Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Question about addresses...

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions
View previous topic :: View next topic  
Author Message
infiniteDreams83
How do I cheat?
Reputation: 0

Joined: 30 Oct 2017
Posts: 3

PostPosted: Mon Nov 13, 2017 3:19 am    Post subject: Question about addresses... Reply with quote

Messing with Halo 2 and need some 'pieces' of the puzzles rectified in my mind...

I found the address of the command that subtracts ammo from my battle rifle. It is "00C20173". The command is "SUB [300F6074 + 08], 1"

The thing about this address is that it is always the same through restarts -- but wait! I thought the whole idea here was that this address was suppose to change when I reloaded the game into memory again? Doesn't the OS load the program into a totally different physical memory local? What gives here?

From my understanding, this is a static address; but what is "static" in reference to? Is it "static" in reference to the entry point of the program? Further, if previous is true, does it mean the address "00C20173" itself is the actual offset from the entry point of the program? (i.e . "Halo2.exe" + 00C20173)?

I think may be mixing up "virtual addresses"... Are the addresses listed in CE in relation to virtual address space. I.e "00C20173" being the literal 'virtual' offset from the entry point of the program? If this is true, it would make much more sense...

Someone with more knowledge may be able to see the gap in my knowledge here... I don't think far off & am pretty close to wrapping my brain thus... hoping to patch up holes in my thinking.

Thnx Very Happy
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 20

Joined: 01 Feb 2016
Posts: 1586

PostPosted: Mon Nov 13, 2017 5:39 am    Post subject: Reply with quote

infiniteDreams83 wrote:
The thing about this address is that it is always the same through restarts -- but wait! I thought the whole idea here was that this address was suppose to change when I reloaded the game into memory again? Doesn't the OS load the program into a totally different physical memory local? What gives here?

if its static then it desnt have to change, and the OS doesnt load it into a different physical memory.
when launching the executable it kinda request a free block of memory in ram.

infiniteDreams83 wrote:
From my understanding, this is a static address; but what is "static" in reference to? Is it "static" in reference to the entry point of the program? Further, if previous is true, does it mean the address "00C20173" itself is the actual offset from the entry point of the program? (i.e . "Halo2.exe" + 00C20173)?

no its not from entry point.
from imageBase.

assuming 00C80000 is ImageBase which is "module.exe" without any offset.

then 00C80001 will be "module.exe"+1

you can find the image base from PEiD, you also can find the regions in CE (image,mapped,private...).

infiniteDreams83 wrote:
I think may be mixing up "virtual addresses"... Are the addresses listed in CE in relation to virtual address space. I.e "00C20173" being the literal 'virtual' offset from the entry point of the program? If this is true, it would make much more sense...

i know there must be something sensible, cuz i always search for something like this.
anyway here is couple quotes from stackoverflow:
stackoverflow wrote:
Physical addressing means that your program actually knows the real layout of RAM. When you access a variable at address 0x8746b3, that's where it's really stored in the physical RAM chips.

With virtual addressing, all application memory accesses go to a page table, which then maps from the virtual to the physical address. So every application has its own "private" address space, and no program can read or write to another program's memory. This is called segmentation.

https://stackoverflow.com/questions/3243610/difference-between-physical-addressing-and-virtual-addressing-concept
stackoverflow wrote:

Virtual address: The address you use in your programs, the address that your CPU use to fetch data, is not real and gets translated via MMU to some physical address; everyone has one and its size depends on your system(Linux running 32-bit has 4GB address space)

https://stackoverflow.com/questions/15851225/difference-between-physical-logical-virtual-memory-address

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote:
i am a sweetheart.
Back to top
View user's profile Send private message Visit poster's website
ParkourPenguin
I post too much
Reputation: 138

Joined: 06 Jul 2014
Posts: 4275

PostPosted: Mon Nov 13, 2017 10:39 am    Post subject: Reply with quote

infiniteDreams83 wrote:
I found the address of the command that subtracts ammo from my battle rifle. It is "00C20173". The command is "SUB [300F6074 + 08], 1"
There is no addressing mode that uses a disp32 and a disp8. It doesn't matter in this case, but don't mislead people in the future. Just copy and paste the instruction.

infiniteDreams83 wrote:
The thing about this address is that it is always the same through restarts -- but wait! I thought the whole idea here was that this address was suppose to change when I reloaded the game into memory again? Doesn't the OS load the program into a totally different physical memory local? What gives here?
I'm assuming that instruction is a part of an executable image. Images can control whether or not they're randomly loaded. Check the DllCharacteristics member in the IMAGE_OPTIONAL_HEADER structure to find this information. (Use CFF explorer to make it easier)


infiniteDreams83 wrote:
From my understanding, this is a static address; but what is "static" in reference to? Is it "static" in reference to the entry point of the program? Further, if previous is true, does it mean the address "00C20173" itself is the actual offset from the entry point of the program? (i.e . "Halo2.exe" + 00C20173)?
If a value is "static," it is stored in the view of an executable image. I'd assume that nomenclature was derived from the keyword "static" used in many programming languages in the declaration of names. Under typical implementations, the objects those names refer to are stored in the image itself.

infiniteDreams83 wrote:
I think may be mixing up "virtual addresses"... Are the addresses listed in CE in relation to virtual address space. I.e "00C20173" being the literal 'virtual' offset from the entry point of the program? If this is true, it would make much more sense...
I don't think you understand how memory is addressed.

There's a physical component of a computer called RAM that stores memory. Each byte in RAM has an address associated with it. This type of address is referred to as a physical address.

If all the software running on a computer had unrestricted access to RAM, it would be impossible to manage. It wouldn't be clear which memory belonged to which process, malicious software could easily run rampant, and a small bug in one software could seize up the whole system.

To avoid this, the operating system takes control over memory management. Each process running on the computer gets its own virtual address space: its own unique view of memory. Each value belonging to a process is still stored in RAM (assuming it hasn't been paged out, but that's another story); however, the process does not use the value's physical address to access it. The process uses the a virtual address that refers to where the value is located in the process's virtual address space. The operating system is partially responsible for managing the translation from virtual addresses to physical addresses.

The addresses and their values as seen in Cheat Engine correspond to the virtual address space of the target CE is attached to.


On another note, the entry point of a program is where the operating system should begin executing code. It has little to do with virtual address spaces.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Discussions All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites