Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Understanding instructions from disassembler

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
DreamingJ
How do I cheat?
Reputation: 0

Joined: 22 Jan 2020
Posts: 3

PostPosted: Fri Jan 24, 2020 9:03 pm    Post subject: Understanding instructions from disassembler Reply with quote

Hi, I've been playing around step 5 of the tutorial (gives a value that you can change). I found the address of the value, and after selecting "find what writes to this address" I opened up the disassembler. I set a breakpoint at the instruction that gave a new value everytime the button is pressed, and I'm able to see from the debugger in "mov [eax], edx" that edx = the new value (in hex), which makes sense.

However, I'm trying to find what instruction set edx to the new value prior to this instruction. An immediate row above, I find "move edx, [ebp - 10]". Now my question is, what is [ebp - 10]?

I keep going up the rows until I find "mov [ebp - 10], eax", and now I want to find what eax is. A few rows above, I find "mov eax, 000003E8".

0x000003E8 = 1000 in decimal. So if that value is put in register eax -> moved to memory location [ebp - 10] -> then from there put in edx -> then
finally put into [eax] , why is the new value displayed as "647", as well as in the instruction breakpoint's debugger the value of EDX is 0x289 or "647" as well. Should it not be 1,000?

I attached a pic of the disassembler.
Thank you!



cheatengine-x86_64_RwMoRkYe1l.png
 Description:
 Filesize:  85.37 KB
 Viewed:  392 Time(s)

cheatengine-x86_64_RwMoRkYe1l.png


Back to top
View user's profile Send private message
ParkourPenguin
I post too much
Reputation: 78

Joined: 06 Jul 2014
Posts: 2639

PostPosted: Fri Jan 24, 2020 10:26 pm    Post subject: Reply with quote

The call instruction at exe+268E5 (just after mov eax,3e8) probably does something that returns a value in eax. Right click on that call instruction and select "follow" or something to go to the called address in the disassembler and see what's going on.

Across call instructions, registers can be either volatile or nonvolatile. Volatile registers might not have the same value they had prior to the call instruction, while nonvolatile registers are guaranteed to have the same value. eax is a volatile register, so whenever you see a call instruction, you can't assume it will still have the same value.

_________________
I don't know where I'm going, but I'll figure it out when I get there.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites