Cheat Engine

vng21092 · Posted: Fri Apr 05, 2013 7:15 pm Post subject: help with understanding addresses

hey guys i was doing some scanning for static addresses and i used two methods, i did it the manual way (find what accesses this address, then get offsets) and i used the pointer scan.

I'm pretty sure these two addresses are related somehow because they both end with DF37C and same offsets

004DF73C with offsets 0,14,368 (manual)

"ac_client.exe"+000DF73C with offsets 0,14,368 (pointer scan)

they both affect the same thing, so my question is why is it that one says ""ac_client.exe"+" and the other one doesn't? is there any way i can obtain the first address from the second? i did this on the game assault cube by the way

TsTg · Posted: Fri Apr 05, 2013 7:22 pm Post subject:

In fact, they are the same address, but just expressed in different way, the first one is absolute, the second one is relative to the executable's image base (so in your case 004DF73C = 00400000 + the offset DF73C), the string "ac_client.exe" points cheat engine to the image base of the executable you are working on, so there's no difference.

vng21092 · Posted: Fri Apr 05, 2013 7:42 pm Post subject:

Thanks for the explanation, but would it be possible to somehow change the second address back into the first one? Somehow remove the "ac_client.exe" but still get the right address? For instance in mw3, for the health i got ""iw5sp.exe"+0078F1A8", how would i find the "absolute" value from that because I couldn't find that address manually.

STN · Posted: Fri Apr 05, 2013 8:08 pm Post subject:

Find out the base address of iw5sp.exe and add 0078F1A8 to it, you will have your absolute address.

Or in CE, simply goto that address then disable "Show Module Addresses" from the menu

vng21092 · Posted: Fri Apr 05, 2013 8:29 pm Post subject:

I honestly had NO IDEA you could do that oh my... thank you so much, btw how would I go about finding a base of address of iw5sp.exe?

TsTg · Posted: Fri Apr 05, 2013 9:23 pm Post subject: