Cheat Engine

Slugsnack · Posted: Mon Sep 17, 2007 3:42 pm Post subject: A few questions

Been wondering some of these for a long time.

1) Why are values in Flash applets stored 8 times their value in memory than you would expect ? ie. if a certain variable, let's say time was 2 seconds. The value stored in memory would be 16. Why is it multiplied by 8 ? I assume it's the way Flash "executes" the ActionScript but I'd like to know for sure if possible.

2) What is the memory type "double" in Cheat Engine ? I understand if a address is of type "1 byte" then it can hold 2^8 = 256 different values but what does "double" mean ? A dword/2 words/32 bits can hold 4294967296 different values, haven't tested whether "double" can take all those yet.

3) I was reading up on some basic reversing recently and came across the term memory segment involving memory pointers. Is that the same as the "base address" you find in CE when finding pointers ?

4) Again whilst I was reading about reversing, I started extending my knowledge a little on registers. I had previously understood the general concept.. move stuff into registers for operating for faster access times, etc. but then I came across 32, 16 and 8 bit registers. Got a little confused at this point. So let's take for example a 32 bit register, EAX. Now then would I be correct in saying that within that there is 16 bits which are allocated another name ? Otherwise it would be nice if someone could explain how the 16 bit register relates to the 32 bit one relatively. Then reading on some more I read about 8 bit registers. I "think" I kind of understand this. Would I be right in saying that the 16 bit register contains a "higher" and "lower" part (AH and AL) ? Therefore changing the what is stored in either would change what is stored in AX and therefore EAX ?

I expect I've got something very, very wrong along the way but what I've learnt has been all information I had to search for. I'm really looking for someone here who can help me out so I can start moving on by getting to grips with the basics well. Yes, I've already looked on google. I'm mostly looking for clarification for these points but any extra info. would be awesome.

appalsap · Posted: Mon Sep 17, 2007 3:48 pm Post subject:

2) "double" is an 8 byte floating point type
4) yes

atom0s · Posted: Mon Sep 17, 2007 5:10 pm Post subject:

1.) This is only in Flash 9 from what I recall. (Maybe 8, not sure.) My guess is to prevent hacking / and such or something to do with x64 systems. Dunno.

2.) As appal said, 8 byte float value.

3.) Not sure what it was that you read to refer to, but, pointers are addresses that point to another block of memory. Usually used while a game uses code shifting or DMA. You usually need to find the base address of the memory block the pointer is found out to make a cheat.

Base + Offset = Address
Address - Base = Offset

And so on.

4.) I have a few ASM tutorials that someone posted a while back on another site that I kept somewhere, when I find em I'll upload them for ya.

Edit:: Ok found them here ya go:

http://home.comcast.net/~wiccaan/downloads/asm/asmd1.txt
http://home.comcast.net/~wiccaan/downloads/asm/asmd2.txt
http://home.comcast.net/~wiccaan/downloads/asm/asmd3.txt

Slugsnack · Posted: Tue Sep 18, 2007 8:59 am Post subject:

kittonkicker · Posted: Tue Sep 18, 2007 10:43 am Post subject:

appalsap · Posted: Tue Sep 18, 2007 11:36 am Post subject:

atom0s · Posted: Tue Sep 18, 2007 11:43 am Post subject:

Slugsnack · Posted: Tue Sep 18, 2007 12:19 pm Post subject:

appalsap · Posted: Tue Sep 18, 2007 12:35 pm Post subject:

Slugsnack · Posted: Tue Sep 18, 2007 12:49 pm Post subject:

Wouldn't an integer over 4294967296 exceed 4 bytes ? By the way thanks for the quick replies. I'm learning a lot today Smile

Repped ya

appalsap · Posted: Tue Sep 18, 2007 12:56 pm Post subject:

yes, that is what the "long long" type is for.

atom0s · Posted: Tue Sep 18, 2007 1:41 pm Post subject:

Slugsnack · Posted: Tue Sep 18, 2007 1:42 pm Post subject:

Haven't noticed one called "long long" Surprised

Guess I'll keep an eye out next time.

Just a few of the unanswered questions in case you missed them or anyone else would like to answer them:

atom0s · Posted: Tue Sep 18, 2007 1:46 pm Post subject:

The parts of the registers:

eax (ax/ah/al) Accumulator
ebx (bx/bh/bl) Base
ecx (cx/ch/cl) Counter
edx (dx/dh/dl) Data

Binary-coded Decimals:
http://en.wikipedia.org/wiki/Binary_coded_decimal

Slugsnack · Posted: Tue Sep 18, 2007 1:55 pm Post subject:

I learnt these 9 32 bit (4 byte) registers:
EAX: Extended Accumulator Register
EBX: Extended Base Register
ECX: Extended Counter Register
EDX: Extended Data Register
ESI: Extended Source Index
EDI: Extended Destination Index
EBP: Extended Base Pointer
ESP: Extended Stack Pointer
EIP: Extended Instruction Pointer

Then these 16 bit (2 byte) ones:
AX
BX
CX
DX
SI
DI
BP
SP
IP

Then the first 4 are split into their high and low part (byte).

My understanding of it is that for the first four registers, the whole thing is called for example, EAX. Then half of that (how do we know which half btw ?) is called AX then the AX is split into two halves, AL and AH. I'm confused as to why they are given different names at all. They seem to be sometimes treated as separate registers. Also if EAX is split into two halves of which one is AX, then what is the other half called ?

Thanks for the link, was just what I was looking for.