Cheat Engine

[[email protected]]

I can't find the 2nd pointer level in the tutorial for some reason, I must be doing something really stupid.
The steps I took:

1) I find the address of the value (396), address = 016F4F40
2) Find out what writes to it, change value, get 016F4F28 with offset 18
3) Do a hex scan for value 016F4F28, get address 0166D518
4) Add address manually, tick pointer with offset 18.

So far so good, the pointer is pointing to the correct value (396)

5) I right click on pointer and do find out what access this address / find out what accesses this pointer
6) change value, get two entries, one is a copy, one is a compare, I go for the copy:

Results:
Probable base pointer =016F4F28

[Dark Byte]

when you did find what accesses on 0166D518 you should have received two addresses. (click on change value)

00425B1A - 83 3E 00 - cmp dword ptr [esi],00
and
00425B1F - 8B 36 - mov esi,[esi]

I recommend the first one, as the second one will mess up the value of ESI as the state you see is after it got executed (not that it matters much, as you know that esi was 0166D518 )

anyhow, the offset is 0, so the base address is 0166D518-0 = 0166D518
so do a hexadecimal value scan for 0166D518

[[email protected]]

Thanks, I thought I had tried that. Also I'm sure I read somewhere that you should always try an entry that does copy rather than compare.