Help with Unity Mono player structure in Beyond Galaxyland (Cheat Engine + dnSpy)

[Salvodif]

Hi everyone,
I’m trying to build a Cheat Engine table for Beyond Galaxyland, which is made with Unity, and I’ve hit a wall with how the player data is structured.
Using dnSpy, I’ve identified the class that controls the character logic:

Code: Select all

PlayerController

. It inherits from

Code: Select all

MonoBehaviour → Behaviour → Component → Object

, and Object includes a

Code: Select all

name

field. The player is part of a team of three characters, and I’m not sure how to reliably identify which instance is which (or even just consistently get my own character’s data) from Cheat Engine.

What I’d like to do is:

1. Create logic in my CT to always resolve the correct address for the current player character.
2. Use that to read/write the character’s stats/values.
3. Inspect the whole memory block of the PlayerController (or whatever structure Unity is using for it), but I don’t know how to properly view or walk that memory region from CE.

Right now I just know the inheritance chain and that Object has a name field, but I don’t know how to:

1. Use that name field (or something similar) from Cheat Engine to differentiate the three team members.
2. Map what I see in dnSpy (fields, properties, etc.) to actual memory addresses.
3. Dump or browse the complete memory block for a specific PlayerController instance.

Are there any guides, examples, or tips for:

1. Working with Unity/Mono classes in Cheat Engine,
2. Resolving object instances (especially when there are multiple characters),
3. And viewing the full memory region of a managed object?

Any pointers, keywords, or links to relevant tutorials would be really appreciated.

[Marc]

You can ressort to tutorial videos like which will give you some useful insight into mono/.net games.

For the process of getting the correct address, there are two common ways: you can either search for a specific value and, after finding it, working up your way to the according structure. With mono-based games, it is enough to put the address into the dissect data window (Memory Browser - Tools - Dissect Data and Structures) and create a new structure, it will automatically find out which structure the value is in and uses the mono information to give the structure and all entries in it a useful name.

The othger way is top-down: go to "mono - .net Info". Select "Assembly-CSharp" on the most-left panel (Images). Right from it you will see the classes. Try filtering for interesting names, I used "player". You will see several entries, one of them ist the "PlayerController". There are some values of interest in it, so click the button "Lookup instances". There are the values below, so croll a little until you see (for example) the name. Almost any values will be sufficient.. klick on the displayed adress(es) and use cursor down to browse through the found addresses which may be (or not) instances of Playercontroller. You'll notice that the values will change according to the new adresses you select by pressing the down-key.

In my test, there has been only one single instance which has meaningful values. copy that adress, put it in the data dissector, create the structure. In the address list, select the address, press F5 and see which code accesses this address.

In this specific game you'll notice that the playercontroller address is accessed a lot (namely by the code at "UnityEngine.Object:IsNativeObjectAlive+b
"). Instead of filtering the false positives away, use an easier approach. In your dissect data at +90, there is a "jumpSpeed" value, which is only accessed when you jump. So, add this address to the table, select it press F5 and voila: "PlayerController:leaderControls+1dda" reads this value, and only this value. Good spot for a code injection, where you can copy the address and it will automatically update everytime you jump.

have fun,
Marc

[MBRKiNG]

some weeks ago i made this table it was a paid request with basic stuff. maybe this would help to.

https://github.com/MBRKiNG/CE-Tables/bl ... d_v1006.CT