Cheat Engine

[Thunder_Bird]

I see cheat engine showing bytes of opcodes in memory view, I want to know how cheat engine calculates it. bytes of "jmp 00B10000" are "E9 17275E00"

from this all I can understand is E9 is byte of jmp instruction and rest of the bytes are of memory address, so my question is how this memory address(00B10000) is converted into the bytes(17 27 5E 00).

some info you might need
OS: windows 64 bit
Application: 32 bit

[MMM-304]

it is the distance from current address+ its number of bytes to the address where you jmp or you call

if Address1 is where the opcode jmp Address2 is present and Address1 = 01001000 and Address2 = 01003000
then:

[Thunder_Bird]

Thanks a lot, solved

[OldCheatEngineUser]

as processor is fetching instructions it increments the instruction pointer to point to next instruction, when instruction bytes are fetched the processor decodes the instruction; E9 is a rel32 form of jump processor take the displacement and adds it to instruction pointer and displacements are signed values.

in your case its a rel32 jump from address "0052D8E4", so when the instruction is fetched the instruction pointer is at "0052D8E9" already.
when decoding is done it gets displacement "005E2717" and adds it to current instruction pointer which will point "00B10000".

you may wonder where "005E2717" came from, its actually "17275E00" current intel processors are little-endian; least significant bits are stored/read first.