Skyrim RE · routing layer

The Address Chain

You want to call a function inside SkyrimSE.exe. It exports nothing. So every problem in this project reduces to one question: what is its address, and how much do I trust the answer?

Four artifacts, one loop

Each holds a different piece. None holds all of it. Click one to see what it gives you and what it still owes you.

Which tool

Pick what you already have, then what you need. The tool falls out of the pair.

I have

I want

Pick one from each column.

The trap, with real numbers

An id is a row number, not an identity. Nothing validates that row n means the same function in both tables. Same id, two tables — flip it.

id 406154

The confidence ladder

Each step down is slower and more certain. Go top-down. Stop as soon as you have enough — and go one lower exactly when being wrong would be expensive.

A hit at the top ends the chain instantly. An absence at the top is also information: nobody ever verified this one, so everything below is unverified territory.

An id is a coordinate, not an identity.

Names come from CommonLib (few, human-checked) or Ghidra (many, machine-guessed). Addresses come from Address Library. Meaning comes only from reading instructions. Truth comes only from the running process.

Resolving cleanly proves the id exists, never that it is what the finding claims.