Joined: 09 May 2003 Posts: 25296 Location: The netherlands
Posted: Fri Aug 22, 2014 7:13 am Post subject:
check the stack.
the first value on the stack at the point of the ret 0004 is the return address (the 0004 means to also increase the stackpointer 4 extra bytes instead of the normal 4)
alternatively, just do a single step there _________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping
Joined: 09 May 2003 Posts: 25296 Location: The netherlands
Posted: Fri Aug 22, 2014 7:24 am Post subject:
when the debugger is paused on the instruction, press f7(step into) or f8 (step over) , both will follow the ret to the next instruction (right after the call)
but you can also do it without debugging by just writing a code injection there (or at the start of the function) and check the return address in [esp] _________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum