Cheat Engine

[psxyojscdllxx]

Newbie question,

I attach the "Find out what accesses this address" debugger with a certain address (AE2E2108), and it finds an access in the line

mov eax,[rax+000000C]

. Now in the tab below, where it records the register values, RAX = 00001415.

I think I remember that it was mentioned somewhere that the values in the debugger are the values after executing the line.
But afaik mov wouldn't modify rax here, and eax is a register, so how did this line access AE2E2108?

other lines that popped up in the debugger were fine (address + offset do add up to (AE2E2108))
most of the other lines also had the offset 0xA8 instead, which might be the struct's offset, so this just seemed the odd one out with 0xC offset

[ParkourPenguin]

eax and rax are two different names that refer to the same CPU register: eax is just the lower 32 bits of rax.

Writing to eax also automatically clears the upper 32 bits of rax (eliminates false dependencies). This is why the upper 32 bits of rax are 0 after the instruction was executed- ignoring the fact that it was also 0 before the instruction was executed.

If that instruction accessed the address AE2E2108 and the instruction is using the addressing mode "rax+C", then clearly rax was `AE2E2108 - C = AE2E20FC` before the instruction was executed.

The offset used by most instructions is probably the correct one. If several use A8 but only one uses C, it's probably A8.

[psxyojscdllxx]

oh wow, thanks, wouldn't have thought of both names referencing the same register. i remember the one being 32-bit and the other being 64-bit equivalent of the eax register, but it didn't cross my mind that a 64-bit processor probably wouldn't have 32-bit registers next and 64-bit registers (correct if i am wrong on that as well)