Cheat Engine

Noobrzor · Posted: Tue Nov 11, 2014 6:33 am Post subject: Disassemble this memory region

Greetings

When I click "Browse this memory region" i get full procedures and addresses named like "ProcessName.exe+a1234". So far I've done a little bit of code injection using that.
Today I tried to "Disassemble this memory region". Now I see direct adresses, and apparently more basic opcodes.

My questions are:
1. How do I revert to the previous type of browsing the memory region? I hate to have to restart the Cheat Engine each time during my learning when I use "Disassemble this memory region" and want to see "ProcessName.exe+a1234" again.

2. In the normal mode I see "call procedure". Am I to understand that disassembling does separate it into simple opcodes to allow more precise changes?

Dark Byte · Posted: Tue Nov 11, 2014 6:42 am Post subject:

1: it's possible the region you're looking at isn't inside a module but generated dynamically
In these cases you'll have to use an array of byte scan to find that code

2: "call" is a cpu instruction. It writes the return address on top of the stack and then changes the execution pointer to the location specified by call.
Once the cpu encounters a "ret" it will jump to the address stored on the top of the stack

Noobrzor · Posted: Tue Nov 11, 2014 7:13 am Post subject:

Thank you for the response.
Now I'll focus trying to learn to understand the meaning of your words, as I lack proper knowledge.

Best Regards!

omnidouche · How do I cheat? Reputation: 0 Joined: 30 Oct 2014 Posts: 9

Correct me if I'm wrong but "browse this memory region" will update the bottom portion of memory viewer while "disassemble this memory region" will update the top half. The bottom is straight bytes to edit while the top will do its best to group the bytes together to form opcodes. If you are in memory viewer and want to get back to "processname.exe+a1234" then just right click on any of the addresses in the top half and click on "Go to address" then type in "processname.exe.+a1234" and if you want to go to an address in the bottom half of memory viewer then right click on any bytes and click on "goto address" and do the same. Or if you want it to be specific you can always just click on the view toolbar in memory viewer and uncheck "show module addresses".