Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[Solved] Step 8: Multilevel pointers: (PW=525927)

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
661089799107
Expert Cheater
Reputation: 3

Joined: 25 Jan 2009
Posts: 186

PostPosted: Wed Jun 09, 2010 11:42 pm    Post subject: [Solved] Step 8: Multilevel pointers: (PW=525927) Reply with quote

I'm trying to do step 8 of tutorial.exe. Can someone tell me what I am doing wrong?

Here is the table that I have, after finding the static address. (Won't let me use [img])


img824.imageshack.us/img824/965/beforetable.png

What accesses this address: (00964CFC, 1st address in above image)

img816.imageshack.us/img816/8883/accesseshealth.png

What accesses this address: (2nd address in first image)

img820.imageshack.us/img820/5245/accesses1afterhealth.png

What accesses this address: (3rd address in first image)

img819.imageshack.us/img819/8426/accesses2afterhealth.png

What accesses this address: (4th address in first image)

img819.imageshack.us/img819/5581/accesses3afterhealth.png

What accesses this address: (5th address in first image)

img823.imageshack.us/img823/6968/accesses4afterhealth.png

And then after clicking "change pointer":

img815.imageshack.us/img815/6697/aftertable.png


Last edited by 661089799107 on Thu Jun 10, 2010 5:24 am; edited 1 time in total
Back to top
View user's profile Send private message
Uzeil
Moderator
Reputation: 6

Joined: 21 Oct 2006
Posts: 2411

PostPosted: Thu Jun 10, 2010 4:01 am    Post subject: Reply with quote

Sorry but I can't be sure what's going on in these pictures, mostly because the table is the same size the whole way through.


I'll just remind you of this:

When you look at mov [ebx+18], edi for example, then your pointer there was be the address in EBX, plus 18. But that also isn't where you stop

Let's say this is how you got to the static address:

You start with address 700
Then you find out that some [eax+6] gets your offset, meaning [eax+6] = 700, where let's say(when you look down at the table) EAX is 500.
So at that point you have the pointer of Address: 500, Offset: 6 (which gives you 700)
Then lets say you do the 'what accesses' again for the address 500, and you get [ebx], where EBX is 450. This means the value of the address 450 is 500. So now, in total, your pointer is: Address: 450, Offset: 0, then result of that with Offset 5. (Because [450+0] gets your 500, then [500+5] gets you your 700, the original address.)

If you're still having issues, put pictures of the 'Add Manual Address' screen, as that's likely where you're having issues.

_________________


Mini Engine v3.0
Mipla v1.0

Reposted old threads out of the MS section.
Back to top
View user's profile Send private message
661089799107
Expert Cheater
Reputation: 3

Joined: 25 Jan 2009
Posts: 186

PostPosted: Thu Jun 10, 2010 5:23 am    Post subject: Reply with quote

Thanks, was able to figure it out Smile

img821.imageshack.us/img821/4525/done.png
Back to top
View user's profile Send private message
Uzeil
Moderator
Reputation: 6

Joined: 21 Oct 2006
Posts: 2411

PostPosted: Thu Jun 10, 2010 7:25 am    Post subject: Reply with quote

Congrats Smile
_________________


Mini Engine v3.0
Mipla v1.0

Reposted old threads out of the MS section.
Back to top
View user's profile Send private message
661089799107
Expert Cheater
Reputation: 3

Joined: 25 Jan 2009
Posts: 186

PostPosted: Thu Jun 10, 2010 7:42 am    Post subject: Reply with quote

Uzeil wrote:
Congrats Smile


Very Happy

I can't seem to find any multi level pointers on actual games though.

This is one of the problems I am having finding it on a game:

These is all my pointers so far (Haven't found a green address yet):

img641.imageshack.us/img641/1113/img1pk.png

and everything is correct so far because cheat engine shows the correct value.

But when I check to see what accesses the pointer, and then do a scan for it.. The address it gives me is 05C1A2C8, and offset 0. Which is already in the pointer list.
Back to top
View user's profile Send private message
Uzeil
Moderator
Reputation: 6

Joined: 21 Oct 2006
Posts: 2411

PostPosted: Thu Jun 10, 2010 2:56 pm    Post subject: Reply with quote

Are you sure you're not accidentally scanning for the same thing?

Unfortunately there are some tricks to keep you from seeing it as easily as done in the tutorial, but that's uncommon(as a compiler generally wouldn't make that code, especially considering it would slow down every loading of the pointer which compilers aren't usually supposed to do)


...what I mean is, "are you sure you're not accidentally scanning for the same thing you scanned for earlier?"

_________________


Mini Engine v3.0
Mipla v1.0

Reposted old threads out of the MS section.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites