Cheat Engine

[Redouane]

The function: Microsoft.VisualBasic.CompilerServices.Operators::CompareString takes 3 arguments, first 2 are strings, 3rd is the case-sensivity flag.

While trying to do a crack me, I found a call to that function that compares my serial with the correct one (tried faking eax after the call, and got the "win" message), now I want to get the two strings that are being compared.

From what I see, the calling convention is possibly __fastcall (ecx and edx are set before the function is called), but when I set a breakpoint just before the function call, I don't get a valid string in ecx/edx (even tried with unicode), also tried [esp+4] and [esp+8] and no valid strings in them.

Does anyone know how the string arguments are passed to that function?

Thanks.

[Zanzer]

Use the value of ECX/EDX as a pointer instead and check the values around there.
For example, if ECX equals 0x12345678, browse the memory at "[12345678]" (with brackets).

After the original mov edx,[address] just simply try: mov ecx,edx

[Redouane]

[Zanzer]

Right.
I believe the first 4 bytes represent a pointer to the String class itself (don't quote me).
The next 4 bytes are the string's length. Followed up by the string's char array.