Cheat Engine

[ralfonat]

Hi there,

much like

forum.cheatengine.org/viewtopic.php?p=5777647

I am tring to find a way to emulate the "Lookup Instances" functionality in the .NET Info dialog with a Lua script.

I've tried various ways but just generally -> is it even possible? or is that a heap search in CE that can't be emulated or is not exposed in Lua?

What do I want to do? I have a HealthPlayer class, I am looking up the first instance and then theres the PLAYER_HEALTH field. So I just want to use Lua to lookup the instance, find the right one, and add the address+offset as a variable in the AddressList.

Is this possible? Is this even the right/smart way to do this?

Thanks!

[ParkourPenguin]

Look at the file `autorun\dotnetinfo.lua` in the main CE directory. Particularly the function `getClassInstances` and `getClassFields`. You won't be able to use these functions yourself, but it should give you some idea of what you'd have to do.

I'd do a code injection to get the instance (search "injection copy") and simply hope the offsets don't change.

[ralfonat]

Hi there,

I had a thorough look at the code but I am unsure as to how I could make use of that when you say "you won't be able to use these functions".

How would I use code injection to get the instance? and what is "injection copy"? I'm sorry for sounding stupid but it seems people use these terms very loosely and I don't want to misinterpret your answer.

[ParkourPenguin]

You can learn from those functions. More specifically, look at the implementation of those script-local functions and re-implement them yourself.

e.g. from the `getClassInstances` function, you can learn that mono code is handled differently from dotnet code. Assuming your target doesn't use mono, you can ignore the mono part of it and only focus on the section that handles dotnet. Look for `DataSource.DotNetDataCollector` and you'll see it comes from `getDotNetDataCollector`, a function with a bit of documentation in celua.txt. The method `enumAllObjectsOfType` is what you'd use to find instances of a particular type/class. Then you'd track down what `Class` is, and eventually figure out it comes from `DataSource.Domains.Images.Classes`. The classes in an image are initialized from `getClasses`, the images in a domain are initialized from `getImages`, and the domains are initialized from `getDomains`. These three functions show how to use various methods in the DotNetDataCollector class to collect dotnet information in the target process.

You can try to reuse the code that's already written. The gigantic function `miDotNetInfoClick` that calls `getDomains` also exposes some script-local functions in DataSource (e.g. `DataSource.getClassFields=getClassFields`)- a weird thing to do if DataSource was also script local. As it turns out, DataSource is a global and can be accessed everywhere in Lua. It just needs to be initialized by the `miDotNetInfoClick` function, which is also a global and can be executed at any time (the `sender` parameter seems to be unused). The images and classes are lazily initialized, so you'll have to check for that manually: i.e. `if Domain.Images == nil then getImages(Domain) end`; classes are more difficult.

The file `autorun\dotnetsearch.lua` searches through dotnet info for specific classes / fields / methods. It mostly handles GUI and some thread-synchronization stuff so as to not block the main thread while the search is executing.

There's also the invasive data collector you might want to use: see the function `LaunchDotNetInterface` as well as the file `autorun\DotNetInterface.lua`. I'm not going to spend more time analyzing this myself.

A good part of programming is being able to read someone else's code and understand it enough to do similar things yourself.

[ralfonat]

[ParkourPenguin]