[tlenl]

Hi Toni, happy new year.

Wouldn't be better to look for (and operate) on the variabile rather than on the function?

The variable once found is (quite for sure) static in the game.

Looking for function is not garanteed to be effectively in all the situations.
Could be for example that different functions would modifies the variable in different place (on different situations in the game).
In this case we would need to find "all the different situations functions" instead of just finding the variable once.
(Once found the variable who cares what function modify it).

Moreover when "finding" the variable to lock, the person could find the right variabile, but it would be possible to mask the "wrong" memory block (if for example is better for uniqueness).

The only requirement would be that the result of the mask is the right address.

Offsetting the wrong function would make the patch not working.

Moreover masking the variable (and operating on it more than on the functions that modifies it), would make the patch more generic and resilient and pheraps could work on cracked and trained too.

We could find the right memory block, the right variable, but mask out the already trained "NOP" function, or just select another memory block wich address the variable and that is untouched accross the original and trained versions.

But in the end the advantage for the person finding the trainer is that it just need to find the variable in memory (and so mask it in whatever place the variable is operated) instead of finding the exact place and function where the function operating the variable is.

I remember your initial requirement was to find a way to identify the variable address in a dynamic way (not with absolute address).