Cheat Engine

[fraxe]

Hi there, i am not very experienced in reverse engineering and unfortunately i encountered blocking problem with finding function in memory.

For now i can't post links, so i mentioned attachment name where it should be placed.

Maybe i will reproduce my steps below, i will appreciate some kind of code review if the steps are correct.

The goal is find a function that performs attacking player.

1. i found address with currently attacked player id
2. next using "find out what writes to this address" i found one instruction (attachment 2)
3. after that, using "select current function" in disassembler i got function starting like that (attachment 3)

Now, i assume that 00564390 is address of my function, am i correct?

Next, basing on Dark Byte answer below i tried to set breakpoint on function start and find out what are the arguments of this functions, but in RSP i have kinda unclear values, i don't know where is the limit where arguments stop. (attachment arguments)

[ParkourPenguin]

In 32-bit code, arguments are passed through the stack.
In 64-bit code, the first 4 arguments are passed through rcx, rdx, r8, and r9 respectively, and then any extras are passed through the stack.
But all that seems pointless since that function isn't conforming to standard calling conventions (or that's not actually the start of the function).

I'd go to the current return address of the stack (7F1E5C) and see what's going on there. i.e. check if it even is code (if not -> probably not actual start of the function), and if so, see what it's doing around the call.

[fraxe]

@ParkourPenguin, thank you very much for reply, I'll try to investigate correct address to this function.