Skip to content

[memhack] Search Log

Jump to bottom
DasKeifer edited this page Mar 20, 2026 · 7 revisions

Search and Investigation Logs

Successes

Failures/More Work Needed

Successes

Pawn

Pilot

Finding the pilot pointers in pawn is fairly straight forward with memory analyzer. Use 4912 as the size (from memedit)

take a snapshot of the current pawn in the in between mission screen. Click the pawn and remove the pilot and take another snapshot. Add a different pilot and take another snapshot. Compare the data to check where it changed every time and you will see a 8 byte block that started with a number, went to 0s (null) and then back to a different number. This is the pilot smart pointer. They point to close to the same memory address.

Note: Currently we only use one of these as they are redundant and we don't support setting smart "double" pointers like these

Note: I determined this was a smart pointer by reverse engineering via looking at the memory for patterns and googling. The first of the two is the data pointer we use that points to the actual object memory. The other points to overhead related to smart pointer we don't care about particularly

Pilot Data

The pilot data I reverse engineered entirely through inspection. Most of the fields are fairly easy to identify with memory analyzer. 0xFFF is probably a reasonable size.

  • XP, Level & LvlUpXp - ints - Use xp <val> command in console to control these. Snapshot between changes and look for the values
  • ID, Name, Skill - ItBStrings - Via inspecting the memory manually and seeing what I recognized as ItBString data
  • prevTimelines - int - Start and abandon runs between scans keeping the same time traveler
  • lvlUpSkills - pointer - Trickier. Compare snapshots between pilots and check for differences. Compare snapshots between the same pilot after doing a bunch of things (changing pilot, leveling up, etc.) and look for matches. Cross compare and investigate any that look like pointers

Game

Reputation

Easily done via Cheat Engine. Modify the value with money <val> command in console. Perform scans and repeat until you find a single address then pointer trace it back to the exe/GameMap object.

Storage, Pod Pilot, and Perfect Island Reward Pilots

These all follow a similar approach and are a bit trickier. I used cheat engine to search for and find the pilot data in the pod based on pilot ID/name and then checked the memory manually to make sure it matched the expected/in game data. Could also use a Memhack struct scanner to do this similar to time traveler (less manually intensive way). Once I had the pilot, I did a pointer pointer trace it back to the exe/GameMap object

Storage

For storage I had to do some additional reverse engineering via manual inspection and testing specifically for weapons to see how they behaved and to determine how vector worked. Again used googling to help identify/confirm the vector memory structure

Pods

For pods, you can trigger them with pod command and it will always spawn with Kai

Perfect Island Rewards

For Perfect Island rewards I choose missions that can easily be completed and used a combination of win and kill commands to quickly finish them

Pod Landing Location

After deployment the pod will spawn. Before it hits the ground close the game and the pod location will be stored in save data in "pod" for the given mission. Reload the game and you will be in the deploy phase again. Capture the Board data and look for the x and y coordinates. Repeat multiple times if needed until you find the stable offset.

Note that this uses a point userdata which, based on manual investigation, seems to just be an x then y int. This means the x & y offsets in the search above will be adjacent offsets.

Notes: This is only the location IF the pod drops. It's still filled regardless of if a pod drops or not. I have not found a trigger for if a pod spawns.

Failures or Need More Work

Game

Score

Score is fairly easy to find via Cheat Engine but the issue is that it does not appear to be referenced in the GameMap object. I found a stable exe offset but this varies by Game version which is something I do not want to tackle yet if not needed.

I did a very long depth 7, breadth 50 pointer scan but did not get any results from GameMap. At this point and shelving this

Console Commands

I did extensive cheat engine searching and reverse analysis with Ghirda to try and track down how we can trigger console commands via lua without success. I have been able to track the string but any changes to it are too late. Part of the complication is that it seems to be handled mainly in the main thread so its hard to trigger and break early enough

Pod Spawn Trigger

Did significant searching and could not find a trigger. Tried doing a full run of captures for Game, Board and the appropriate Region_Data.island_x_x. Analyzed for a number of patterns without any obvious hits:

  • 0s for no spawn, any other value for spawn
  • Consistent numbers for no spawn other than 0
  • Additional spawn coordinates that could indicate spawning
  • "Countdown" pattern of pods left to spawn for the island. I.e. 1 until first pod then 0, on second island back to 1 until pod, third island 2 until first pawn then 1 and so on

Some things I have found out:

  • Pod is not determined until at soonest deployment phase. If you save the game, make a copy, enter a mission and it spawns a pod then you close, restore the save and re-enter the same mission, it won't always spawn a pod
  • If you close the game during deployment, you are kicked back to island. Pod/game data not updated at that point at least
  • If you start a mission, wait for pod to start but close before it lands and reload the game, you will be back in the deployment phase and the save data will have a "pod" field if it's spawning a pod with the location. This indicates to me that it's determined as part of deployment phase

Clone this wiki locally