Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Can't find the base pointer (Offset Loop?!?!?)

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Tutorials -> Pointer tutorials
View previous topic :: View next topic  
Author Message
Tobilo
How do I cheat?
Reputation: 0

Joined: 19 Jan 2018
Posts: 7

PostPosted: Fri Jan 19, 2018 9:50 am    Post subject: Can't find the base pointer (Offset Loop?!?!?) Reply with quote

Hey guys, i've some problems with finding the base pointer of a certain value.
Background Information: The value contains the count of items at the given inventory space.

First all I found the adress of the value, so I looked what accessed it. And this what I found:

EAX=00000000
EBX=00000000
ECX=1FFD30D0
EDX=0F859550
ESI=1FC7141A
EDI=2976F2E4
EBP=2976F2CC
ESP=2976F2AC
EIP=0503C7A0

Probable base pointer =0F859550

0503C793 - cmp ebx,[edx+08]
0503C796 - jae 050394A0
0503C79C - mov [edx+ebx*4+0C],eax
0503C7A0 - movzx ebx,byte ptr [esi+01]
0503C7A4 - inc esi

* Edx is the inventory position (1st = 0, 2nd = 4 and so on) and 0C the Offset

Ok cool so I searched for 08E967C0 and did the same procedure and now I have a problem. The following lines:

EAX=0F859550
EBX=00000204
ECX=1FE4BAC0
EDX=0000169A
ESI=1FE4B11F
EDI=2976ECFC
EBP=2976EC3C
ESP=2976EC18
EIP=05041704

Probable base pointer =0F859550


050416FB - mov ebx,[ecx+ebx*4+18]
050416FF - cmp eax,[eax]
05041701 - mov eax,[eax+ebx]
05041704 - movzx ebx,byte ptr [esi+03]
05041708 - add esi,03

What is going on here?!?
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 347

Joined: 09 May 2003
Posts: 20277
Location: The netherlands

PostPosted: Fri Jan 19, 2018 10:02 am    Post subject: Reply with quote

remember the text that says that register states shown are from AFTER execution? this is the case

anyhow, you know the final address is 08E967C0 so eax was originally 08E967C0-204

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Back to top
View user's profile Send private message MSN Messenger
Tobilo
How do I cheat?
Reputation: 0

Joined: 19 Jan 2018
Posts: 7

PostPosted: Fri Jan 19, 2018 10:15 am    Post subject: Reply with quote

Dark Byte wrote:
remember the text that says that register states shown are from AFTER execution? this is the case

anyhow, you know the final address is 08E967C0 so eax was originally 08E967C0-204


Thx for your answer, but this is not the static address right? Bcs when i restart the game, it does not find the value.
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 8

Joined: 01 Feb 2016
Posts: 865

PostPosted: Fri Jan 19, 2018 10:20 am    Post subject: Reply with quote

you have to pointer scan it, or manual path finding process.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
patched cheat engine tutorials
Memory Hacker
Back to top
View user's profile Send private message Visit poster's website
Tobilo
How do I cheat?
Reputation: 0

Joined: 19 Jan 2018
Posts: 7

PostPosted: Fri Jan 19, 2018 10:31 am    Post subject: Reply with quote

OldCheatEngineUser wrote:
you have to pointer scan it, or manual path finding process.


Well when i was pointer scanning it after the 2nd rescan it found 0 results, and I already did pointer scans many times, so it should work normally, but it didn't.
And manual scanning was the thing i did like described above :S
Back to top
View user's profile Send private message
TheyCallMeTim13
Wiki Contributor
Reputation: 8

Joined: 24 Feb 2017
Posts: 276
Location: Right Here Buddy.

PostPosted: Fri Jan 19, 2018 10:44 am    Post subject: Reply with quote

When you manually trace a pointer, you need to trace it back to a static base, the first base is probably not static else pointer scanner would have found it. If you set up the pointer scanner for a max. of say 5 levels and found nothing, then you will probably need to go more levels then that.

Another method is to trace the base to an instruction that only accesses that base and then inject there and store the base to use for pointers.

Here is a tutorial on the wiki that may be helpful:
Tutorials - Finding The Player Base

_________________
A: What manner of man are you that can summon up fire without flint or tinder?
T: I... am an enchanter.
Back to top
View user's profile Send private message
Tobilo
How do I cheat?
Reputation: 0

Joined: 19 Jan 2018
Posts: 7

PostPosted: Wed Jan 24, 2018 1:03 pm    Post subject: Reply with quote

Ok well thanks for you help. I decided to use aob scans now, but I did one mistake while asking my question. I noticed this instruction:

05041701 - mov eax,[eax+ebx]

gets executed twice.

But how do I know the ebx of the first execution?
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 8

Joined: 01 Feb 2016
Posts: 865

PostPosted: Wed Jan 24, 2018 1:10 pm    Post subject: Reply with quote

most likely its not gonna change, but if you are worried about ebx then:

- place a break-point on the instruction
- let the execution break
- see whats in ebx
- press F9 to run again
- let the execution break again
- see if ebx changed

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
patched cheat engine tutorials
Memory Hacker
Back to top
View user's profile Send private message Visit poster's website
Tobilo
How do I cheat?
Reputation: 0

Joined: 19 Jan 2018
Posts: 7

PostPosted: Wed Jan 24, 2018 3:02 pm    Post subject: Reply with quote

OldCheatEngineUser wrote:
most likely its not gonna change, but if you are worried about ebx then:

- place a break-point on the instruction
- let the execution break
- see whats in ebx
- press F9 to run again
- let the execution break again
- see if ebx changed


Ok thank you very much, that helped me understanding the code better!

Also thank you @Dark Byte for reminding me and @TheyCallMeTim13 for showing me the AoB Scan method! Very Happy
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine Tutorials -> Pointer tutorials All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites