Cheat Engine

[Drustanus]

I'm not sure how feasible this is from a debugger perspective, but I had a thought and I'm curious if it can be done.

Let's say that I have the base address of some class instance. If I use "Find out what accesses this address" on it, it will just show me instructions where a register (perhaps with an offset) holds the base address.

What I'd like to see instead are instructions where the base address is stored in a register with offsets added to it ie. Field accesses.

To elaborate a bit more, let's say the RAX register is holding my base address.

"Find out what accesses" could give me something like:

[ParkourPenguin]

Not feasible in hardware.

You could look at what accesses a pointer to the base of the struct and trace what happens to the value of the pointer, but I don't think CE has the capability to automate that process yet.

[Dark Byte]

use exception or dbvm breakpoints

go to the class instance start and select all the bytes you think belongs to this instance
then rightclick and find what accesses this address