Cheat Engine

[Pingpongus]

Hey guys, I have been plugging away on my project finally having wrapped my head around how to scan for pointers. However, now I want to do something a little more complicated.

If I have the address of a function, and I want to write some code that will execute when this function is called inside the process, how would I go about doing that? I don't want to inject anything, I just want to detect the fact that the function was called (and probably get the values of its params). WaitForSingleObject (sorry, cant post urls yet), a function I am utilizing elsewhere to wait for the attached process to close seemed promising, but it doesn't appear to work for functions.

This is on Windows, and I am trying to accomplish it using the Win32 API. Thanks in advance for any help!

[ParkourPenguin]

Use a breakpoint.
https://docs.microsoft.com/en-us/windows/win32/debug/basic-debugging

[Pingpongus]

Oh! I think you are definitely right. Could you give me a bit more of a nudge? I think WaitForDebugEvent() is what I need, but it seems that the DEBUG_EVENT struct only has codes for things like process created, process exit, etc. Nothing like "function called".

Edit: Sorry, I jumped the gun! I dove into the docs you posted but now I see you said simply, "use a breakpoint" I think DebugBreakProcess is what I need

Edit: Edit: I wish I could double post lol. Well I'm still not entirely clear how to use this DebugBreakProcess. It can be used to break out of the process, but I'm not sure how to tell it to do it on that particular function call.

[ParkourPenguin]

General idea:

1. Overwrite an instruction at/near the beginning of the function with an int3 (0xCC) instruction
   
2. When that instruction is executed, the processor generates interrupt 3
   
3. The kernel handles the interrupt and notifies the debugger attached to the process that an interrupt occurred (windows calls this event a "breakpoint exception")
   
4. The debugger then does something
   
5. After the debugger is done, it restores the original instruction so that the process can execute it as normal
   
6. The debugger might overwrite it again with an int3 if it wants to continue to break when the function is run

For more information, search for tutorials on how to make a debugger in Windows.

[Pingpongus]

Ahhh I think I get it, thank you very much for the detailed answer. So basically if I want to achieve this behavior, this is the end of my "no writing to memory" approach. I will have to insert that break instruction into game memory. I don't think this is a problem at all though, as I see other projects on github writing little bits to the games memory. Really appreciate the help!

[ParkourPenguin]

int3 is a software breakpoint. You could use hardware breakpoints if you really don't want to write to memory, but they have limitations too (i.e. only 4 available).
https://en.wikipedia.org/wiki/X86_debug_register

All else being equal I'd use software breakpoints over hardware breakpoints for stopping at code.