Cheat Engine :: View topic - getting an opcodes follow address

Cheat Engine Forum Index

Cheat Engine
The Official Site of Cheat Engine

FAQ

Usergroups

Register

Log in to check your private messages

getting an opcodes follow address

Cheat Engine Forum Index -> Cheat Engine Lua Scripting

View previous topic :: View next topic

Author

Message

HexaG0n
Advanced Cheater

Reputation: 0

Joined: 29 Mar 2021
Posts: 64

Posted: Fri Sep 02, 2022 9:43 pm Post subject: getting an opcodes follow address

Reply with quote

how can i get an addresses opcodes follow address?
e.g:

Code:

-- split dissassembled string(s)

eg1 = {"","jmp qword ptr [7FF6904C2E50]","48 FF 25 91571E00","7FF6902DD6B8"} -- i want to get the address "7FF6904C2E50" from jmp qword ptr [7FF6904C2E50]

eg2 = {"[902E24A0]","lea rcx,[7FF6904C6650]","48 8D 0D 7D8F1E00 ","7FF6902DD6CC"} -- i want to get the address "7FF6904C6650" from lea rcx,[7FF6904C6650]

eg3 = {"","call 7FF6902DDA00","E8 5B030000","7FF6902DD6A0"} -- i want to get the address "7FF6902DDA00" from call 7FF6902DDA00

Send private message

ParkourPenguin
I post too much

Reputation: 152

Joined: 06 Jul 2014
Posts: 4721

Posted: Fri Sep 02, 2022 10:35 pm Post subject:

Reply with quote

If it's just one instruction, I'd do it manually: read the 32-bit signed displacement with `readInteger(address, true)` then add RIP (address of next instruction) to that value.

You could also use a regex.

Code:

function getEffectiveAddressAccess(addr)
local instruction = splitDisassembledString(disassemble(addr))
return getAddressSafe(instruction:match'%[(%x+)%]') or nil
end

_________________

I don't know where I'm going, but I'll figure it out when I get there.

Send private message

HexaG0n
Advanced Cheater

Reputation: 0

Joined: 29 Mar 2021
Posts: 64

Posted: Sat Sep 03, 2022 1:39 am Post subject:

Reply with quote

Code:

local function getEffectiveAddressAccess(addr)
local instruction = ({splitDisassembledString(disassemble(addr))})[2]
local address = getAddressSafe(instruction:match('%[?(%x+)%]?,?[%w]*$')) or 0
return address >= getAddress(process) and address or false
end

print(tostring(getEffectiveAddressAccess(0x7FF6902DD827))) -- call 7FF6902FD840 -> 0x7FF6902FD840 (140696957737024)

thank you very much! this works good enough for me Very Happy

Very Happy

Wink

Send private message

Display posts from previous:

	Cheat Engine Forum Index -> Cheat Engine Lua Scripting	All times are GMT - 6 Hours
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum

Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki IRC (#CEF) Twitter
Third party websites