How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

Question

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.

My Objective is to find an address or a pattern that will allow me to loop through up to 32 enemies in order to read all their coordinates, in order to do this I have been attempting to find a pattern between each of their addresses with no luck. I have been able to collect 3 different enemy addresses, this information is useful but searching through 32 addresses is a task which requires more effort than I believe is necessary.

As stated I have access to the first 3 enemy addresses and if from that information it is possible to trace back to the base either through Cheat Engine or other reverse engineering software the process would be appreciated.

Ultimately my question is, is there a way to detect a pointer array in memory from one of its addresses, for example if if I have 3 enemy coordinates can I somehow trace the memory location back to an address that accesses all 32 enemy addresses whether it is by using cheat engine or another reversing tool.

Answer 1

(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex)

Few ways to find the other structures come to mind:

Scanning memory for signatures

Once you have a few examples of the structures, maybe the easiest way to find the other structure instances is to find matching constants in all three structures. Some values may be constant, represent properties that apply to all the enemy entities in a more high-level class inherited.

Pros:

• This is easy to implement, can be done this Cheat Engine.
• in the general case it should survive program restarts, you won't need to find the three structures every time you run the game.

Cons:

• not so robust. stuff might change between versions, data you think is constant may actually change in some cases you haven't looked at.

Pointer searching

There might be a pointer to each entity somewhere. you can just as easily search the memory for the addresses of the structures you found, and detect the array/structure that holds all of the entities. you could also walk trough arrays you find in the structures themselves, you might be looking at a linked list.

Pros:

• easy to implement.
• will be a bit more robust than the previous method.

Cons:

• you will still need to somehow find the first entities.

Finding the Constructor/constructor-like function

Either Object Oriented language like C++ or ObjC, or a procedural language like C, there must be a function that initiates the structure. usually it's easy to find - the first function called after the object is allocated, pretty distinctive assembly - mostly initialization code.

If we're talking about OO code, finding the virtual function table or a similar construct will let you easily find the construction functions, walk trough inheritance and find at least a portion of the manipulating functions.

After you get the Constructors you can easily get all the allocations, and see where pointers are being kept.

Pros:

• quite robust
• better understanding of how entities are saved in memory.

Cons:

• Static RE. usually harder to do (Get a good dis-assembler)

Reversing the structure

This one requires a bit more reversing work, but will let you find the best ways to search for the entities. Using Cheat Engine and IDA, manually map the structure, the elements/members, the functions that manipulate the structure.

If there're any pointers involved, follow them and reverse other structures you encounter.

Pros:

• Robust
• The right way to do what you want. Really understand what's going on. facilitate future abilities/features.

Cons:

• more work, and harder to do. A lot of RE.

Note

for at-least some of the methods I mentioned finding the pointers to all entities while analyzing the program might only be the first step. You can search for references to the list itself and get a better way to automatically find the entities on each program restart. This eliminates some of the Cons.

Answer 2

First Find the address you are looking for. Then cycle this:

1. Find the base (the beginning of the record).
2. Dissect the memory around this to recognize array or linked list.
3. Search the memory for pointer to that base.

Example:

Scan for parameter finding the address 30000032.

Find out the base of this record is 30000000.

Checking memory - nothing fancy around.

Finding pointer to the base at 20000004.

Find out the base of the record is 20000000.

Checking memory - still nothing...

Finding pointer to the base at 10000008.

Finding out the base is 10000000.

Checking memory - all pointers to objects I am looking for are 12 bytes away from each other. (Obviously this is some sort of collection.)

Last memory scan for pointer to make sure I am not wrong at 0000040.

Find pointer to that collection, and right after it: count of the objects in the collection.

Restart the game/computer few times to find a consistent pointer to that address.

Reward myself with a beer for the good work.

How to find the base: I like to use the "pointer scan", and check the last offset. The smallest from the most commonly found, is usually the correct one.

Sometimes, I am trying to find a record, at the beginning of allocated memory, and in this case I am sure something is base.

Another trick is to find two one after another in memory, determine their "max size", and this means the base must be no further than this number back in the memory.

How to recognize collections: Most of them are EXTREMELY organized, with specific offset, or have pointers to same type of objects.

Like if you have:

Pointer to Player 1 data,
4 Bytes
4 Bytes
Pointer to Player 2 data,
4 Bytes
4 Bytes
Pointer to Player 3 data

It should ring a bell.

Keep in mind that such alignment may randomly happen in the source, so try to search for: Player 3 data, Player 3 data +/- 4, Player 3 data +/- 8.

Anyway, if you find something like this, you are most likely really close.

This works for me, hope it works for you guys too.