Cheat Engine

[justa_dude]

Hi folks,

Just wondering why I sometimes get different module addresses depending on whether I'm using the kernel-level debugger versus the default. If I'm using the user-mode debugger, I still get the more familiar addresses when I copy from the memory view / disassembler, but the display shows something different. The templates all grab the unfamiliar module names, too. CE seems to be happy using either, but I'm not really clear on the difference. Could anyone enlighten me, please?

As an example, AK::Streammgr::blahblah+12345 vs Assassinscreedgame2.exe+12345.

Cheers,
adude

[Dark Byte]

the symbols are probably lost when the new processhandle is being used (new processhandle due to attachtoprocess) so ce falls back on modulenames when getting the name of an address

[justa_dude]

So, the AK::Streammgr stuff is a symbol loaded from the program's debug information? That's awesome.

For noting addresses in general, is any one choice advantageous over another? I understand that using flat addresses relative to the base of memory is frowned upon since the relative addresses can change, but is there any fundamental difference between using a symbol name versus a module name?

Thanks,
adude

[Dark Byte]

using symbols can have an advantage sometimes.
e.g a game could have a lot of symbols like apawn::DecreaseHealth

When it updates there is a high chance that the offsets from those direct functions are still valid (unless those specific functions got edited, but that's rare)