Cheat Engine

[toadn]

I just want to make sure before I ask the questions ..
dynamic variables == variables are strored in the Stack.
static variables == variables are strored in the BSS/DATA section.
right?

1)
How CE identifies static address?
How CE know which address is dynamic, and which address is static?
*I expect to get a detailed answer, i want to know how CE actually doing it.

2)
If the program or game using a dynamic variable, is there a way to access the variable in a fixed way(like static address pointer)? Or every time i must look for the variable address again?

3)
Why game developers using static variables, and not only dynamic variables? After all, it will be harder for us to find the address of the variable we are looking for.

[kuntz]

Dynamic variables are variables which have memory addresses that change with each run of the process, while static variables are not. It has nothing to do with stack or bss segments which is likely leading to confusion. With enough effort I can put "static" variables in my stack and use them as "static" variables.

1) There is no such thing as "dynamic" or "static" memory addresses, these are human concepts mostly used in Game Hacking to describe the two types of games in existence. Some older games used certain compiled languages that make heavy use of hardcoded addresses, while other's did the exact opposite. Today most games use compiled languages that make heavy use of dynamic allocation of memory blocks acquired from the OS during runtime. Every time the game is run, it allocates memory from the OS, the OS chooses a different region every time, thus first you need to "find" the region, and then once you've found it, you can find the variable within. For these types of games it is often easier to just modify the games' code for an intended effect, rather than trying to find the variable in memory and "freeze" it to a specific amount.

2) Yes. But it's easier to just modify the games' code for most people, so it's rarely done.

3) Game devs do not choose for a variable to be "static" or "dynamic" during development, it's up to the compiler and the memory allocation strategy they choose to use. But there is no one developing who is thinking to themselves "This variable will be static... oh but this one will be dynamic".

[toadn]

[ParkourPenguin]

From this point forward, I would suggest you change your wording to something less condescending. You are not entitled to anything on these forums and pretending like you are will not get you any help. I'll assume you don't have that intention.

1:
A "static" address is an address located inside a module (i.e. an exe or dll). While the module itself can be loaded at a different virtual address between separate instances of the program, a value stored in the module is unlikely to change its position in that module. Thus, it can be referenced persistently by getting the location of the module (see windows API documentation).

A "dynamic" address is anything not inside a module. This can include the stack, heap, and anything else that's been allocated at runtime by the program. It's uncertain exactly where a specific memory block will be allocated, but it is certain that some reference to it must exist somewhere; otherwise, the program wouldn't be able to use it and would just be allocating memory for the fun of it.

Note that addresses on the stack can sometimes act like static addresses. The first few values on the stacks of the first few threads usually don't change semantics between separate instances of the program. Thus, they can also be referenced persistently (this has been explained before on these forums).

2:
That's one of the most frequently asked questions on these forums. It has been answered many times and has many tutorials covering it, yet even more people ask it without searching.

3:
I highly doubt any developer takes that into account. They'll just use whichever makes the most sense. That isn't even a form of protection, as it doesn't have any baring on the ease at which a value can be found and changed. There are many better ways developers can go about protecting their program.

[kuntz]

[toadn]

[mgostIH]

CE dissects the PE header of the executable and checks how long static sections are and from what address they start.

Also, as a developer, you can't really get rid of static addresses, because your program needs to have references to it's own variables when it starts, so it's impossible to have a 100% dynamic executable.

[toadn]

[Dark Byte]

Threadstack# addressing can find those.
The closer to the stack it is defined, the more static it is. Of course, the more higher up you get it becomes more random, but the base is always pretty static. And from there you can get paths to the rest

[toadn]

[ParkourPenguin]

I would like to point out that the term "static" can refer to several things. Different programming languages can have different meanings and implementations associated with that keyword. With regards to CE, the only apparent usage of the term "static" would be the "Find static addresses" menu item (Memory Viewer -> Tools). In this case, a static address is any memory operand of any instruction whose offset is specified by only a displacement (no base, index, or scale; see Intel V1 S3.7.5 "Specifying an Offset") [CE source]. It's common for some people to consider the green addresses in the hex view to be static, but these are determined solely on whether or not they're inside a module [CE source]. Given the context of the OP's question, I'm using the latter definition of "static."

Short C++ example of stack addresses:

[kuntz]