Cheat Engine

Servus · Posted: Wed Nov 12, 2014 8:51 pm Post subject: Pointers, offsets

1) Found the address of ammunition
2) Performed 'Find out what accesses this address'
3) Found this:

EAX=0000001C
EBX=0D4282AC
ECX=08AB8A70
EDX=0058C8A8
ESI=00000004
EDI=00000000
EBP=0058C890
ESP=0058C87C
EIP=6C1C2F96

Probable base pointer =08AB8A70

6C1C2F8D - mov esi,[ecx+eax*8]
6C1C2F90 - mov [edx],esi
6C1C2F92 - mov eax,[ecx+eax*8+04]
6C1C2F96 - pop edi
6C1C2F97 - pop ebx

Now, my question is - how do I make something out of this offset? I can't seem to make sense of it: [ecx+eax*8+04]

Dark Byte · Posted: Wed Nov 12, 2014 9:01 pm Post subject:

"Register values shown are after the instruction has been executed"

that means that EAX is not useful, anyhow, you know the address you did "find what accesses" on so that's an simple calculation:
offset=eax*8+04=addressyoulookedup-08ab8a70

Now what to do with it. Do a 4 byte hexadecimal scan for and see if you can find out how that gets it's value (find what accesses)
Or use a pointerscan and tell it it has to end with the offset you found (speeds it up in some cases)

alternatively, you could do a code injection there and find what you need (may require some filtering to find only the object you need)