Cheat Engine

[qrfl]

In cheat engine, when you create a codecave it overwrites memory with a jump, then it asks if we want the rest of the memory filled with nops.

How is this calculated?

I mean for example 0xE9 is JMP , however it doesnt necessarily mean is the beggining of an instruction, you could have.

E8 0066E912 where E8 is MOV and there is an E9 in the value that is not a JMP


thank you in advanced.

[hhhuut]

CE always replaces the first byte of the selected instruction with the "E9" jump byte, followed by four bytes which specify the address to jump to.

[Zanzer]

Assembly has specific bytes that represent specific instructions.
There are a limited number of possibilities and each instruction has a set length.
If the first byte is one thing, the processor knows what to expect in the next byte, and so on.
It then interprets those bytes into their corresponding instruction.
After executing the instruction, the processor moves on to the next byte.
It's as simple as that.

CE is disassembling the bytes to identify the instruction length.
It then knows that a JMP instruction takes up 5 bytes.
So it overwrites entire instructions until it covers those 5 bytes.
Any bytes beyond those 5 that are overwritten are converted into NOPs.

[qrfl]

[Zanzer]

http://forum.cheatengine.org/viewtopic.php?t=587413