Mono:Mono Lua

The advanced MONO features of Cheat Engine are controlled by the "monoscript.lua" script in the autorun directory where cheat engine is installed. When you attach to a process, the script scans for "mono.dll". If it is found, the appropriate MonoDataDissector dll from the autorun directory is injected into the process which creates a named pipe waiting for a connection. The LUA code then connects to the pipe and messages are exchanged to perform the mono functions.

Main Methods

LaunchMonoDataCollector()

this is some

information

varType = monoTypeToVarType(monoType)

Returns the Cheat Engine type (vtString, vtByte, vtWorkd, vtDword, vtSingle, vtDouble, vtPointer) for the given mono type

result = LaunchMonoDataCollector()

injects the dll and returns 0 for failure, or monoBase returned from the CMD_INITMONO command on the pipe

mono_object_getClass(address)

returns classId, className of the class at the given address in memory

mono_enumDomains()

returns a table array of domainaddress for each domain in the game

mono_setCurrentDomain(domainId)

returns ? (result of MONOCMD_SETCURRENTDOMAIN)

sets the domain the MonoDataCollector will use

mono_enumAssemblies()

returns table of assemblyId for each assembly in the current domain from the MonoDataCollector

mono_getImageFromAssembly(assemblyId)

returns the imageId for the passed assembly

mono_image_get_name(imageId)

returns the name of the assembly with the given imageId

mono_image_enumClasses(imageId)

returns a table of classId for classes in the given assembly image

mono_class_getName(classId)

returns the class name as a string

mono_class_getNamespace(classId)

returns the namespace of the given class as a string

mono_class_getParent(classId)

returns the classId of the parent class of the given class

mono_class_getStaticFieldAddress(domainId, classId)

returns the base address for a special area that stores static addresses for a given class. For example if you have a class that has 5 static fields, their offsets will be added to this base address to get the memory location

mono_class_enumFields(classId)

returns a table of field objects for fields in the given class

field - the field id

type - ?? the Cheat Engine type? (i.e. vtByte, vtWord, vtString, etc?)

monotype - ?? the mono type?

parent - ?? the class id?

offset - the offset in bytes from the structure base address

flags - ??

isStatic - true/false - if true, offset is into static address, use mono_class_getStaticFieldAddress

name - field name

typename - name of the type with namespace (i.e. "System.Int32")

mono_class_enumMethods(classId)

returns a table of method objects for the methods in the given class

method - method id

name - string name of the method

mono_getJitInfo(address)

returns a result object with the properties given the address of code in memory

method - the method id

code_start - address where method code begins

code_size - length of code in bytes

mono_image_findClass(imageId, namespace, className)

returns the classId of the given class name and namespace in an image

mono_findClass(namespace, className)

returns the classId of the given class name and namespace

mono_class_findMethod(classId, methodName)

returns the methodId of a certain method in a class

mono_findMethod(namespace, className, methodName)

returns the methodId of a certain method, calls mono_image_findClass and mono_class_findMethod

mono_method_getName(methodId)

returns the name of a method given the id

mono_method_getHeader(methodId)

returns a headerId??

mono_method_getSignature(methodId)

returns result, parameternames, returntype

result - ?? string

parameterNames - table of strings representing parameter names

returnType - string?? - mono type string?

mono_method_disassemble(methodId)

returns a string - ?? the IL code ??

mono_method_getClass(methodId)

returns the classId a method belongs in

mono_compile_method(methodId)

JIT a method if it wasn't compiled yet (??return value address of assembly??)

mono_free_method(methodId)

(no return value) - only works on dynamic method, and only if profiler isn't being used

mono_methodheader_getILCode(methodHeader)

returns address, size

address - address of start of IL code?

size - size of IL code?

mono_getILCodeFromMethod(methodId)

combination of mono_method_getHeader and mono_methodheader_getILCode

mono_iamge_rva_map(imageId, offset)

?? not sure what this is ??

mono_loadAssemblyFromFile(fname)

loads a c# assembly in the target process

mono_invoke_method('domain', 'method', 'object', 'args')

Lets you invoke a method with the given arguments. args is a tablearray of record with value and type

Cheat Engine Hooks

mono_initialize()

sets up hooks, calls old open process hook if there was one, calls syncrhonize("mono_OpenProcessMT")

mono_OpenProcessMT(t)

if parameter is not nil, calls t.destroy(), enumerates modules looking for 'mono.dll', adds menu item to cheat engine main form

mono_OpenProcess(processid)

mono_structureDissectOverrideCallback(structure, baseaddress)

Called by CE when a structure is being dissected to fill in the values if we know the structure

Returns true if the structure members were defined, nil if not

Calls mono_object_findRealStartOfObject(baseaddress), mono_class_enumFields(classaddress), monoTypeToVarType(monotype)

mono_structureNameLookupCallback(address)

Returns classname,currentaddress (the real base address) or nil

Called by CE when creating a new structure in the structure dissector

mono_symbolLookupCallback(symbol)

returns pointer or nil

called by CE when it is trying to find the address to go with a symbol

calls mono_findMethod and mono_compile_method

mono_addressLookupCallback(address)

returns string

called by CE in the disassembly window to show a symbol name for the address

calls mono_getJitInfo(address), mono_method_getClass(method), mono_class_GetName(class), mono_class_GetNamespace(class), mono_method_getName(method)

Mono Dissector Methods

monoform_killform(sender)

monoform_miShowILDisassemblyClick(sender)

monoform_miRejitClick(sender)

monoform_miGetILCodeClick(sender)

monoform_EnumImages(node)

monoform_EnumClasses(node)

monoform_EnumFields(node)

monoform_EnumMethods(node)

mono_TVExpanding(sender, node)

mono_TVCollapsing(sender, node)

monoform_FindDialogFind(sender)

monoform_miFindClick(sender)

monoform_miExpandAllClick(sender)

monoform_miSaveClick(sender)

mono_dissect()

miMonoActivateClick(sender)

miMonoDissectClick(sender)

Autoassembler Hooks

monoAA_USEMONO(parameters, syntaxcheckonly)

monoAA_FINDMONOMETHOD(parameters, syntaxcheckonly)

monoAA_GETMONOSTRUCT(parameters, syntaxcheckonly)

Cheat Engine Callbacks

• TODO: Move this secion
• Callbacks - have register and unregister methods. The register methods return an id that can be passed to the unregister methods.
  • registerSymbolLookupCallback
  • registerAddressLookupCallback
  • registerStructureNameLookup
  • registerStructureDissectOverride
  • registerFormAddNotification
  • registerAutoAssemblerCommand(command, function(parameters, syntaxcheckonly))

 Note: The callback function can return multiple values
 Nil, <String>: Will raise an error with the given string
 MultilineString: Replaces the line in the script with the given strings.

• • registerAutoAssemblerPrologue(function(script, syntaxcheck)) - maybe replace AA commands

Misc. Notes

TODO:

• https://github.com/mono/mono/tree/master/mono/dis
• mono_metadata_decode_row