Tutorial: Finding pointers with CE

Section 1 - Using CE to find pointers:

 This assumes you are familiar with scanning for addresses in cheat engine.

 Many people complain about DMA (dynamic memory allocation) making it difficult to use/find addresses, especially when the program is protected with packing, such as Themida (thus not allowing you to attach cheat engine's debugger to the program). However, cheat engine's pointer scan feature lets you get around this - and it's much more user friendly for those who don't know how to find pointers via debugging. When you've attached CE to your target program, and found the address you want, right click the address in your cheat table and select "Pointer scan for this address". You will then be prompted to a new dialog with many options, as seen here:

Checkboxes: make the settings similar to that of the screenshot. From - to: this is the range of addresses the pointer path can be in. I'd usually just leave it as default: 0x00000000 - 0xFFFFFFFF. The next two checkboxes you can leave unticked. Now, the important parts are in the Maximum offset level and Max level.

 The max offset is the maximum number in hex that your pointer can have as an offset. some programs/games use high numbers, some use lower. For FireTrain, most of the time I had to use a max offset of 0x99999 for best scan results.

 Max level is how many pointer-to-pointers can be allowed which point to your static address. The concept of pointer-to-pointers with offsets can be tricky at first. However, you just need to remember how a pointer + offset works: the pointer points to an address, then the offset is added to the address that the pointer points to. A multi-level pointer follows the same concept exactly. The only difference is that you "follow the pointer and add the offset" multiple times in a chain, so to speak. For FireTrain, the highest level needed was 4, for character base. You can now pointer scan.

 This could take a while, or even freeze your computer for a long period. Once you hopefully get some pointer results from the first scan, exit the game, re-enter and find the address once again (since DMA will cause it to change). After you have your address the second time, press Pointer scanner -> Rescan Memory.


Hopefully this should narrow it down to only a few pointers, which should be static. You can then double click on the pointer you want in pointer scanner and it will be copied to your cheat table.