Cheat Engine

[xwize]

Hi all, this is my first post here.
I've been using cheat engine for a while so I know the basics.

I have hooked d3d calls in AC odyssey and I know a bunch of render target memory addresses. These render targets could be extremely useful for hud removal and general post process graphics tinkering.

I need a consistent way to refer to these memory addresses without needing to search for them at runtime, so naturally I tried to use cheat engine to resolve them to a pointer chain that would work across game restarts.

But here's the problem, whenever i scan for a known render target address, generate a pointermap and compare, it doesn't find any pointers. I tried in two games, RE2 and AC odyssey, RE2 works just fine, but AC odyssey always gives me 0 results for the comparison.

I'm quite experienced at programming but I'm still relatively new to reverse engineering, so can someone who knows their shit offer me some hints?


I know the application has a pointer, because it draws into the render target every frame, so it obviously has the pointer SOMEWHERE in its address space, so why can't cheat engine find it? I tried every scan setting.

So what reasons might there be for this? Is there some kind of protection going on? I need the opinion of someone with more expertise.

It sucks because this is the only thing stopping me from releasing this mod which would be pretty awesome to have on PC.

[ParkourPenguin]

Apparently a good portion of the graphics engine is done in C#. Assuming it's being compiled to CLI bytecode, you may have an exceptionally hard time finding static pointers. For example, a while ago in a game I forget, I found a base address the compiler stored as an immediate in an instruction (e.g. mov rax,1286c4fda074).

You can ask the pointer scanner to find such an address by turning off the alignment requirement, allowing non-static base addresses, and allowing read-only nodes in the advanced settings. Be aware this will increase scan times drastically. You may need to turn off compressed pointerscan files as well (maybe that bug is fixed now; I don't know).

Even if you did find such an address, you'd still need to do an aobscan for it since it's dynamically compiled. You'd be better off injecting code to copy the end address itself or some node in a pointer path to it. Search for "injection copy" / "injection copies" on youtube for tutorials of varying degrees of quality.