Cheat Engine

[94d33m]

In step 8 there is:
Extra2: In some situations it is recommended to change ce's codefinder settings to Access violations when
Encountering instructions like mov eax,[eax] since debugregisters show it AFTER it was changed, making it hard to find out the the value of the pointer

Where is this access violation setting ?

[Dark Byte]

debugger options breakpoint types

also another way to figure out the original address is using your head and math

you did find what accesses on an address
so mov eax,[eax] accessed that address
so eax contained that address when it got executed

[94d33m]

btw i understand that mov eax, 500 moves 500 to eax, but what does mov eax, [eax] or mov [eax], eax do ? keep the value same ?

[OldCheatEngineUser]

[Dark Byte]

as stated, registers are shown after execution
so with mov eax,[eax] you can't see what eax was

but since you did find what accesses on address xxxxxxxx you know that eax was xxxxxxxx-0