Cheat Engine

penpenpen · Cheater Reputation: 0 Joined: 23 Feb 2014 Posts: 39

Hi!
I'm not sure if the title is correct.

I Have a .dll file(test.dll) which I inject in another application(practice.exe).
With that .dll I want to overwrite a "call" operation(ASM) from the original programme.

I figured Out that the ASM Opcode for Call is: $E8

Here's an image that shows the CE Memory viewer:
*See Attachment*

So its
E8 E4 FB D9 03 translating to -> call 041A1550
Where E8 is the Opcode for the Call Operation.

But how are the other Bytes (E4 FB D9 03) calculated to 041A 1550 (test.dll+1550) ?

Hope anyone can shine some light in this darkness.

penpen

STN · Posted: Sat Oct 04, 2014 12:46 pm Post subject:

This should explain it for you

http://stackoverflow.com/questions/9438544/operand-generation-of-call-instruction-on-x86-64-amd

penpenpen · Cheater Reputation: 0 Joined: 23 Feb 2014 Posts: 39

Thanks alot.
JMP Relative seems to work just like that.