Cheat Engine

The0neThe0nly

So, as the title suggests, I am using the "Open File" button in Cheat Engine to edit memory in a dll that my game uses. I am navigating to a specific function and I am replacing part of the code with a jump to a code cave within the dll. In the code cave, I am writing my own assembly code. At first, this was all working fine. But, I decided I wanted to add another portion of code that accessed an address in the main game. The game's addresses change every time the game is restarted, so I couldn't use a static address. Then, I decided to try and find out when a certain thread passed my function and had an address that is in the main game module (Look at the snippet below).

Dark Byte · Posted: Sat Jun 14, 2014 4:06 am Post subject:

A trick to get the current eip:

The0neThe0nly · Posted: Sat Jun 14, 2014 4:02 pm Post subject:

Dark Byte · Posted: Sat Jun 14, 2014 4:51 pm Post subject:

That's the thing. Because the address changes the result of the calculation changes.
That result can be used to calculate the correct address

Example:
File location of pop ebx=10000
File location of the address you wish is at 20456

First run pop ebx is at 2010000

2010000-10000=2000000
The address is at 2020456

Second run po ebx is at 3010000
3010000-10000=3000000
The address is at 3020456

This won't work if the address you're interested in is in an external module
In that case hope the dll exports an api you could use like getModuleHandle or loadlibrary, or if it contains a pointer to that module somewhere

The0neThe0nly · Posted: Sat Jun 14, 2014 6:43 pm Post subject:

Dark Byte · Posted: Sat Jun 14, 2014 7:50 pm Post subject:

Check the dll import table for an api you can use. E.g. getModuleHandle or loadlibrary, andt then call them to find the base of the module you're interested in

Perhaps the dll gets an address to the game's module which you can use

Otherwise you're out of luck