Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


I need help with multilevel pointers

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Sun Mar 04, 2007 6:25 pm    Post subject: I need help with multilevel pointers Reply with quote

I was wondering if anyone can help me out with the multilevel pointers in tutorial.exe

Here's what I'm doing:

Value = 1580 so i scan for that and find it on first scan

Find what writes to it and change value and the code pops up

I do More Info on the code and search for the value of the pointer needed.

it finds one result, I add a pointer address manually using the search result and the offset

I have a pointer, but i need the pointer to this pointer so I right click the new pointer I found and click find what writes to this address

A window pops up saying this is a pointer "Find out what writes to this pointer" and "Find what reads from the address pointed at by this pointer" the tutorial.exe says to do exactly what I did last time so I press "Find what reads from the address pointed at by this pointer"

I click "Change Value" back in the tutorial and it finds the opcode again, but it's the same opcode as last time, doing any more info/pointer scan will only find the pointer I already have. I'm not sure what I am doing wrong as I am doing exactly what I did the first time as it says to do in the tut. Any advice? Thanks!
Back to top
View user's profile Send private message
UnXsIsT
How do I cheat?
Reputation: 0

Joined: 04 Mar 2007
Posts: 1

PostPosted: Sun Mar 04, 2007 7:52 pm    Post subject: Reply with quote

I am also trapped in this tutorial Sad
Back to top
View user's profile Send private message
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Sun Mar 04, 2007 10:17 pm    Post subject: Reply with quote

That's the last part in the tutorial too =(

I passed it but by freezing the process and changing the value to 5000 after i'd changed the pointer lol, but this still doesn't teach me how to find multilevel pointers.
Back to top
View user's profile Send private message
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6300

PostPosted: Mon Mar 05, 2007 12:06 am    Post subject: Reply with quote

If you set a break on the address you find, Look at the asm instructions above the break.
You will see something that will help you.

This is why you need to understand some basic assembly.
You already know what a "address" looks like.

Dont forget about reverse byte order too....
Back to top
View user's profile Send private message
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Mon Mar 05, 2007 12:25 am    Post subject: Reply with quote

Labyrnth wrote:
If you set a break on the address you find, Look at the asm instructions above the break.
You will see something that will help you.

This is why you need to understand some basic assembly.
You already know what a "address" looks like.

Dont forget about reverse byte order too....


no idea what you just said, but I'll look into it thanks Very Happy

I set a break at 00456160 which is mov [eax+18],esi
then pressed change value

the registers to the right turned red, the program stopped responding until i pressed Run, anddddd I don't know what I'm looking for. esi?? esi = 00000C6B so what do I do with that? umm sorry I am ultra confused now.

I understand the eax+18 part is the address, eax = 008F9FDC then add 18 to that and it's the address of the value, so esi should be what is being placed into eax right, but where is esi coming from, this would tell me where the next level pointer is wouldn't it? Thanks again
Back to top
View user's profile Send private message
Labyrnth
Moderator
Reputation: 10

Joined: 28 Nov 2006
Posts: 6300

PostPosted: Mon Mar 05, 2007 1:23 am    Post subject: Reply with quote

mov [eax+18],esi

^ ok this looks right, Now look at the instructions above this one.
scroll up some in memory view and sit and stare a sec.

esi is the value of the address you set the break on.
Back to top
View user's profile Send private message
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Mon Mar 05, 2007 7:55 pm    Post subject: Reply with quote

eh... I'll just use the pointer scan feature Very Happy
I stared for 10 minutes nothing happend Crying or Very sad

I learn better with hands on step by step, Im not smart enough to follow hints Confused
Back to top
View user's profile Send private message
stanoja
Cheater
Reputation: 0

Joined: 08 Mar 2007
Posts: 33
Location: Mk.

PostPosted: Fri Mar 09, 2007 1:54 pm    Post subject: Reply with quote

I did the tutorial, it was really easy.

I'll explain the Multi-level pointer step, step-by-step:

1.Find the value's address
ex: 3182, add 00976CE4

2.Find out what writes to the address:
3.On the code, click extra info
you'll get:
Code:

  address1 - code                           //the address you need is ADDRESS3
  address2 - code                           //and the thing you should look up is
>>ADDRESS3  - mov [eax+18],esi              //[eax+18]-the address the pointer
  address4 - code                           //points to, and esi-the value the pointer
  address5 - code                           //writes to [eax+18].

Copy memory
The value of the pinter needed to find this address is [hex value]
--------------------------------------------------------
3.In CE search for the [hex value] you found before in Extra Info
4.You'll find an Address with the value you searched.
5.Copy the address, it's the pointer's address.
6.Go to Memory Viewer.

Go to Tools->Pointer Scan Ctrl+P
7.In the Pointer Scan window goto Pointer Scanner->Scan for pointers Ctrl+p

8.Paste the address in the field.
and set the options on this case:
you know it's a level-4 pointer, so fill the bottom left field called
Max Level with "4".
9.Scan.
You got too many results,yeah?

10.In the tutorial click Change Pointer, and you got new value with new address, and the pointer has changed it's address too.
repeat steps 1,2,3,4 & 5 to find the new pointer address...

11.Goto the pointer scan results and goto Pointer Scanner->Rescan memory.....

12.Paste the new pointer address.

13.Finally, you found the ponter...

Study it, practice...
I think it'll do a good job to you![/quote]

_________________
Busy thinking...
Back to top
View user's profile Send private message Send e-mail
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Sun Mar 11, 2007 5:06 am    Post subject: Reply with quote

right, I know how to use the pointer scan feature that's not the problem. I don't know the sequence of events in finding a pointer to a pointer to a pointer to a pointer manually without the use of pointer scan. The instructions in the tutorial do not work.
Back to top
View user's profile Send private message
stanoja
Cheater
Reputation: 0

Joined: 08 Mar 2007
Posts: 33
Location: Mk.

PostPosted: Sun Mar 11, 2007 7:09 am    Post subject: Reply with quote

Manually:
Not possible...Only Theoretically...
It's a little(moro than a little) confusing..
Like Watching people sending a messageone-2-anoth-2-anoth.
You'll know the end message, but where it started, and where it passed?
My word: IMPOSSIBLE

_________________
Busy thinking...
Back to top
View user's profile Send private message Send e-mail
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites