 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
lmfinley
How do I cheat?
![]() Reputation: 0
Joined: 31 Mar 2016
Posts: 6
|
 Posted: Tue Apr 05, 2016 1:18 am Post subject: Stuck on the meaning of this code line - what does it mean? |
 |
|
Hi, so I was looking at some values in a game. And ive been stuck on this value for a week now. I simply cant understand what it means, can anyone help me?
The address im interested in is:
072905F9 - mov eax, [ebx+00000170]
As far as I understand it to be, it is copying the value of [ebx+00000170] to eax. As you can see in the picture, eax is 23 whereas ebx is 50. So how exactly does it work that 50+170 > 23??
| Description: |
|
| Filesize: |
39.48 KB |
| Viewed: |
5072 Time(s) |
|
|
|
| Back to top |
|
 |
Redouane
Master Cheater
![]() Reputation: 3
Joined: 05 Sep 2013
Posts: 363
Location: Algeria
|
| Posted: Tue Apr 05, 2016 4:49 am Post subject: Re: Stuck on the meaning of this code line - what does it me |
|
|
| lmfinley wrote: | Hi, so I was looking at some values in a game. And ive been stuck on this value for a week now. I simply cant understand what it means, can anyone help me?
The address im interested in is:
072905F9 - mov eax, [ebx+00000170]
As far as I understand it to be, it is copying the value of [ebx+00000170] to eax. As you can see in the picture, eax is 23 whereas ebx is 50. So how exactly does it work that 50+170 > 23?? |
EBX = 0x0D8430D0
EBX + 0x170 = 0x0D843240
mov eax,[ebx + 170] will be mov eax,[0D843240]
It will overwrite the previous value of eax (0x23) with the value at address 0D843240 (check it out in the memory viewer).
|
|
| Back to top |
|
|
lmfinley
How do I cheat?
![]() Reputation: 0
Joined: 31 Mar 2016
Posts: 6
|
| Posted: Tue Apr 05, 2016 12:44 pm Post subject: |
|
|
hmm, I went and look at the address like you suggested. It pointed me to a fixed value of 20. But the value of eax changes with every hit. I tried re-tracing to see whether the pointer changes with every hit, but no, it stays the same. It copies the value of 20 every round to eax but eax is never 20.
any idea why that is? thanks in advance
|
|
| Back to top |
|
|
Redouane
Master Cheater
![]() Reputation: 3
Joined: 05 Sep 2013
Posts: 363
Location: Algeria
|
| Posted: Tue Apr 05, 2016 5:01 pm Post subject: |
|
|
| lmfinley wrote: | hmm, I went and look at the address like you suggested. It pointed me to a fixed value of 20. But the value of eax changes with every hit. I tried re-tracing to see whether the pointer changes with every hit, but no, it stays the same. It copies the value of 20 every round to eax but eax is never 20.
any idea why that is? thanks in advance |
Seeing your code, that instruction shouldn't move 20 to eax, it moves 4 bytes of data, not a single byte, for example, if you find this in the memory browser:
0D843240 -> 20 C8 45 0E XX XX XX ...
then mov eax,[0D843240] will move 0E45C820 to eax, because the 4 bytes at 0D843240 represent that value (0x0E45C820).
(then it tests if eax is 0 to prevent a (mov ecx,[8]) which would most likely crash the program)
|
|
| Back to top |
|
|
lmfinley
How do I cheat?
![]() Reputation: 0
Joined: 31 Mar 2016
Posts: 6
|
| Posted: Wed Apr 06, 2016 3:56 am Post subject: |
|
|
I must thank you for the replies, it has been helpful in furthering my understanding of the codes.
however, I am stumbled once again when I view the 4bytes code. as it gives a value like 230799392 in decimal or, 0DC1B820 in hex. And if I go to that address, it points to a value like 66DDF450, and if I go to that address, it points to a base address (its in green color, so I assume its the base) of 66666FB0.
so, mov eax, [ebx+00000170] essentially is 66667120. I am still puzzled as to how the value in eax is always 000000xx, where xx = numbers.
is there some place else that is affecting the value at the address that I need to find?
|
|
| Back to top |
|
|
Redouane
Master Cheater
![]() Reputation: 3
Joined: 05 Sep 2013
Posts: 363
Location: Algeria
|
| Posted: Thu Apr 07, 2016 3:18 am Post subject: |
|
|
| lmfinley wrote: | I must thank you for the replies, it has been helpful in furthering my understanding of the codes.
however, I am stumbled once again when I view the 4bytes code. as it gives a value like 230799392 in decimal or, 0DC1B820 in hex. And if I go to that address, it points to a value like 66DDF450, and if I go to that address, it points to a base address (its in green color, so I assume its the base) of 66666FB0.
so, mov eax, [ebx+00000170] essentially is 66667120. I am still puzzled as to how the value in eax is always 000000xx, where xx = numbers.
is there some place else that is affecting the value at the address that I need to find? |
Provided that the application does not crash, the value of eax isn't of the form 000000xx (it's used as a pointer, it then checks if it's 0).
Choose the next instruction (test eax,eax), and check the value of eax, on breakpoints, registers are only logged before the execution of the instruction that EIP points to.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
