| View previous topic :: View next topic |
| Author |
Message |
Mark Danielle
Advanced Cheater
![]() Reputation: 0
Joined: 22 Aug 2012
Posts: 97
|
 Posted: Sat Jun 07, 2014 1:42 pm Post subject: How to find values stored backwards? |
 |
|
I have come across values that are stored in memory backwards where each group will represent 256^n in hex. Like so:
| Code: |
16777216
|
| 65536
| |
| | 256
| | |
| | | 1
| | | |
00 00 00 00
|
For example:
| Code: |
00 00 00 01 = 1
00 00 00 FF = 255
00 00 01 00 = 256
00 01 00 00 = 65,536
00 00 10 40 = 2600
etc. |
What are these called and how do you find them? Even if you know they are stored this way and know the exact value you're looking for it can be hard to locate, but without it seems almost impossible. Thanks.
|
|
| Back to top |
|
 |
justa_dude
Grandmaster Cheater
 Reputation: 23
Joined: 29 Jun 2010
Posts: 893
|
| Posted: Sat Jun 07, 2014 1:49 pm Post subject: |
|
|
Endianness
Values are always stored that way on x86. The search function picks them up just fine.
_________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
|
Mark Danielle
Advanced Cheater
![]() Reputation: 0
Joined: 22 Aug 2012
Posts: 97
|
| Posted: Sat Jun 07, 2014 1:58 pm Post subject: |
|
|
justa_dude, thanks. Do you have to have to choose any special options to make it work then? Since I can't find it just by searching normally.
For example, I'm trying to find the value 32767 which I already know (because I've found it before) will be in memory as 7F FF. And if I search for either 32767, 7FFF 2-bytes or 00007FFF 4-bytes I don't find it. However if I search for just byte based on what I know the last value will be (FF) I can find it, but this only works if I know in advance what the value will be which is usually not the case.
|
|
| Back to top |
|
|
justa_dude
Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010
Posts: 893
|
| Posted: Sat Jun 07, 2014 2:07 pm Post subject: |
|
|
| bmn wrote: | | justa_dude, thanks. Do you have to have to choose any special options to make it work then? |
You're welcome, and no. As I said, all values are encoded this way on X86. So, if there were special settings you'd have to use them every time.
| bmn wrote: | | Since I can't find it just by searching normally. For example, I'm trying to find the value 32767 which I already know (because I've found it before) will be in memory as 7F FF. And if I search for either 32767, 7FFF 2 bytes or 00007FFF 4 bytes I don't find it. However if I search for just byte based on what I know the last value will be (FF) I can find it, but this only works if I know in advance what the value will be which is usually not the case. |
Are you sure it isn't stored in memory as FF 7F or FF 7F 00 00? Either way, searching for 32767 should catch it. You could try disabling fast scan or alignment options (I can't remember what the default is), but it's not something I remember having to do for simple values.
_________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25811
Location: The netherlands
|
| Posted: Sat Jun 07, 2014 2:30 pm Post subject: |
|
|
check out http://forum.cheatengine.org/viewtopic.php?p=5305367#5305367
it shows how to add big endian support to CE (scanning and editing)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Mark Danielle
Advanced Cheater
![]() Reputation: 0
Joined: 22 Aug 2012
Posts: 97
|
| Posted: Sat Jun 07, 2014 2:43 pm Post subject: |
|
|
Nope, definitely looks like 7F FF to me, unless I'm missing something. Even with fast scan disabled, searching for either 32767, 7FFF 2-bytes or 00007FFF 4-bytes just doesn't find it. Incidentally, this is in SheepShaver, a PowerPC emulator.
 [/img]
|
|
| Back to top |
|
|
daspamer
Grandmaster Cheater Supreme
 Reputation: 54
Joined: 13 Sep 2011
Posts: 1588
|
| Posted: Sat Jun 07, 2014 4:53 pm Post subject: |
|
|
Search for FF7F0000 instead...
_________________
I'm rusty and getting older, help me re-learn lua. |
|
| Back to top |
|
|
justa_dude
Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010
Posts: 893
|
| Posted: Sat Jun 07, 2014 5:00 pm Post subject: |
|
|
After seeing that you're emulating powerpc I realize that I also misread your original question and assumed you were struggling w/ little endian. Sorry - you actually did a great job framing your question. My mistake. DB's earlier suggestion is worth looking into.
_________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
| Back to top |
|
|
Mark Danielle
Advanced Cheater
![]() Reputation: 0
Joined: 22 Aug 2012
Posts: 97
|
| Posted: Sat Jun 07, 2014 11:51 pm Post subject: |
|
|
Dark Byte, it looks like that did the trick. Thank you very much! 
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
