Finding a certain function in game(TS4)

Question

I am trying to find a function that places a furniture on the ground when I buy it and click the spot.

This is the way I am trying to do solve it at the moment.

1. Find the address of money with cheat engine
2. See which areas write to this address
3. Backtrack the function calls and set breakpoints

I managed to backtrack the calls enough that the breakpoint doesn't anymore trigger by selling the item back but only by placing it on the ground. By looking at the arguments I determined that this is still not the function I am looking for as the arguments don't change according to what item I place on the ground.

I tried to backtrack more but then I ended up in a function that seems to be part of the main game loop(?) as it is run constantly.

Is there any better method in achieving this, or is it just blind testing and backtracking as I have done? I usually work by searching the addresses with cheat engine and then switching to ollydbg to do the tracking.

I've also been trying to find the functions that triggers when I press certain buttons but it's been really hard to even find an entry point for this, how should I try to proceed?

Answer 1

Some tips/thoughts as they're flowing, sorry for the mess. Maybe I'll sort it out later.

General tips:

If you're trying anything more advanced then changing a value, CheatEngine (and debugging) are probably not the best tools for this task IMHO. They'll work great at providing extra info and for validating your assumptions (which if done right you'll have tons of), but not as the main tool. Once you found a few somewhat relevant functions you're better off actually going full front reversing these parts of the game. That is, start up IDA and document like hell.

I'd start by creating a structure for the object that contains the money, try spending some time finding other low hanging members of that structure as well as it's size (just assume by members you see, and increase when needed). Whenever you see a member you don't know what purpose it serves, give it the best informative name you can (mFunc405020 if you don't mind) or a relevant comment. You'll be amazed at how easy it makes naming members the third time you come across them.

Same goes for methods. After you've found some members go for methods just the way you did for members. Start with constructors and inheritance trees, they give a lot of info and relatively easy to find. Draw the inheritance graph and rename functions and create structures accordingly. Use the constructors to find more instances of the structures, they'll give you more info.

If/when you notice you're reversing the wrong structure don't be afraid of ditching it for a more interesting structure you found or go off and find another structure.

find an object specific tips:

Since you're looking for creation of a specific object (which will probably have its own class) you need to switch objects quite frequently and use debugging/cheat engine to verify you found a relevant constructor.

I'd even spend less time on members/methods and most of it on constructors and destructors. When you'll map the inheritance tree you could easily find the constructors being called specifically for your object.

EDIT: You might also find an old answer of mine helpful, to a question titled "how to find entities/enemies array pointer using Cheat Engine" by Daniel Filipe.