I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me. I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what function(s) was/were called when a specific event was triggered (like pressing the mouse button for instance) Because this action wasn't tied to any particluar variable, I couldn't just "listen" for instruction modifying memory. I couldn't just log all the function calls because it would have been impossible to spot the right one from all the other ones.

So it got me thinking of a way of doing it :

1) put the debugger in a 'listen' mode where it logs all the function calls while the process is running. During that time, do not trigger the event you're looking for, just let the program follow its "normal" flow.

2) After a few seconds of "calibration", the debuger now has a list of all the functions that are normally called when the event isn't triggered.

3) Trigger the event. Now any function call that wasn't in the initial calibration list has to be at least correlated to the event.

I'm really new to reverse engineering and I'm pretty sure a tool like that must already exist. So my question is simple. Does it exists ? If not, why ? Wouldn't that be useful ? Is there's an easier way that I'm missing ?

Thanks in advance (and sorry for broken English, I haven't slept in a while and it's not my native language)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.