Cheat Engine

[kitesan]

how to follow a ret 0004 for find the call?

sorry for my english

[Dark Byte]

check the stack.
the first value on the stack at the point of the ret 0004 is the return address (the 0004 means to also increase the stackpointer 4 extra bytes instead of the normal 4)

alternatively, just do a single step there

[kitesan]

thank you found it.

and how to step just in case?

[Dark Byte]

when the debugger is paused on the instruction, press f7(step into) or f8 (step over) , both will follow the ret to the next instruction (right after the call)

but you can also do it without debugging by just writing a code injection there (or at the start of the function) and check the return address in [esp]

[kitesan]

Thanks alot.