Cheat Engine

thenibble · Newbie cheater Reputation: 0 Joined: 30 Nov 2010 Posts: 22

In 32 bit it was simple to look at the 4 bytes of a MOV opcode to identity the pointer in reverse, however in 64 bit it's more complicated. I can't seem to understand how to retrieve the correct address. Here is a picture for reference.

Can someone shed some light on this?

Dark Byte · Posted: Sat Feb 28, 2015 6:26 am Post subject:

1412d49da+7+019fb4af=142ccfe90

thenibble · Newbie cheater Reputation: 0 Joined: 30 Nov 2010 Posts: 22

Thank you for your help. I see it now.

Dark Byte · Posted: Sat Feb 28, 2015 6:56 am Post subject:

edit: for the question if 7 is a constant

no, that 7 is the size of the instruction in bytes.
if it where to use eax, that rex prefix ( 48 ) would go away and be 6

for pointers it's usually 7 though