Cheat Engine

[muse4665]

I'm trying to understand how cheat engine calculates the jmp 7FF6DA550000 opcode from E9 E9DBBBFF bytecode.

The start of the jmp instuction is at 7ff6da992412

The closest I've been able to get calculating the address it will jump to is

(7ff6da992412 + 5) + FFBBDBE9 = 7FF7DA550000

FFBBDBE9 in the swapped endian of E9DBBBFF.

7FF[7]DA550000 is almost right except the 7 in brackets should be a 6.

Any clues on where to go from here or how you would calculate the absolute jmp address from the instruction location and relative offset

[TheyCallMeTim13]

For x64 addresses in instructions use an offset and the next instruction's address, so 0xE9DBBBFF + game.exe+432417 = 0x7FF6DA550000.

[FreeER]

(7ff6da992412 + 5) + FFBBDBE9 = 7FF7DA550000
FFBBDBE9 as a signed 4 byte value is negative though because it's greater than 7FFFFFFF, -4465687 in decimal, positive 4465687 = 0x00442417

(7ff6da992412 + 5) - 00442417 = 7FF6DA550000

[muse4665]