Cheat Engine

[Dr.Disrespect]

I am reading the "Introduction to x64" on the Intel website, and the RIP register got me confused.

This is the part on the website, which explains RIP:

[Zanzer]

RIP equals the address of the currently running instruction.
I know nothing about [RIP] pointing to the next instruction.
I guess that's just something the x64 processor understands.
You probably won't ever have the need to use RIP for a hack.

[Dr.Disrespect]

[predprey]

https://en.wikipedia.org/wiki/Program_counter

IP or instruction pointer denotes the address for the next instruction to be executed. It is automatically incremented after the instruction fetch stage of cpu pipelining. For x86, it is referenced by EIP while for x86_64 it is referenced by RIP.

You probably wouldn't use it for normal game hacking, but I have heard of people using it for evading online cheat detectors by manually setting a breakpoint and changing the instruction pointer to skip a few instructions instead of NOPping the few instructions. Apparently doing so can fool the cheat detection systems. You could also theoretically make a jmp by changing the instruction pointer.

[ParkourPenguin]

While you will rarely use the RIP register directly, RIP-relative addressing is a very common occurrence in any application. It allows you to address any memory location within 2GB of the next instruction. This is why you should specify a memory region when allocating memory in a 64-bit process: it allows CE to use a 5-byte jump instead of having to store the 8-byte memory location and jump to that instead (14-byte jump).

When it's necessary, CE's assembler will take care of it the majority of the time. You don't have to worry about it unless you're encoding instructions yourself.

[STN]

It just means the current instruction(RIP) will be used in calculation of the instruction. Just look at the jmp, movsd and other 64bit instructions, they use relative addressing instead of absolute positioning e.g (F2 0F10 35 D8466808 - movsd xmm6,[game.exe+94AB0F0]) ...its something like this
Destination address - current address - 8

You can control flow of execution with IP and as such it is useful in certain situations. In games with anti-cheats not allowing memory editing (codbo3, infinite warfare, mafia 2 etc), i've used it to redirect code execution to my cave, doing what i like without the game scanners ever being triggered!. But yeah, you won't use RIP much like other special purpose registers.

[mgr.inz.Player]

[Dr.Disrespect]

Thanks for all the replies, STN, Penguin and predprey. I have a general idea about RIP now.

I will come up with more questions if I need to deal with it in the future.

Thanks again, guys.

[STN]

[mgr.inz.Player]

uhm, nope.


For (R/E)IP relative addressing you have to keep in mind that CPU works like this:

[panraven]

These might be examples that knowing the offset (<...>) and where the offset is (address of beginning of <...>), can still not be determined where the target is:

[predprey]

[panraven]

reassemble is more a disassembler, since it read the address bytes and disassemble it as some text then put that text on the new address that the reassemble command located.

These may be example of rip addressing, http://www.agner.org/optimize/optimizing_assembly.pdf

[Dr.Disrespect]

Thanks for all the posts, guys. It's a bit complicated for me, need some time to digest.