Cheat Engine

Slugsnack · Posted: Thu Dec 18, 2008 10:27 am Post subject:

that was what i meant by being careful.. and hence my suggestion to build in some debugging code.

if you left cef.. either stay away or properly come back.

nog_lorp · Posted: Fri Dec 19, 2008 10:13 pm Post subject:

How the call is made does not matter in the least. The ONLY source of information about the caller is the return address, which can only be of two things: are RET or a RETF (if it is something else it will be apparent by the function). If it is a RET, the return address will be [esp] when the function is called, regardless of how the function is called. If it is a RETF, the return address will be segment [esp-4] : [esp]. All other details of the call are not concerns.

Also, since when has anything in this forum been considered not a valid suggestion because it is "a hack", especially one that is a hack because "Microsoft does not support it". _ReturnAddress() is certainly a useful suggestion, but its existence in certain scenarios does not invalidate all other options. He could be using any other compiler, or delphi (a favorite for these forums eh), or another operating system.

I'm glad I'm still capable of pissing you off x0r.
~nog_lorp

Trucido · Moderator Reputation: 6 Joined: 08 Sep 2007 Posts: 2792

nog_lorp · Posted: Sat Dec 20, 2008 2:49 pm Post subject:

I did misunderstand your comment regarding call type. However, in light of the context of the thread (every post before yours and mine, up to the original one), it had been made clear the only viable method of doing something similar to what void wanted was to get the return address. Apologies for trying to take your post in context (although I can't blame you for skipping over most of the posts on CEF in general).

Additionally, as I have misunderstood your post, so have you misunderstood mine: I never made a suggestion or gave any directions. I was providing information, and accurate at that. While some of it may have been extraneous (regarding call type, as I was arguing with you about something you never said Embarassed

), none of it was erroneous (this is where you really start to sound like x0r).

Finally, the supported method is not always the best method. Facts embedded in the architecture do not risk "deprecation by microsoft". If you know the exact location of the return address it is a waste of time and space to use a scanning function to find it. Also, the fact that you assumed he was using C does not make your assumption valid. Nor does the fact the GCC has a similar intrinsic mean that the original poster is using a compiler that does.

You take a very Irwinesque philosophical standpoint that information, even correct information with no moral attachments, can be bad or evil.

But, I hope you are actually you and not someone else - good luck with your identity crisis Wink

sponge · Posted: Sat Dec 20, 2008 3:38 pm Post subject:

Let's face it guys. Trucido isn't that smart.

rapion124 · Posted: Sat Dec 20, 2008 4:11 pm Post subject:

Just do

nog_lorp · Posted: Sat Dec 20, 2008 5:29 pm Post subject:

rapion, [esp] doesn't deference the data ON the stack, it dereferences the stack pointer - IE giving you the top element of the stack. Only if esp has been corrupted (i.e., not possible unless someone was intentionally crashing the program, and not possible after a real call because esp has to be valid at the time of the call) would [esp] cause problems.