If you are looking at RAM (which I assume so, since you mention executable area) then you should study how RAM is organized into chunks, etc.
A chunk is is contiguous group of 0x1000 bytes with the same memory attributes.
A chunk can be executable, mapped, unmapped, inaccessible, etc.
When it comes to locations where data it stored, it depends on how the data is loaded.
In old games, most of the space required to hold the data was declared in the executable and filled in by external files (Final Fantasy® VII for example).
This is why most of Final Fantasy® VII’s data structures can be mapped so easily, since they never move in RAM.
Unfortunately these days most things are loaded entirely from external files with the memory declared in real-time as required. This causes data to shift around in RAM and makes it often very difficult to track.
In the case of 3-D models that are only in RAM when they are being used, they are always declared in real-time and almost never end up in the same location in RAM.
In order to track them, you have to find the pointers to them.
Pointers, even in advanced games, are almost never more than 2 deep. This means finding a pointer to a pointer, which is usually because one class has an array of models (one pointer) and then that class is instantiated with a pointer.
So you would find the pointer to the class, map that class, and find the member of that class that is a pointer to the 3-D models.
Also, most graphics cards store the vertices, mesh, and texture information for 3-D models. This is an area of RAM you can not access (not through the Windows® API). Even DirectX® can not interact directly with graphics devices, which is why Microsoft® requires all graphics card to have a HAL (Hardware Abstraction Layer).
I have written a program with a Hex Viewer with many useful features.
It shows you where chunks begin and end, and it uses color-coding to display the hex graph.
It shows you where pointers are and shows you executable areas in RAM (blue).
It shows areas that are reserved for data (free store
) and it has a feature to help you map structures in RAM.
It allows you to build structures to depict complicated data types, including 3-D models, and to paste those structures over RAM to see how that area in RAM measures up to your structure.
It shows you if the area is a valid area for the structure you have defined, and if it is, it shows you the names of each of the structure elements and their values.
It can even scan your existing projects for structures you have already defined inside code files (.cpp, .h, and .txt) and convert them into the structures you can paste over RAM.
I have posted the link here a few times but nobody cares.
They are either too busy or they aren’t hacking right now, or whatever else.
I request feedback but get none.
mirex is now hosting my site, so here is the link to my Windows® 9x version.
Memory Hacking Software Compatible
And in order to know how to use the templates (only helpful if you already know how to use classes/structures) you need the tutorial.
Tutorial
L. Spiro
