Cheat Engine

[inetuser]

I have noticed many times that when I scroll up or down through the disassembled code for the first time in the memory viewer, the disassembled code and the address changes. For example, when the memory viewer first opens, I'll see the following code at the top.

08491AE3 - 54 - push esp

If I then try to scroll up or down to see more code, the address, for example, will change to 08491AE2 and all disassembled byte code will look different and previously disassembled output "08491AE3 - 54 - push esp" will not be anywhere to be found.

Is memory viewer re-aligning the addresses and disassembling the byte code again such that the previous address and disassembled output disappears?

I can create the exact scenario and post the snapshot if necessary.[/b]

[Dark Byte]

The memoryviewer will realign the memory when you use the up direction to what it assumes is the best alignment based on the information it sees.(function header, invalid opcodes, etc...)
Sometimes it's correct, sometimes it's wrong.
Use the left/right keyboard buttons to shift by 1 byte (or hold shift and scroll the mouse button) till it's aligned the way you think is correct

[inetuser]

Ok.. Thank you. That helps.

The value I am interested in gets pushed on to the stack and I am having difficulty finding out who pushes that data on the stack. Is it possible to set a set a break start condition (using LUA code or whatever other means) which monitors the stack and pauses the execution once the given value is pushed on the stack.

It is proving very difficult to step trough the code to see when the value is being pushed to the stack because there is an internal timer and I believe that the code branches in different direction once the timer expires and the value I am interested in doesn't get pushed on stack.