The Mental Model

Everything in SKSE reverse engineering reduces to one question: “where is the thing I want, and how do I talk to it?” There are four kinds of “address” and one verification habit. Learn those and the rest is tooling.

1. A building with no street signs

SkyrimSE.exe is a compiled binary. Every function and data structure is in there, but the names were stripped at compile time. So each function is just an address, like an apartment with no nameplate, only a unit number measured from the front door.

All of RE is about putting nameplates back on, and then knocking on the right door. When Bethesda ships a new version (SE 1.5.97 → AE 1.6.1170) they recompile, and every apartment moves. The same tenant now lives at a different unit number. That single fact is the source of almost every dual-build bug.

2. The four kinds of “address”

These are the entire vocabulary. Click nothing here, just absorb the four.

3. How they chain together

One hook is a walk through all four. Click each step to expand. This is the real chain for the hook that crashed.

The one-line summary: ID → RVA → detour → struct offset → vtable call. Every hook is some path through that. The “Invoke” functions are just the engine’s bridges from C++ into the Flash UI, addressed by ID, then dispatching by vtable.

4. Failure modes — why bugs hide

The thread through all four kinds: none of these errors throw a clean “not found.” A wrong id, wrong offset, or wrong slot returns plausible-looking garbage that crashes later, somewhere else. That is why static decompiles are never enough.

5. Worked example — our actual SE crash

The whole port reduced to spotting this in a crash log. Here is the trace from symptom to fix.

The crash

; access violation, rcx = 0x28 (near-null)
SkyrimSE.exe+0ECA173  mov rdx, [rcx]          ; deref a near-null GFxValue
SKSE_CustomMapMarkers.dll  GFxValue::GetMember("MarkerDescriptionObj")
SKSE_CustomMapMarkers.dll  HoverImageRenderer::SampleCardState(MapMenu*)
SkyrimSE.exe  ... 53115 / 53204   ; these are SAVE-LOAD / VM funcs!
; RSP objects: BGSSaveLoadManager, LoadRequest, "VM is freezing..."

[SE-PROBE] MapMenu base =
  0x7ff66d747e80

The fix

// before — AE id used on both builds
REL::Relocation<std::uintptr_t> target{ REL::ID(53111) };

// after — same logical fn, addressed per version
REL::Relocation<std::uintptr_t> target{ REL::RelocationID(52224, 53111) };

How each SE twin was then confirmed (not guessed)

For every id, the SE candidate was read and checked against what the real function must contain — the verify habit in action:

Same-on-both ids do exist (ScreenToWorldRay 70630, Compass 51668/51744) — but you only know that by checking, never by assuming.

6. What a detour actually does, byte by byte

“We hook the function” hides a small surgery. PolyHook overwrites the first few bytes of the target with a jump to our code, and saves the bytes it clobbered into a trampoline so the original can still run. Step through it.

Why a trampoline exists: writing the jump destroys the first instructions of the original. The trampoline holds a working copy of those bytes plus a jump back into the rest of the function, so our hook can still run the real engine code (this is how every g_trampoline(...) call in our hooks works). Why the first bytes only: a 64-bit jump needs ~12–14 bytes; PolyHook disassembles whole instructions so it never cuts one in half (that’s what the “Capstone disassembler” in each Install() is for).

7. The C++ → Flash bridge (the “Invoke” functions)

The map UI is a Flash movie (Scaleform). Our hooks live in C++. The two Invoke functions are the doorways between those worlds — that’s all they are. Click each layer to see what it’s for.

The key insight: the bridge is crossed by method name, a string, not a function address. That’s why "SetSelectedMarker" is itself an Address Library entry (270681216427): we resolve the string’s address so our detour can pointer-compare the name being invoked and act only on the one we care about. The crossing itself is a vtable dispatch (CALL [RAX+0xE0]) — addressing kind ④ from section 2, doing real work here.

8. The verify-live checklist

Keep this open while doing RE. For every hook, after resolving the id, ask: does the function / field / slot this resolves to actually look like what I expect, on this specific version?