Cheat Engine

[iPromise]

I have a few questions to regards on how Cheat Engine's dissassembler works. I've finished my debugger and i'm interested in adding a dissassembler to analyze the asm instructions of the address(es) my debugger gave.

my first question is, how do you know what address is the beginning of the asm instruction.

for instance,

address: 0x10001 contains the byte 0x44 which corresponds with the asm instruction inc esp.

On the contrary, address 0x10000 to address 0x10003 contain the bytes 0x8b, 0x44, 0xb1 and 0xe0 which corresponds to the asm instruction mov eax, [ecx + esi*4-20]

How do I know where the instruction begins? Those addresses were just examples so don't take them literal.

my second question,

is it recommended that I view the intel documentation on asm or an opcode map to know what each byte corresponds to?

thank you.

[Slugsnack]

i'll answer your second question first. you should not be doing either unless you intend on creating your own disassembler engine. i see absolutely no reason at all for you to do that. unless you have a compelling reason to, you will find yourself doing a very large amount of tedious work that has already been done by someone else many, many, many times

if you use someone else's library for the disassembler engine, no doubt it will have an interface for you to select where to disassemble too and some advice on how to pick that place. in many cases the disassembler engine will make this choice for you (and correctly too)

[Innovation]

http://ref.x86asm.net/ is a good reference if you do choose to make your own disassembler.

Although, as Slugsnack said, it will be a lot of work that many other people have already done (e.g. libdasm, udis86, and diStorm, among countless others).