Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Finding pointer to the bottom of entity array

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
mynameisjimmy
Newbie cheater
Reputation: 0

Joined: 21 Jun 2018
Posts: 15

PostPosted: Sun Jul 08, 2018 6:32 am    Post subject: Finding pointer to the bottom of entity array Reply with quote

Good evening,

I've found the entity list numerous times in this game and I'm trying to make a bot around it.

The problem is, I can't seem to find pointer leading to the bottom of entity list (0 index).

Perhaps I'm doing it the wrong way, so here's my process:
- I scan for 0x0, target a monster, scan for changed value - I keep doing it until I get a singular value - monster's address = 04A7C3A4
- I open the dissect structure window and enter the address, pressumably the 1st element under that address is a pointer to the class of object (and yes, it is because I can see plenty of referenced strings with function names in that pointer), the class address is the same and never changes: 79D8BC
- I look for another occurance of the pointer to class and calculate distance between both of them, which is 1D7C in this case.
- I keep reducing the previously found monster's address by 1D7C until the first value (previously pointer to class) changes to "???" and there it is: 4A50004 is the last pointer to class.

Now, if I check what accesses it - nothing does!
If I enter the address as value to scan for - no green address appears.

I'm totally clueless at this point, especially because there's some extra data before 04A50004 located at 04A50000, so in memory viewer it looks like this:

(from 04A4FFFC to 04A50004 to show you surroundings aswell)
Code:
?? ?? ?? ?? 9C 90 AB 04 00 00 00 00


Here's the assembler at 04A50000
Code:
04A50000 - 9C                    - pushfd
04A50001 - 90                    - nop
04A50002 - AB                    - stosd
04A50003 - 04 00                 - add al,00 { 0 }
04A50005 - 00 00                 - add [eax],al
04A50007 - 00 00                 - add [eax],al
04A50009 - 00 00                 - add [eax],al
04A5000B - 00 00                 - add [eax],al
04A5000D - 00 00                 - add [eax],al
04A5000F - 00 00                 - add [eax],al
04A50011 - 00 00                 - add [eax],al
 


Any help appreciated!
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 458

Joined: 09 May 2003
Posts: 25296
Location: The netherlands

PostPosted: Sun Jul 08, 2018 10:19 am    Post subject: Reply with quote

try finding the top of the entity array instead and then traverse it till the bottom (or loop back)


(check out the address that pointer points to)

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
mynameisjimmy
Newbie cheater
Reputation: 0

Joined: 21 Jun 2018
Posts: 15

PostPosted: Sun Jul 08, 2018 10:57 am    Post subject: Reply with quote

Dark Byte wrote:
try finding the top of the entity array instead and then traverse it till the bottom (or loop back)


(check out the address that pointer points to)


Do arrays grow up or down in memory? I know that some values are written in reverse thanks to Big Endian, what about arrays tho?

Is index 0 pressumably on 0x0, index 1 on 0x4, 2 on 0x8 and so on, or in reverse?

See image below, I think this definitely could be the entlist beginning, seeing how there's just plain ??? before it.



cheatengine-x86_64_2018-07-08_19-02-02.png
 Description:
 Filesize:  28.44 KB
 Viewed:  2811 Time(s)

cheatengine-x86_64_2018-07-08_19-02-02.png


Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 20

Joined: 01 Feb 2016
Posts: 1587

PostPosted: Sun Jul 08, 2018 11:03 am    Post subject: Reply with quote

its memory architecture, everything starts from 0 and grow up.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote:
i am a sweetheart.
Back to top
View user's profile Send private message Visit poster's website
Dark Byte
Site Admin
Reputation: 458

Joined: 09 May 2003
Posts: 25296
Location: The netherlands

PostPosted: Sun Jul 08, 2018 11:20 am    Post subject: Reply with quote

select the first 4 bytes and press space, it can be a linked list
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
mynameisjimmy
Newbie cheater
Reputation: 0

Joined: 21 Jun 2018
Posts: 15

PostPosted: Sun Jul 08, 2018 11:26 am    Post subject: Reply with quote

Dark Byte wrote:
select the first 4 bytes and press space, it can be a linked list


It sent me further intoo the entity list (I know that's still entity list, because it started moving a lot once I went from secluded area to are with monsters all around.

There also seem to be another 4 bytes once I leave this area, should I click space once again or should I just continue going through the rabbit's hole Very Happy ?

@edit: It seems that the first 4 bytes moved me 161D0 further, where the next ones move me 1D7C each (which also is the size I've calculated for structure).

At certain point it started going back, here's addresses (started listing them after 2-3 jumps, +/- shows whether it grew or not):
042E7F4C +
042E9CC8 +
042DB0E8 -
0430570C +
04303990 -
042F6B2C -
042F88A8 +

So what do we do now boss? the said previously address was clearly the start of list - how do I find pointer for it if no other method worked? (pointerscan, level 8, 4092 max offset, allow for read-only pointers), doing the 'check whats accessing it' method didn't work either.
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 458

Joined: 09 May 2003
Posts: 25296
Location: The netherlands

PostPosted: Sun Jul 08, 2018 12:57 pm    Post subject: Reply with quote

try going untill the value is 00 00 00 00 (or a value you've prdviously seen), you're then at the bottom of the list
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
mynameisjimmy
Newbie cheater
Reputation: 0

Joined: 21 Jun 2018
Posts: 15

PostPosted: Sun Jul 08, 2018 1:18 pm    Post subject: Reply with quote

Dark Byte wrote:
try going untill the value is 00 00 00 00 (or a value you've prdviously seen), you're then at the bottom of the list


Was a longer journey, but here's where I've gotten (also the other address changed because I was trying to scan for something else and game crashed).

Start: 4430000
End: 451A084

What does that tell us? Except the maximum size of the entity array 0 to 127
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites