Cheat Engine

[h3x1c]

Greetings! Okay, so, I'm quite familiar with the general functionality of "Dissect Data/Structures," but I fear I'm missing something when it comes to 64-bit addresses.

The problem I'm having is getting the offsets to show properly. Take, for example, [RAX+0C], which is, say, 7D888880C.

Regardless of if I enter 7D888880C-C or 7D8888800, the offsets after defining the structure seem to be off. So, I'll look for offset C, but it's skipped due to the way the structure was defined--perhaps something like this:

0000
0004
0008
0009
000D
000E
0012

If I enter the exact value of RAX+0C (7D888880C in the example above), then I'll see the correct value after defining the structure, but then I can't see anything prior to it, of course. Even if I try something like 7D88888C-4 just to see 4 bytes prior, the defined struture from that tends to be off, too.

This is making it impossible for me to compare data from multiple addresses, or even to look for other relevant data in close proximity to one address! This only seems to be an issue that I'm having with 64-bit addresses, too. Using "Dissect Data/Structures" with 32-bit addresses has been absolutely marvelous for the most part.

I've no doubt this is due to an error on my behalf or a lack of understanding with something, so any guidance or feedback here is greatly appreciated. Thanks so much!

[Zanzer]

You can define your own offset if the automated scan doesn't assign the correct thing.
Right-click > Add element (or push the insert key)

[h3x1c]

[Zanzer]

I personally don't use the dissector, so I can't offer any tips. I usually just go to the beginning (offset 0) in the memory viewer. Set the display type to 4-bytes and look around for whole numbers. See if any map up to other in-game values. Then switch it to float and look for values not in exponential notation. Sometimes 2-byte values are needed. You can then manually add the values that the dissector missed. As long as your starting address ends in 0, 4, 8, or C, then the memory viewer should make a visual inspection easier.

[Dark Byte]

If it's not .net or mono(active) then CE will guess the types based on some rules
e.g:
-Is the value human readable? (0 to 10000, or ending with 0)
-Does the value represent an currently readable address
-And most importantly, check the alignment on a 4 byte preference. If a current address is unaligned it'll try to handle it so the next item will be aligned on a 4 byte address

So, if a structure's elements are unaligned for whatever weird reason then ce will guess it wrong

[h3x1c]

Thanks for the replies, Zanzer and Dark Byte! I feel WAY more clear about the whole thing now.