Cheat Engine

[Zanko]

Hi, is it possible to know where the .data section start exactly?

In the attached you can see that I navigated to corresponding section of byte array, one in disassembled view and another one in memory region view.
http://prnt.sc/bo5ld5

1 ) I know for sure that those byte represent character structure, HP, MP etc. So what does the dissembled view tell us? What are those corresponding instruction? Does cheat engine just simply try to translate the OP code even though those op code might not be executed?

[Dark Byte]

you could try parsing the PE header which is likely at ffx.exe+200

the disassembler view just interprets data as it sees it, it doesn't care if it's executable or not (data can contain jit'ed or decoded code)

also, not all code in .text is valid code. it also contains class tables and other data

[Zanko]

Thank you for answering!

Out of curiosity, does that mean sometimes assembly instruction is wrong? For example what if the byte array is like this

00 01 02 03 04 05 06 07 08 09

What if the first 3 byte are instruction 00 01 02
the next two by is data 03 04
and the rest is instruction 05 06 07 08 09

Since cheat engine intepret data as it sees it, does that mean it possible that cheat engine thinks that

first 3 byte is instruction 00 01 02
next 3 byte is instruction 03 04 05
and the rest is instruction 06 07 08 09

what would happen in this case? The real instruction is "splitted" unintentionally. Is this possible?

[Dark Byte]

it is possible
e.g:

[Zanko]

Hi, this is very interesting! If I may asked, obviously it is very difficult to spot this kind of error given that there are millons of instruction. If i was debugging arond 52th millions instruction, how can I be sure that the previous 52 millions instruction is reliably interpreted?

[Dark Byte]

you don't
but you can get a valid instruction point from eip when debugging, which will align you properly

also, if you get experienced in reading disassembly, you'll quickly recognize when the code is wrong