When building the game, I have the C compiler to preprocess my source to a single file. This is "parsed" by a python script, which mainly just detects structs and their members. This is not very expandable, and I'm planning to copy a parser from my other project so that I can also support function signature reflection.

After scanning the whole source, the script writes a C file, where every struct has a corresponding global variable named like "MyStruct_rtti", and those are initialized according to the scanned values. This file is compiled with the game. At runtime I then use OS symbol querying functions (GetProcAddress, dlsym) to find information about the struct I want. (The last part could be done without symbol queries if you generated the type info e.g. to some tree structure.)

With this info about struct member count, member type names, pointer depths, array depths etc. it's pretty easy to traverse the whole program state, at least if you have all of your state under a single struct, which can be used as a starting point for the traversing.