What's a good method to find the location of objects in a game [closed]

Question

So in a given game there are objects randomly placed around the map. I've managed (through playing with the memory in cheat engine) find that a single value changes when a certain object is within my draw distance. It's a boolean either 0 or 1. I had expect to then be able to search for the location of these objects (based on an interval of my location at N,E,S, and W of the object in x and y) however I was surprised to find that no values were found in this range! Is there a piece of software/method by which I could try and figure this sort of problem out?

I realise this is a broad question - I wouldn't like to limit it to a specific game since I wish to apply the method to more than one game. If there are other ways to make the question more narrow please say so in comments and I'll amend!

Answer 1

I'll make the assumption that the application is written in Visual C++.

CheatEngine itself is already pretty useful for finding your objects - first you need to find the place in code where these objects are created. For example in C++ you'd write:

GameObject* obj = new GameObject();

In assembly this is often inlined to a malloc call. So if you use something like IDA Pro to more accurately reverse engineer the assembly, you might see something like this:

;; void* obj = malloc(64);

push  40h      ;; alloc 64 bytes
call  _malloc  ;; easilly detected only if program dynamically links to msvcrt.dll
add   esp, 4
mov   [esp+local_C0], eax

From this you can figure out that your objects are always 64 bytes in size (this is just an example, so your concrete program probably might have bigger objects).

If you launch the program in Visual Studio (File -> Open.. -> Project/Solution.. -> YourProgram.exe), you can force it to use the Windows debug heap, which will allow you to walk all the dynamically allocated heap nodes and filter out all nodes that are 64 bytes in size.

Now you should have a large collection of potential GameObject pointers and the final level of filtering would be detecting some basic patterns - for example if the class uses virtual functions, the first field of the object will be its VTable entry, thus giving you an easy identifier whether it's a GameObject or not.

This might not be a complete example, but it should be good enough to get you in the right direction.