Cheat Engine

[Mark Danielle]

Hi, I have an idea which I will explain below.

Let us say that in a game, we would like to find the entity array.
We know that, for example:

The HP offset within Entity structure = 0x4

[[entityarray+offset]+offset] = Entity HP
[[?+?]+0x4] = Entity HP


Let us say that we found the proper HP addresses of 3 entities in the game.

We do not know what the offset is for each entity within the entity array, but we know that all entities must be in the same entity array (same entity array address).

So we know for a fact that:

? = entity array address
[[?+X]+0x4] = entity 1 hp
[[?+Y]+0x4] = entity 2 hp
[[?+Z]+0x4] = entity 3 hp

As we have the addresses for all 3 entities' HP, we can do a pointer scan for all 3 of them which end in the 0x4 offset and then find a common pointer (the entity array) between all three scans.

The only problem right now, is that filtering 3 pointer scans manually just takes way too long for a human being.

It would be great if cheatengine would have a method to filter common (base) pointers between many pointer scans.

Of course this could be used with more complicated structures like:
[[[[entity array+?](entity)+?](component list)+?](component)+0x4]

If you have 3 components then you can find the component array within the entity, etc.

So this would basically be an intersection between two or more pointer scans for the (base) pointer address.

[Dark Byte]

So basically do a normal pointerscan for entry1 hp and then 'fiddle' with each offset of every result to see if it matches entry2 hp and if so, store both paths

I might be able to add that, but it may take up to 2 to 4 gb extra ram to keep a reverse pointermap for the base pointermap, and will slow down scans quite a bit
It could be a thing for rescans only as well.

Not sure how to 'group' the addresses though

[Mark Danielle]

[Dark Byte]

One pointerscan should be enough as that contains all the data you will need

with fiddle I mean let CE automatically do that for you.

e.g you have the following situation:
You have 2 classes. Game and Player

Static base address (game.exe+10000) points to the Game class
The Game class holds an staticsize array of players at offset 0x118
The player class has at offset 0x480 the player health


You do a pointerscan for the player health, and one of the billion of results the pointerscan finds is:
[game.exe+10000]+118]+480=player1 health

With a fiddle distance of 4 (and stepsize 4) CE would then check the following paths if they match player2 health: (just an example, you'd likely want to go with 64 or 128 distance with multiple players)
[game.exe+10000]+118]+47c
[game.exe+10000]+118]+484
[game.exe+10000]+114]+480
[game.exe+10000]+11c]+480
[game.exe+fffc]+11c]+480
[game.exe+10004]+11c]+480

It would then find [game.exe+10000]+11c]+480 to be a match for player2 health. So saves the pointer for player1 and player2
[game.exe+10000]+118]+480=player1 health
[game.exe+10000]+11c]+480=player2 health

the problem is how to prevent a third rescan from using both results to fiddle with while only the first one would be enough (ptr results are unordered)

(You can't really see pointerscan results as sets that you can compare. multiply the time it takes to sort a pointerscan by the number of results in it to get the time it takes to handle it like a set)

[mgr.inz.Player]

"the problem is how to prevent a third rescan from using both results to fiddle with while only the first one would be enough (ptr results are unordered)"

Don't save those pointers at all and allow other workers to do their job, even when they repeat the very same (or almost the same) work?




RESCANNING:


If worker have this pointer [[[[[game.exe+10000]+offset0]+offset1]+offset2]+118]+480 which points to address1 (P1 Health),

Check if adjusted pointers (made from above pointer) will point to address2 (P2 Health). Max adjust value is 0x100.
If at least one points to address2, we will keep this pointer. If not, just drop/reject/flagAsInvalid this pointer.

[Dark Byte]

max adjust value of 0x50 (80) with a stepsize of 4 would mean 40 checks for each offset (20 below, 20 above)

on a level 6 pointer that would be 40*6=240 checks for each pointer. (it's useless to fiddle with multiple offsets at a time)

But yes, the rescan will take about 240 times longer than usual


Of course, assuming you follow the next CE's recommended scanning method(first make a snapshot, reboot or go to another system, then do a scan with help of the snapshot), you should only have a handful of results to work with

(I do think it should store which offsets should be changed to get to health 2 though, as it might not be clear to the user why that path got left in)

[mgr.inz.Player]

[Dark Byte]

Actually, I think this is a bad idea to do it in a scan or rescan

I think the original post might work better

Sort ptr1 and ptr2 on the base address
Delete all the .ptr.X entries that are unique and leave the ones that have a matching base

Then sort ptr1 and ptr2 on the first offset and delete all the .ptr.x entries that are unique and leave the ones that have a matching offset (or are negative)

repeat until there are no matching .ptr.x left and you'll have two lists of matching pointer starts

And I guess you could also go from the other side

[mgr.inz.Player]

[Dark Byte]

The thing is that you (and likely other users) would assume it would be able to find pointers to semi-related fields instead of related fields seperated by a single array (which is a fair request else it'd be only useful in those few player array situations)

The problem with that is that offsets after the first change can not be guaranteed to be similar, so they have to be checked the full structsize of the original scan (eg 2048)
Meaning for every pointer you find a full secondary pointerscan would have to be done to find that address

So even with 1000 results you'd be doing 1000 times a level-1 pointerscan multiplied by the distance (since only the base would be aplicable to the change)

I think doing 2 to 3 scans and sorting them is probably faster

[Mark Danielle]

[mgr.inz.Player]

@bmn

If you want to test the newest (not 100% tested) pointerscanner, you can try this:
https://googledrive.com/host/0BwMAnE6mjogMTmpYMGstY1NPQnc/



1 Download file "pure r2795.7z",
extra step: do a backup, WinRAR or 7Zip of whole CE directory.

2 extract with WinRAR or 7z
3 copy and paste into CE directory, overwrite existing files.


By default CE is installed in C:\{PF}\Cheat Engine 6.4,
where C is system drive, {PF} is your "program files" dir - could be "c:\Program Files" or "c:\Program Files (x86)".

As DB said, you need 6GB or more for some scans.