FearLess Cheat Engine

Are there more methods to find timers besides searching and filtering unknown values and Ultimap?

To find or to stop without finding.

Maybe they use system time functions?

If you can stop/start the timer at will then you can search its countdown value.

The value isn't displayed, just visual effects. To start/stop - only with the game menu (the entire game stops).

^ I wouldn't know how to use Ultimap in that regard?! a short explanation on how to do thàt will be appreciated...

That said: many games tend to use their own routines/approaches for that. And even within the same game, they can use different routines altogether... Some examples:
> AC titles use a 30000 divider to get them milliseconds (I assume here that they use the game's "clock"-timer based on a 30 FPS). Fyi: a lot of work to find the right opcode here... !
> Watch Dogs: they use - if i recall well - 4/5/... different routines: in some cases, the best approach seemed to be to follow the 4-bytes (in secs) timer_value to research/find the actual float_value eventually
> Some games use double_values as well (can't recall in which game that was; but it is pretty rare in my encounters)
> Another approach: game initiates 2 values with timer_value difference; then one value in/decrements towards the other value (~ end_time)

Overall:
> timer is a float_value; and can either increment/decrement internally (while showing a GUI_value that might - or not - do the same in/decrement). Iow internally incrementing, while showing a decrementing value onscreen... (and vice versa)
> timer is a 4_byte value, usually in (milli)seconds. Or: it uses the system_time (~ Unix Epoch) as basis.

> major challenge: timer can be found "easily", but is managed via the stack... and its stack_address changes constantly (with each "tick")... Good luck with that one


tip: do mention the game you're tackling; some might be "familiar" with it...

The stack address can be pulled from register, mov'd to say r10, and then loaded into a global symbol and then used as a dynamic address. So as long as you read the assembly and see which register is loading your address you want (And assuming a bunch of addresses aren't being stuffed through there) then your fine also you can then make a conditional script in LUA to only apply the global symbol IF your value at that addreess == 8 for example


So a dynamic address that updates every (x)ms and that can have conditions based on the value populated too.