Cheat Engine

[OldCheatEngineUser]

dissect code did not give any effect in the disassembly in a mono game, so is it a bug?

[FreeER]

hm, perhaps disable mono (just try debugging something and it'll break the monopipe lol) and then using dissect code.

If it still doesn't work then perhaps there's a bug, though probably not a high priority one.

[Dark Byte]

dissectcode follows modules

[OldCheatEngineUser]

mono features: off
dissect code: every module the game loads
result: nothing

mono features: on
dissect code: every module the game loads
result: nothing



so its probably a bug tho.

[Dark Byte]

is the code you're looking at inside a module ?

[OldCheatEngineUser]

[Dark Byte]

code dissect doesn't follow dynamically allocated memory

and mono tends to generate code at runtime in allocated memory

[OldCheatEngineUser]

uhm, i see.

i ran couple tests too, on enumerated dlls still not everything analyzed even the entry point.

and what you said is true, they are dynamically allocated.
first i thought these functions might be imported from another process, but it didnt make sense to me.
well, they are imported actually.

so there is nothing i can do about it?
i tried with olly, but seems olly cant handle the executable since its about 16MBs.

[ParkourPenguin]

celua.txt:

[OldCheatEngineUser]

im not sure .. what should i do with this lua code?
i know what base and size means, but its executed under lua engine? right!

plus the functions in this section 0x80000000 and mem_rgn can find this section of the executable.

im not sure if they were marked as uninitialized executable data.

[ParkourPenguin]

1. Look at an instruction in the disassembler
   
2. Look at the address that instruction is at (turn off symbols in the view menu)
   
3. Open the Memory Regions window
   
4. Find the memory region that address is in
   
5. Open the Lua engine window (Memory View -> Tools -> Lua Engine)
   
6. Copy and paste that code into the bottom part of that window (left of the "Execute" button)
   
7. Replace the "base" parameter with the number under the "Address" column in the memory regions window
   
8. Replace the "size" parameter with the number under the "Size" column in the memory regions window
   
9. Make sure the arguments are prepended with "0x" to tell Lua they are hexadecimal literals
   
10. Click on the "Execute" button

[OldCheatEngineUser]

no way parkour, base at 7FFF0000 and the size 90000 which will be 80080000.

and the instruction located in 800E0000+

also getDissectCode().dissect(0x7FFF0000, 0x90000) didnt result anything.

[ParkourPenguin]

Then why did you choose that memory region if you know it isn't the correct one?

Say an instruction in a memory region you want to dissect is stored at the address 10002B419, and the Memory Regions window looks like this:

[OldCheatEngineUser]

[panraven]

Try to associate the dissect function with a hotkey, but found ce will duplicate same reference with each hotkey pressed.
Work around is to add an artificial call reference to the target function starting address, the artificial call/jump is in between that function start and end.
This may affect some other extension using the dissect function references, since it is not an actual call, it may cause problem.

Hotkey is CTRL-ALT-J, may change.

Usage: Save the text to a *.lua and put in autorun directry.


Updated:
-- add one more 'already' check.