Cheat Engine

kitesan · Posted: Sun Mar 15, 2015 8:21 am Post subject: CE Question

How to find where is the jump that carry you to a certain address you have ?
something like "find references" in CE? the jump is far by the way

hhhuut · Posted: Sun Mar 15, 2015 8:34 am Post subject:

It's probably saved somewhere on the stack or even in the ip-register ...

And with "far" you mean that the cs-register is a different one than at the address you have?

kitesan · Posted: Sun Mar 15, 2015 8:46 am Post subject:

no, i mean that that is not a short jump and i cant find it (but it's not a call , so no return address)

hhhuut · Posted: Sun Mar 15, 2015 10:03 am Post subject:

Well if you know that the jump jumps directly to your address, you can use the "find assembly code" option from the memory view.

Since it supports wildcards you can easily input something like:

"j* <absolute address of your jump target>"

i.e. "j* 00400104"

Btw: How do you know that there is a jump which jumps directly to your address?

kitesan · Posted: Sun Mar 15, 2015 10:35 am Post subject:

thanks , that was helpful

btw: because there is an Unconditional Jump right before my instruction

podstanar · Posted: Sun Mar 15, 2015 1:54 pm Post subject:

Tools --> Dissect Code. After analysis, you will see every reference (except indirect ones).