageBase]
mov rax, [SizeOfImage]
add r14, rax
mov rbx, 8
mul rbx
invoke GlobalAlloc, GMEM_ZEROINIT, rax
mov [Disasm_Index], rax
mov rdi, rax

It's an allocated buffer that allows me to store all qwords (instruction addresses).

but when I have a file of 50 MB my program will allocate an enormous amount of memory as a buffer.

My main question would be:
How is it possible to keep track of the instruction to assemble.

for example:
When the listview requests the first item:
iItem = 0 --> instruction to disassemble at: 140000000
iItem = 1 --> instruction to disassemble at: 140000005
iItem = 2 --> instruction to disassemble at: 140000009

As you see the amount of opcodes (bytes) vary for each iItem.

What I do atm is I store the addresses 140000000, 140000005, 140000009 etc..
into the allocated buffer.
Than when the listview asks for iItem 1 -> I read the addresses from the buffer and disassemble the instruction and fill the listview with information.

Are there any quicker less memory taking methods?

[ulysse31]

Have you taken a peek at the x64 debugger project ? the source code is available and they use BeaEngine as well.