Cheat Engine

[drdorianwhite]

I was searching for a pointer chain for a player x,y,z position.

At one point of checking what accessed a pointer, I got a calculation with an ESI register. I evaluated the offset and continued. The problem is, the value of ESI changes so, I need to figure out how to know what this value will be to get the right value.

Here is disassembly up to the line in question:

065881AB - E8 DC090000 - call 06588B8C
065881B0 - 8B D0 - mov edx,eax
065881B2 - C1 EA 14 - shr edx,14
065881B5 - 8B C8 - mov ecx,eax
065881B7 - C1 E9 0C - shr ecx,0C
065881BA - 33 D1 - xor edx,ecx
065881BC - 33 D0 - xor edx,eax
065881BE - 8B CA - mov ecx,edx
065881C0 - C1 E9 07 - shr ecx,07
065881C3 - 33 CA - xor ecx,edx
065881C5 - C1 EA 04 - shr edx,04
065881C8 - 33 CA - xor ecx,edx
065881CA - 89 4C 24 2C - mov [esp+2C],ecx
065881CE - 8B 54 24 20 - mov edx,[esp+20]
065881D2 - 8B 52 20 - mov edx,[edx+20]
065881D5 - 8B 72 08 - mov esi,[edx+08]
065881D8 - 4E - dec esi
065881D9 - 23 F1 - and esi,ecx
065881DB - 3B 72 08 - cmp esi,[edx+08]
065881DE - 0F83 B6000000 - jae 0658829A
065881E4 - 8B 54 B2 0C - mov edx,[edx+esi*4+0C]

For those more savvy in in disassembly, how can I find the value of what ESI will be? What methods do I use to track down the addresses, and what math do I apply?

Thx

[deviluc]

Just search for an address that's not used by the game and then do a code injection at 065881E4 to copy the value of ESI in the address you've just found by using:

[TsTg]

065881AB - E8 DC090000 - call 06588B8C <--after this call, eax value is generated, it will be used to calculate ecx

065881B0 - 8B D0 - mov edx,eax <---edx copied from eax
065881B2 - C1 EA 14 - shr edx,14
065881B5 - 8B C8 - mov ecx,eax <---ecx copied from eax
065881B7 - C1 E9 0C - shr ecx,0C
065881BA - 33 D1 - xor edx,ecx
065881BC - 33 D0 - xor edx,eax
065881BE - 8B CA - mov ecx,edx
065881C0 - C1 E9 07 - shr ecx,07
065881C3 - 33 CA - xor ecx,edx
065881C5 - C1 EA 04 - shr edx,04
065881C8 - 33 CA - xor ecx,edx
065881CA - 89 4C 24 2C - mov [esp+2C],ecx <---final ecx is here, also is stored in esp+2C address

065881CE - 8B 54 24 20 - mov edx,[esp+20] <--edx first value
065881D2 - 8B 52 20 - mov edx,[edx+20] <--Final edx value
065881D5 - 8B 72 08 - mov esi,[edx+08] <--esi depends on final edx
065881D8 - 4E - dec esi <--value is decreased by 1
065881D9 - 23 F1 - and esi,ecx <--next esi is ANDed with ecx (that depends on eax from the CALL command earlier)



to get edx, see the value inside [esp+20] , and search for in cheat engine (4 bytes, hex type), to get esi, you will need what's inside [edx+8] beside the value of ecx (for the and esi,ecx command).