Cheat Engine

t2kien · How do I cheat? Reputation: 0 Joined: 09 Feb 2012 Posts: 2

First of all, i use CE to search memory my application on windows xp sp2.everything is fine when i found the constant address 0x02533838 in the code

Dark Byte · Posted: Thu Feb 09, 2012 3:37 am Post subject:

windows xp doesn't do module relocation often while vista and later do it more (relocating a module also causes some instructions to be rewritten with help of the relocation table inside the pe header)

anyhow, check the address that instruction is at and see if it's inside a module. If so, you can do a modulename+offset notation to find that code instead of an aob.

alternatively, as you might have noticed, the last 5 digits are always the same, so you can do an aob scan for 8b 35 38 38 ** **

t2kien · How do I cheat? Reputation: 0 Joined: 09 Feb 2012 Posts: 2

Thanks for your tips. As you mentioned, I will do the following steps:
- Inject code into target process;
- Do some aobscan (8b 35 38 38 ?? ??)
- Looking for pointer in the opcodes i got from aobscan result

And with your first suggestion: do modulename+offset notation. I currently dont know how to do it in c++. I need to search more for this method

please fix me if i am wrong!