More on how to find stuff in Dolphin with Cheat Engine.
Sorry for not having used 0x00 notation to properly indicate hex values.
It took me quite a while to find out how to add custom value types to it, the secret is that you have to right click the type selection combo box.
The first thing you should be searching for is the game ID of the game you are playing, which you can find by right clicking a game -> properties -> info (then do a text search). You should find about two addresses that end in 0000. The first one is usually the start address of the region of the game's RAM that you are interested in.
Then you look for the pointer to this address, either by right clicking the found address, once you've drag- and dropped it down to your watch list, and selecting pointer scan, or by searching for it as a 4byte hexadecimal value. You are looking for an address that will remain constant within a certain build, no matter how often you are restarting it.
If you've done a pointer search you should have found something like Dolphin.exe+435C4EC (this the result I got for the 3.0 516 x86 TAS version build), if you've done the hexadecimal value search, you should have gotten an address that if you add it to the RAM watchlist below and doubleclick it will give you the same result. Great.
Now whenever you are looking for some real addresses you want them to be in the range > of the address that Dolphin.exe+435C4EC points to (let's say it's 0b130000, then you are looking for 0b-something results). Let's say you find an interesting value at 0b4f45f6, then you now need to subtract 0b130000 from it to get an offset of 3c45f6. You now want to add a new address manually, check pointer, fill in Dolphin.exe+435C4EC as the pointer and 3c45f6 as the offset. Now you won't have to look for that value again everytime you resteart anymore. Success!
Another complication is that you won't be able to scan for Big Endian Float or Double in the newest official release, but you can join the beta testing group of the 6.2 version of Cheat Engine [URL=
http://forum.cheatengine.org/groupcp.php]here[/URL] or just get it from [URL=
http://cheatengine.org/temp/CheatEngine62Beta6.rar]here[/URL] (the link might be dead by the time you are reading this).
This is the code that you should paste in to enable Big Endian Float and Double support, as provided to me by mgr.inz.Player:
Big Endian Float - full AA script
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,4)
TypeName:
db 'Float Big Endian',0
ByteSize:
dd 4
UsesFloat:
db 01
ConvertRoutine:
[32-bit]
push ebp
mov ebp,esp
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax] //place the bytes into eax
bswap eax
pop ebp
ret 4
[/32-bit]
[64-bit]
//rcx=address of input
mov eax,[rcx] //eax now contains the bytes 'input' pointed to
bswap eax
ret
[/64-bit]
ConvertBackRoutine:
[32-bit]
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+c] //load the address into ebx
bswap eax
mov [ebx],eax //write the value into the address
pop ebx
pop eax
pop ebp
ret 8
[/32-bit]
[64-bit]
//ecx=input
//rdx=address of output
bswap ecx
mov [rdx],ecx //place the integer the 4 bytes pointed to by rdx
ret
[/64-bit]
Big Endian Double - full AA script "(it's not perfect conversion)"
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,4)
alloc(PreferedAlignment,4)
alloc(TEMPVAL,8)
TypeName:
db 'Double Big Endian',0
ByteSize:
dd 08
UsesFloat:
dd 01
PreferedAlignment:
dd 04
TEMPVAL:
dq 00
ConvertRoutine:
[32-bit]
push ebp
mov ebp,esp
//[ebp+8]=input
//example:
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax]
bswap eax
mov [TEMPVAL+4],eax
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax+4]
bswap eax
mov [TEMPVAL],eax
finit
fld qword ptr [TEMPVAL]
fstp dword ptr [TEMPVAL]
mov eax,[TEMPVAL]
pop ebp
ret 4
[/32-bit]
[64-bit]
//rcx=address of input
mov rcx,[rcx] //eax now contains the bytes 'input' pointed to
bswap rcx
mov [TEMPVAL],rcx
finit
fld qword ptr [TEMPVAL]
fstp dword ptr [TEMPVAL]
mov eax,[TEMPVAL]
ret
[/64-bit]
ConvertBackRoutine:
[32-bit]
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
//example:
push eax
push ebx
mov ebx,[ebp+c] //load the address into ebx
finit
fld dword ptr [ebp+8]
fstp qword ptr [TEMPVAL]
mov eax,[TEMPVAL+4]
bswap eax
mov [ebx],eax //write the value into the address
mov eax,[TEMPVAL]
bswap eax
mov [ebx+4],eax //write the value into the address
pop ebx
pop eax
pop ebp
ret 8
[/32-bit]
[64-bit]
//ecx=input
//rdx=address of output
mov [TEMPVAL],ecx
finit
fld dword ptr [TEMPVAL]
fstp qword ptr [TEMPVAL]
mov rax,[TEMPVAL]
bswap rax
mov [rdx],rax //place the integer the 4 bytes pointed to by rdx
ret
[/64-bit]
Another neat trick is that you can look at AR codes inside Dolphin, which will usually contain very useful addresses as their leftside expressions. F.e. 023c4c09 00000150 continuously writes 0x150 to the offset 3c4c09. Try searching for one AR code yourself and Dolphin will load a list of readymade codes for the game for you.
Thanks for your attention.
