Cheat Engine

oyy5408 · How do I cheat? Reputation: 0 Joined: 28 Apr 2010 Posts: 9

EAX=1E31D328
EBX=00000001
ECX=0000000A
EDX=00000002
ESI=1E31C3BC
EDI=00000002
EBP=1E314850
ESP=0018EF74
EIP=0043904F

Probable base pointer =1E31D328

00439045 - add eax,ecx
00439047 - mov ecx,[esp+0c]
0043904b - mov [eax+edx*4+7d],ecx
0043904f - ret 000c
00439052 - int 3

above is what showed up in the more information window.
I'm trying to find a pointer, and I'm not exactly sure how to find the pointer address for this situation.

I searched the forum but I couldn't find the answer.
I'd appreciate it if somebody could answer for me.

Dark Byte · Posted: Sun Oct 31, 2010 3:01 pm Post subject:

base address is 1E31D328 and offset is 8+7d=85

of course, because eax is modified right before the instruction you most likely won't find anything. See if you can find the value of eax before it gets changed

oyy5408 · How do I cheat? Reputation: 0 Joined: 28 Apr 2010 Posts: 9

ohh so finding the very first address in the bracket is NOT how it always works in finding a pointer i see.

I guess that's why it says 'probably' on the more information window.

Thanks, I learned something new today. : )

EaxUser · How do I cheat? Reputation: 0 Joined: 03 Jan 2011 Posts: 2

This Thread is exactly what im looking for.

I have a Problem to find a Pointer for this:

EAX=42C80000
EBX=00000000
ECX=05D2110C
EDX=05C94FD8
ESI=00000202
EDI=0012FA30
EBP=0012E8CC
ESP=0012E894
EIP=004595B4

Probable base pointer =42C80000

004595ab - mov ecx,[ebp-38]
004595ae - mov edx,[ecx+14]
004595b1 - mov eax,[edx+eax*4]
004595b4 - mov [ebp-08],eax
004595b7 - mov ecx,[ebp+0c]

So, im trying to Calculate this.
edx+eax*4[this is Offset]

42C80000*4=10B20000[Offset]
I think the 0's are not important, so the Offset is 10B2. Am i right?

Can i do with this Offset a Pointerscan and which Maximum Offset Value is required for this?

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

No.

Your instruction is changing eax:

004595b1 - mov eax,[edx+eax*4]

And the register is logged AFTER Your instruction. Which means after [edx+eax*4] has been moved to eax.

Try to set a breakpoint on the code before Your code and You will see what is eax before Your code will run.

Dark Byte · Posted: Mon Jan 03, 2011 11:12 am Post subject:

or you can just calculate it yourself
You know what edx+eax*4 results into (the address you used find what accesses on)

so:
knownaddress=edx+eax*4
knownaddress-edx=eax*4
(knownaddress-edx) / 4 = eax

Geri · Moderator Reputation: 112 Joined: 05 Feb 2010 Posts: 5627

Yeah, that's more logical. Smile

EaxUser · How do I cheat? Reputation: 0 Joined: 03 Jan 2011 Posts: 2

The Know Address is 05C94FF0 and Edx is 05C94FD8.

So, im trying again to calculate with Dark Bytes Formel.

05C94FF0-05C94FD8=18

18=eax*4
18/4=6[Hex]
eax=6

I think this one im right.
Offset what i need is then 18.

Thanks for this.