w0ffen How do I cheat? Reputation: 0
Joined: 19 Feb 2017 Posts: 1
|
Posted: Sun Feb 19, 2017 9:14 am Post subject: Cheat Engine disassembly (x64) different from IDA |
|
|
Hey all,
I'm working on debugging a game (Dead Rising) to expand my knowledge on reverse engineering. I have been using IDA Pro to disassemble and Cheat Engine to debug/auto assemble and test code. I have noticed, however, that the two programs are showing different bytecode, and I am confused as ti why.
Here's a function call in IDA Pro:
[code]48 8b 0d c7 9c 8e 01 mov rcx,QWORD PTR [rip+0x18e9cc7]
//The instruction shows as mov rcx, cs:qword_1957960
[/code]
And here is the same exact line in Cheat Engine (notice the bytes are different):
[code]48 8b 0d e7 c1 8e 01 mov rcx,QWORD PTR [rip+0x18ec1e7]
//The instruction shows as mov rcx, [DeadRising.exe+1959EA0]
[/code]
Note that I have re-based the IDA database to 0x0 (although that still hasn't allowed me to find code in Cheat Engine from IDA without scanning the memory for the exact same bits.)
I highly doubt this game is self-modifying on runtime. What's going on here? I'm not sure which to go with.
|
|