Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


how to encode memory address into bytes

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Thunder_Bird
Cheater
Reputation: 0

Joined: 27 Apr 2018
Posts: 33
Location: pakistan

PostPosted: Wed Dec 30, 2020 5:37 am    Post subject: how to encode memory address into bytes Reply with quote

I see cheat engine showing bytes of opcodes in memory view, I want to know how cheat engine calculates it. bytes of "jmp 00B10000" are "E9 17275E00"

from this all I can understand is E9 is byte of jmp instruction and rest of the bytes are of memory address, so my question is how this memory address(00B10000) is converted into the bytes(17 27 5E 00).

some info you might need
OS: windows 64 bit
Application: 32 bit
Back to top
View user's profile Send private message
MMM-304
Expert Cheater
Reputation: 0

Joined: 17 Aug 2020
Posts: 170
Location: Milkey Way

PostPosted: Wed Dec 30, 2020 6:05 am    Post subject: Reply with quote

it is the distance from current address+ its number of bytes to the address where you jmp or you call

if Address1 is where the opcode jmp Address2 is present and Address1 = 01001000 and Address2 = 01003000
then:
Code:

Bytes:                                        Opcode:
E9 FB1F0000                             jmp Address2


ie [01001000+5]+00001FFB = 01003000
+5 = distance to the address of next opcode/number of bytes of current opcode
Back to top
View user's profile Send private message
Thunder_Bird
Cheater
Reputation: 0

Joined: 27 Apr 2018
Posts: 33
Location: pakistan

PostPosted: Wed Dec 30, 2020 6:18 am    Post subject: Reply with quote

Thanks a lot, solved
Back to top
View user's profile Send private message
OldCheatEngineUser
Whateven rank
Reputation: 20

Joined: 01 Feb 2016
Posts: 1586

PostPosted: Wed Dec 30, 2020 10:10 am    Post subject: Reply with quote

as processor is fetching instructions it increments the instruction pointer to point to next instruction, when instruction bytes are fetched the processor decodes the instruction; E9 is a rel32 form of jump processor take the displacement and adds it to instruction pointer and displacements are signed values.

in your case its a rel32 jump from address "0052D8E4", so when the instruction is fetched the instruction pointer is at "0052D8E9" already.
when decoding is done it gets displacement "005E2717" and adds it to current instruction pointer which will point "00B10000".

you may wonder where "005E2717" came from, its actually "17275E00" current intel processors are little-endian; least significant bits are stored/read first.

_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
STN wrote:
i am a sweetheart.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites