Home

Pointer Finder 2.0 User Guide & Tutorial

Welcome to the official guide for Pointer Finder 2.0, a high-performance memory scanning tool designed for finding stable pointer paths in emulated games. This guide will walk you through the entire process, from setting up to finding your first valid pointer.

Table of Contents

1. Introduction
2. Prerequisites
3. Tutorial: Finding a Pointer Path (NDS Example)
   • Step 1: Attaching to the Emulator
   • Step 2: Finding Your Initial Target Address
   • Step 3: Performing the First Scan
   • Step 4: Refining the Results
   • Step 5: Filtering for Stable Paths
   • Step 6: Using Your Pointer Path
4. Deep Dive: Understanding the Static Address Range
5. Reference: Common Memory Layouts
6. Troubleshooting & FAQ

---

✨ Introduction

Pointer Finder 2.0 helps you find a stable, static memory address that "points" to a dynamic value in a game, such as a player's health, ammo, or score. This is essential for game hacking and creating achievements for platforms like RetroAchievements, as it allows you to track a value even when its location in memory changes.

✅ Prerequisites

Before you begin, you will need:

• A supported emulator (e.g., RALibretro v1.8.1, PCSX2 Nightly, DuckStation) with a game running.
• Basic knowledge of how to use your emulator's built-in memory viewer/debugger to find the current value of what you want to track.
• Pointer Finder 2.0 running on your system.

🚀 Tutorial: Finding a Pointer Path (NDS Example)

In this tutorial, we will find a stable pointer path for the Health in Crash of the Titans on the Nintendo DS, using RALibretro v1.8.1 with the DeSmuME core.

Step 1: Attaching to the Emulator

1. Launch RALibretro and load your game.
2. Open *PointerFinder2.exe.
3. Go to File -> Attach to Emulator....
4. The tool will automatically detect the running RALibretro.exe process and attach to it. If multiple emulators are running, a selection dialog will appear.

(Image: Pointer Finder 2.0 main window showing "Status: Attached to RALibretro (NDS)")

Step 2: Finding Your Initial Target Address

Before we can find a pointer path, we need to know where the health variable is right now.

1. In RALibretro, open the Memory Inspector.
2. Search for your current health state.
3. In our example, we find the health is at address 0x002cabf4. This is our first Target Address.

(Image: RALibretro's Memory Inspector showing the address 0x002cabf4 with a 32bit value of 0x00064000)

Step 3: Performing the First Scan

1. In Pointer Finder 2.0, click the New Pointer Scan button.
2. The Scan Options window will appear.
3. In the Target Address (NDS, Hex) box, enter the address you found: 0x002cabf4. Keep in mind that Pointer Finder 2.0 knows to add the 02 prefix for NDS RAM.
4. Leave the other settings at their defaults for now and click OK.

Important

The NDS has a somewhat ambiguous static memory range, making it difficult to pinpoint the exact location for your game's static memory. However, you can simplify this by enabling the Use Visual Range Selector checkbox. Once activated, the Static Range textboxes will convert into a slider. You can click and drag the blue slider within the 4MB block of the NDS memory where you believe the static range resides. The slider will move in 1MB increments, but if you need more precision, you can hold Ctrl while clicking and dragging the slider to fine-tune the position. I suggest to start between a range of 0x00100000 - 0x001FFFFF this is your starting point.

(Image: Pointer Finder 2.0 results grid filled with potential pointer paths of initial results.)

Step 4: Refining the Results

This is the most critical step. We need to narrow down the results to only the paths that correctly track the health state as it changes.

1. Go back to the game and load a save-state, different level, etc.
2. In Pointer Finder 2.0, click the Refine with New Scan button.
3. In the Scan Options window, enter the new target address: 0x002c04c4. Click OK.

Pointer Finder 2.0 will perform a second scan and show you only the pointer paths that were present in both the first and second scan. The number of results should drop dramatically.

(Image: Pointer Finder 2.0 results grid showing a much smaller number of results after refining.)

Pro Tip: You may need to repeat this step 2-3 times (e.g., die and restart the level) to get the result list down to a manageable number (ideally under 50).

Step 5: Filtering for Stable Paths

Even after refining, some paths might be temporary coincidences. The filter helps us find paths that are stable over time.

1. With your refined list of results, click the Filter Dynamic Paths button.
2. The UI will change to "Filtering..." mode. The application is now continuously re-checking every path in the list in the background. If a path breaks (i.e., it no longer points to your target address), it's removed from the list.
3. Go back to the game and trigger a loading screen or a major state change (e.g., enter a pipe, finish the level). This is when unstable pointers are most likely to break.
4. Watch the results count in Pointer Finder 2.0, you may see it drop as unstable paths are filtered out. Let this run for 15-30 seconds.
5. Click Stop Filtering.

The paths that remain are very likely to be stable and reliable.

Step 6: Using Your Pointer Path

You now have a reliable pointer path!

