Cheat Engine

[Rubicon]

Hello All

i want to create an AOB script for witcher 2 for Unl Health

so i want to know if i'm doing everything in the right way, because i'm still in the early learning process

so i do all the usual find the address, realise it's only a visual address, (being that the health bar jumps up n down), find out what writes to it, and i get 2 Code Segments. one possibly being enemy health and the other player health.

so i try to trace back the instructions..per watching tut vids on YT..which he admits at the end of the video took him ages

[img]imgur*com/a/hKc1P[/img] [img]imgur*com/a/oftuE[/img]

so edi stores the health value, so going along with the tutorial i search for references to edi before the mov instruction??

which says i should investigate the call above and keep on going like that?

so i break and trace on the call above the mov instruction.

[img]imgur*com/a/tlwmN[/img]

and see that edi gets pushed to the stack
then it's Zeros edi
then it compares esp+1c which stores the health value to edi

[img]imgur*com/a/AzFY7[/img]

and then i'm not sure if it makes the jump or not for the next instruction

CF Flag becomes 1, ZF flag stays 0

so does it make the jump?

if so to which we land here..

[img]imgur*com/a/m9DlV[/img]

with a test instruction, which from what i see just sets Flags

then pop edi from the stack and that's as far as i've got upto now..

anyone who can help me with this it would be much appreciated

edit, dam these url restrictions...

[sbryzl]

You need to trace further back and the value won't necessarily be in the edi register if it is pushed and popped. You have to follow where it goes on the stack and use the stack pointers to figure out where your current function was called from. Use the secondary description in the stack view to find return points from the current function. Return points will look like Witcher2.exe+number.

You need to find where your value was loaded from a memory address. It will look like mov edi,[something or other]. And 'something or other' should not be esp or ebp because those are stack pointers and are just another way of transporting the value if it's not held in the registers.