Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25794 Location: The netherlands
|
Posted: Mon Aug 18, 2014 11:29 am Post subject: |
|
|
The tutorial says to use find what writes for the first one, not access
Anyhow, notice the text at the bottom of the Extra info window:"registers shown here are AFTER the instruction has been executed"
mov eax,[eax] will write the value stored at the address eax points to into eax. That means the original address of eax is gone.
Luckily you can use basic logic to figure out the original value
First of, you can read this instruction as mov eax,[eax+0]
This means an offset of 0
Now, the basic math, you know that the address this instruction read is 1efbc8
So, that means 1efbc8-0=1efbc8.
So, eax was 1efbc8
So do an hexadecimal value scan for 1efbc8
Tip: the address with that value is tutorial-i386.exe+245360 (00645360)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|