1. Right-click on one of the remaining paths in the results grid.
2. Select Copy as RetroAchievements Format.
3. Paste the result into your text editor or the RetroAchievements achievement editor. It will look something like this: I:0xW14A808_I:0xW14_I:0xW8_I:0xWd4_0xW0=1 This code can now be used to reliably read the health, no matter where it moves in memory!

(Image: Showcase of the right-click context menu on a result row.)

---

🔬 Deep Dive: Understanding the Static Address Range

One of the most important settings in the Scan Options is the Static Base Address Range. Understanding this will make your scans faster and more accurate.

What is a Static Address?

• Dynamic Memory: This is where game objects are created and destroyed during gameplay (e.g., enemies, items, player character data). Addresses here are temporary.
• Static Memory: This is part of the game's core code and data that is loaded into a fixed, unchanging location in memory when the game starts.

A reliable pointer path must start from a static address. The Static Base Address Range tells Pointer Finder 2.0 where to look for these starting points.

Why is the Range Important?

This range acts as a boundary for the pointer search. When the scanner is working backward from your target, as soon as it finds a pointer that comes from an address within this range, it considers the path complete and stops searching.

• Too Wide: If the range is too large and includes dynamic memory, you will get many false-positive paths that will break later.
• Too Narrow: If the range is too small and excludes the area where the game keeps its static pointers, you might find no results at all.

How to Set the Range

Pointer Finder 2.0 provides excellent defaults for each supported system. However, you can fine-tune it based on your game, just make sure the range is 1MB apart for better accuracy and change that when possible (PS2 e.g. 0x00400000 - 0x004FFFFF).

Manual Textbox Entry

For most systems, you can directly enter the start and end of the range you want to scan. You can find memory maps online to determine the best range for your specific game.

Visual Range Selector (NDS)

For NDS, Pointer Finder 2.0 offers a visual slider to set the range.

• Enable: Check the Use Visual Range Selector box.
• Adjust:
  • Drag the left and right thumbs to adjust the start and end points.
  • Click and drag the blue bar in the middle to move the entire range window.
• Reset: Ctrl-Double-Click the slider to reset it to the recommended default range for the system.

(Image: Showcase from the Scanner Options form highlighting the Visual Range Selector for NDS.)

Tip

1. Start with a Low Max Level (1)
   Begin by setting the max search level to 1. If you get results, refine the search based on those findings. If those results are useful, you've likely found the correct path. If not, increase the max level and continue refining.
2. Max Offset is Crucial
   The default max offset is 0xFFF. A larger offset range will give more results. Combining this with a higher max level increases the search space. Some games may have very large offset ranges, so setting the max offset to 0xFFFF is possible, but expect a massive number of results.
3. Balancing Levels and Offsets
   For manageable results: Set the max level to 3 and max offset to 0xFFF. This will generate around 400k results.
   For larger result sets: Increasing the max level to 5 will exponentially increase the result count, especially if the max offset is set to 0xFFF.
4. CPU Power Matters
   The faster your CPU, the quicker it can handle larger pointer path searches. Keep in mind that higher levels and offsets will result in longer search times, so ensure your system is capable of handling extensive searches efficiently.
5. RAM Capacity Matters
   More available RAM will result in a larger number of search results. For instance, the tool can potentially yield up to 1 million results, but this comes at the cost of approximately 500MB+ of RAM usage. It's important to manage the max results setting to avoid overloading your system's memory, while still allowing you to find relevant pointer paths. The tool doesn't automatically release RAM, you may notice increased memory consumption during extensive searches. To address this, a "Restart Application" button has been added to the Settings window, offering a quick, one-click solution to safely restart the tool and free up memory.

---

🗺️ Reference: Common Memory Layouts

Knowing the memory layout of the console you are working with is key to setting an effective static range. Here is an example for the original PlayStation.

Common PS1 Memory Layout

Address Range	Usage	Recommended Static Range?
0x80000000–0x8000FFFF	Kernel, System Libraries, BIOS data
0x80010000–0x8007FFFF	Main Game Code & Static Data	✅ Yes
0x80080000–0x801FFFFF	Heap, Dynamic Data, Game Objects	❌ No

For most PS1 games, a static range of 10000-7FFFF is a very effective starting point.

---

❓ Troubleshooting & FAQ

• I can't attach to my emulator.

  • Ensure the emulator is running and a game is loaded past the title screen.
  • Try running Pointer Finder 2.0 as an Administrator.
  • For RALibretro, ensure you are running a 64-bit build of Pointer Finder 2.0 and have a supported NDS core loaded.

• My first scan finds 0 results.

  • Double-check that you entered the Target Address correctly.
  • In Scan Options, try increasing the Max Offset or Max Level.
  • Widen the Static Base Address Range.

• I have too many results, even after refining.

  • Refine more! Repeat Step 4 with different game states (e.g., after loading a new level).
  • Use the Filter Dynamic Paths feature for a longer period of time, and make sure to trigger loading screens or other major game state changes while it's running.

• The application seems slow or has crashed.

  • After many scans, application memory can become fragmented. Use the Restart Application button in the Settings window for a clean, state-preserving restart.