View previous topic :: View next topic |
Author |
Message |
kiko298 How do I cheat? Reputation: 0
Joined: 09 Sep 2018 Posts: 6
|
Posted: Sun Sep 09, 2018 11:26 am Post subject: Pointer dissapears [Help] |
|
|
I manually try to discover a multi-level pointer however it dissapears :/
I recorded a video of whats happening but i cant post it :/
URL : /watch?v=2rS96Z4Y9pA&feature=youtu.be
You have to add youtube url before
The pointer scan also fails!
Thanks you
|
|
Back to top |
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Mon Sep 10, 2018 12:13 am Post subject: Re: Pointer dissapears [Help] |
|
|
have you tried what accesses the address first? try it!
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
kiko298 How do I cheat? Reputation: 0
Joined: 09 Sep 2018 Posts: 6
|
Posted: Mon Sep 10, 2018 5:11 am Post subject: Re: Pointer dissapears [Help] |
|
|
OldCheatEngineUser wrote: |
have you tried what accesses the address first? try it! |
Will do so, thank you for the tip!
|
|
Back to top |
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Mon Sep 10, 2018 5:50 am Post subject: |
|
|
just pick another instruction with different offset, and see how it works.
it looks similar to CE tutorial step 5: (32-bit)
Code: | - mov eax,[eax+00000478] // it requires debugging to get the address of [eax+00000478] "address of eax without the offset"
- mov edx,[ebp-10]
- mov [eax],edx << // [eax] = offset '0' |
so how it works, debug [eax+478] to get eax address.
then scan for that address as hex, and you got your static address.
just add 478 as first offset then 0 as second offset, hopefully you can understand what im trying to explain.
(so again ce tut step 5 32-bit is almost similar to your case)
so you might need debugging in some cases, only when manual scanning. (of course you need debugging, but i meant code-debugging to get register states)
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
kiko298 How do I cheat? Reputation: 0
Joined: 09 Sep 2018 Posts: 6
|
Posted: Mon Sep 10, 2018 10:16 am Post subject: |
|
|
Thanks a lot for helping me!
I've done that, the problem here is that whenever i search for the Hex value in CE nothing comes up!
|
|
Back to top |
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Mon Sep 10, 2018 10:54 am Post subject: |
|
|
yes it shows you all registers (only for that specific instruction), but eax in my example above is different than yours.
and what i meant by code-debugging is, placing a breakpoint to see register states.
so here is your code:
Code: | mov ecx,[eax+14]
mov eax,[ebp-08]
mov [ecx+edx*4],eax |
its pretty much similar to CE tutorial code.
so to find your pointer, find your address again and see what writes to it.
" mov [ecx+edx*4],eax " should appear, select it and click on " show disassembler "
go up two-instructions and place a breakpoint on " mov ecx,[eax+14] " by pressing F5 or from debug-menu, when it breaks get the address of EAX.
then choose 4-byte scan as hex, and scan for the address of EAX.
keep in mind:
- your last offset is '0' (because edx=00000000 so 0*4 = zero)
- next offset is '14' (because you took the address from [eax+14] so ...)
good luck, you know the rest.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
kiko298 How do I cheat? Reputation: 0
Joined: 09 Sep 2018 Posts: 6
|
Posted: Mon Sep 10, 2018 11:20 am Post subject: |
|
|
I understood what you told me to do and i did it. However i hit the same wall as before! Sorry for being such a pain in the *** but look here:
**YOUTUBESITE***/watch?v=dydErZal7_Y&feature=youtu.be
Thats what i've done
[EDIT]
i dont know if this helps but as soon as i create and start another match the value changes
|
|
Back to top |
|
|
OldCheatEngineUser Whateven rank Reputation: 20
Joined: 01 Feb 2016 Posts: 1586
|
Posted: Mon Sep 10, 2018 11:33 am Post subject: |
|
|
i see, the problem here is EDX getting changed everytime.
i cant help you more by just writing here, but i will end this with a useful tip.
tip:
- when address showing as 00123ABC and not as "module.exe"+offset and you wanna know if its static or dynamic, copy the address and go to memory view - hex dump.
right-click "goto address" and paste, if the bytes in hex-dump are green then its a static address.
(and usually when scanning static address as 4-byte hex you will find nothing)
and i hope this is the case, so you can be happy for finding a static address.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote: | i am a sweetheart. |
|
|
Back to top |
|
|
|