Cheat Engine

[ashftw]

I am rewriting CE's pointerscan to c++ on Linux platform.
I had iterated each pointer offset like this:

[Dark Byte]

Ce keeps a (custom implementation of a ) map that holds all pointervalues and the addresses that have that as value.
so then it just has to ask for values within a range and it'll get all the addresses that have a value in that range

[ashftw]

So that map is actually pointermap's ".scandata" file, that contains maps of process, right? Like '/proc/self/maps' in Linux:
file: "base.exe", address: 0x400000, size: 0x1000, etc...
file: "library.dll", address: 0x725000, size: 0x22000, etc...

I am really confused by your answer. Can you show in the code exactly where this is going? Or classes/methods that doing this?

[Dark Byte]

it's this monster: https://github.com/cheat-engine/cheat-engine/blob/master/Cheat%20Engine/pointervaluelist.pas

most importantly:
https://github.com/cheat-engine/cheat-engine/blob/ed059e44be2c268a770587bf74c867f08c8bb5b4/Cheat%20Engine/pointervaluelist.pas#L583


basically it holds a list of all the values in the target process that represent an address, and for each value which addresses (multiple) hold that value

so then when searching for value XXXXXXXX-structsize to XXXXXXXX it gets all the addresses a lot quicker.

Of course it first has to do a full memory scan and confirm every value it encounters is a pointer by referencing if the memory is available or not (in linux check /proc/pid/maps yes)

(Also, keep in mind TBL cache hits/misses etc... so if possible, keep the allocs low and all memory nearby)


--edit
also, I just noticed why you're confused.
While your pointerscanner starts from base addresses and scans until it accidentally hits the one target destination address, CE's pointerscanner starts from the destinationaddress and goes the other way until it finds any base address
This method of course makes it pretty difficult to calculate how long it is going to take, because each path can cause more paths until max level

(See it like raytracing. Instead of following the infinite amount of possible rays a lightsource emits, just start from the screenpixel and follow it's path until it reaches a lightsource )

[ashftw]

Oh, I got it. Thank you!