Function Calling Assistant

NFCTools is a Lua-based utility plugin for Cheat Engine that provides a graphical interface for calling functions in a running process. It supports both x64 (Win64 calling convention) and x32 architectures, offering advanced memory monitoring and snapshotting capabilities.

Features

1. Function Calling Assistant (x64 & x32)

• Direct Execution: Execute functions at specific memory addresses with custom register and stack-argument values.

• Calling Conventions:

• x64: Uses the standard Win64 calling convention (RCX, RDX, R8, R9, and stack arguments).

• x32: Supports standard 32-bit function calls.

• Thread Management: Run functions in a new thread, with an option to force the thread to terminate via ExitThread() immediately after the call.

• Breakpoint Loading: While the debugger is paused at a breakpoint, use the Load Current button to automatically pull the current register and stack values into the assistant.

2. Memory Change Monitor

• Real-time Monitoring: Periodically hashes and reads memory at the addresses pointed to by registers to detect changes.

• Visual Status Indicators:

• OK (Green): Memory matches the baseline.

• CHANGED (Red): Memory has diverged from the baseline (e.g., after replaying a function call).

• ? (Gray): The memory region is unreadable.

• Configurable Check Size: Customize the number of bytes (up to 1,048,576) to monitor the pointers.

3. Baseline Snapshotting (v1.4)

• Cheat Table Integration: Capture a "baseline" snapshot of memory before it changes and automatically generate an Auto Assembler script.
• Persistent Data: The tool allocates memory and pre-fills it with your snapshot data, adding it directly to your Cheat Table as a new record.

Installation

1. Navigate to your autorun directory in Cheat Engine (e.g. etc...\Cheat Engine 7.6.6\autorun).
2. Paste the NFCTools.lua file into the directory.
3. Run Cheat Engine
4. A new NFCTools menu will appear in the Cheat Engine Memory Viewer window.

Usage

1. Navigate to the Memory Viewer in Cheat Engine.
2. Open the NFCTools menu and select either the x64bit or x32bit Function Calling Assistant.
3. Place a breakpoint on the start of any function and click Load Current to fill in register values.
4. Enable Monitor pointer changes to track if memory structs have been modified.
5. Click Call Function to execute the function.

Version History

• v1.4: Added "Add Copy to Cheat Table" feature, allowing users to snapshot baseline bytes into new memory records via Auto Assembler scripts.
• v1.3: Introduced Memory Change Monitoring to flag when buffers pointed to by registers change after a call.