Cheat Engine

[CerberusForHumanity]

the selected opcode is writing to my address i understand that but i believe it uses a encrypted value. i know my value is in the 2nd opcode at the top the mov edx,[rdi+soandso] my question is once the game goes to that jump/jle is it going directly to that xor or does it just move to the movsdx rax,edx ? my goal is to change the value before it gets encrypted and i thought i would be doing that at the 2nd opcode at the top but when i raise it past a certain value it crashes the game so if anyone can help me in understanding where i should write my script before that xor takes place i would be thankful

[ParkourPenguin]

Every path going to exe+4e8144 causes a segfault. Relying on exceptions as an ordinary branching mechanism seems like a stupid thing to do intentionally, so it's probably just crashing the game on purpose.

Check what the values at rdi+b74f4c and rdi+b74f44 are.

The value in edx is being used as an offset from the value in rdi+b74f30. There are a couple places it could segfault if set improperly with respect to rdi+b74f40. Maybe rdi+b74f44 is a negative number that results in a reasonable offset after the add? Or perhaps that value at rdi+b74f30 is important too? The address that results from mov rax,[rax] is read to get the value written to esi and, if the function exe+7efac0 conforms to any standard calling convention, subsequently the value stored at rax+854.

Debug it to look at values in registers and in memory, and use your head to figure out the meaning of the different values. Maybe look at the called function too, especially if esi isn't preserved across it.

[CerberusForHumanity]

[CerberusForHumanity]

so from more digging i found at the compare the value of the cap is 30 and when i do what writes to it instead of seeing 1E (hex for 30) i see no values except zeros at edi like in these images. i also know edi got its value at the push. at the push it shows no value except zeros when using a breakpoint. How do i see the 30/1E if breakpoint and the what writes menu doesnt show it either? i know it is 30 because when i do a what addresses this instruction accesses it shows a address with a byte value of 30. it makes sense since the unit cap is 30. thank you for your time and anyone that helps and has helped.

[ParkourPenguin]

There's an xor edi,edi just before that write (mov [rcx+3cc],edi), so yes, it's being set to 0.
(xor edi,edi sets edi to 0 always)

The inc instruction probably increments the value until it reaches 30 or something.

[CerberusForHumanity]