Cheat Engine

[Dr.Disrespect]

[++METHOS]

If you set a breakpoint on the call and then step (F7) in to the call, you'll see that the call will return at the end of the sub-routine, which will jump back to the next line in the code (below the call that you set a breakpoint on). Also, not all jumps will jump forward in code, some will jump backwards and since we have conditional jumps, the code may not always follow the same path...which is how you could have a call towards the end of a sub-routine get executed before a call the occurs near the beginning of that same routine.

[Dark Byte]

this function returns the difference in address from the original address to the current address. (originally 01700449 was located at 008DB449

this is useful for code that can change location in case the relocation



as to what it does exactly:
call stores the address right after the call instruction in the stack
pop eax takes that address out of the stack
then decreases it with 008DB449 and returns to the caller

so ret returns to 017004C0

[Dr.Disrespect]

@++METHOS, Thanks a lot. Good to know that I can check step by step by using F7.

@Dark Byte:
Thanks. I have some questions:
1. "call stores the address right after the call instruction in the stack":
Which call stores the address after which call instruction? Do you mean the call at 01700444 stores the address after the call instruction at 0170004BC?

2. "ret returns to 017004C"
It returns to the line under "017004BC call 01700444", right?

3. Why subtract eax?

Thanks.

[ParkourPenguin]

1. When a call instruction is executed, it pushes the address of the next instruction onto the stack. Inside that call, when a ret instruction is run, it pops off the address at the top of the stack and jumps to that.

2. Yes. If the computer executes the call at 017004BC, the ret at 0170044F will make it jump to the next instruction, push esi.

3. Because that's how getting the difference between two numbers work. If you want to know what the difference is between 5 and 7, then that's 7-5, or 2. Same case here, just with bigger numbers written in hexadecimal.

[Dr.Disrespect]