Cheat Engine

catfood · Cheater Reputation: 0 Joined: 22 Jun 2015 Posts: 34

Heya guys. I'm trying to find a text limitation requires text to be between 4 and 12 characters.

What I'm thinking, is the best way to find this address, would be using the Assembly scan.
I'm assuming since its no less than 4 characters, itll be a cmp jl 4. and no larger than 12 would be a cmp jg 0C.

I'm not entirely sure how to search for that tho.. Might someone tell me how to best search for this?

ParkourPenguin · Posted: Mon Feb 29, 2016 4:11 pm Post subject:

I'm not sure if that's a good idea.
There is a virtually infinite number of ways for a computer to do something. You could try to guess what's probable, but there's no guarantee you'll get it right.
Try searching for the number of characters your input is, then look at what accesses that. If there is no address that stores that number, finding what accesses a pointer to a string representing your input might work, but that's easier said than done. Ultimap might be a better option if you can use it, but depending on how that restriction is implemented, it might not be a good option.

Regardless, to answer your question, the easiest way is to go to Memory Viewer -> Search -> Find assembly code. Alternatively, you can try doing it yourself:

Write a short script that allocates some memory, registers it as a symbol, and writes those instructions into that block of memory. Look at that allocated memory in the disassembler to get the bytes those instructions represent. Then, set the writable and CoW checkboxes to grey, check the executable box, and scan for that AoB.
Open up those addresses in CE's disassembler and scroll up a bit. If that instruction is still there, then it's probably meant to be executed. If it's not still there, then those bytes are probably a part of another instruction and can be ignored.

However, note that neither of these may work for everything. For example, the instruction mov m32,eax can have a couple machine code representations: A3 ?? ?? ?? ?? and 89 05 ?? ?? ?? ??. CE uses the second one, but if the application uses the first one, you'll never know about it.