Cheat Engine

[AceDongKing]

I am trying to find the player base address.

I start by trying to find the player's health by doing an 'Unknown Initial Value' scan with the value type of Float, taking damage, 'Decreased Value' scan, 'Unchanged Value' scan, repeat... until I get the list down to about 63 results found.

Looking through the value's I select 10 addresses that look good and are sitting close together in a block.

<<IMAGE ONE>>

When I freeze the values, it seems that my health goes down but instantly goes back to the frozen value. Unfreezing it makes the player take damage again, so that's good.
Through ticking them all and unticking them one by one I am able to find the single address that actually freezes the value. Unfortuantely it is not always in the same spot
in the list of 10 addresses that come up for health(I.E. it's not always the first / third one / last one / etc).
Checking 'What Accesses This Address' on all 10 found health addresses I find that they're all being accessed by the same instruction in memory.

When I see what writes to these addresses it seems to be a one shared instruction from the same address.

<< IMAGE TWO >>

Although the one address that actually freezes the health is being accessed by three.

<< IMAGE THREE >>

Here is the disassembler for the address that is hared amongst the 10 health addresses.

<< IMAGE FOUR >>

Back-tracing the assembly a bit, I get lost at the 'mov rax, [rsi+20]' at 09CEBEE0 instruction after the two jumps.
Not really sure where it's getting the data and what the data is.
Putting the addresses into the data dissecter does not help me out much.

I decided to check what addresses are accessed by the shared instruction 09CEBF2F.

<< IMAGE FIVE >>

It seems there are 30 different addresses accessing this instruction, 10 of them are continious updates while the other 20 only update when the player is damaged or hit.
Upon further investigation I beleive that 10 of the 20 addresses that are being written to are part a different player attribute (the Power) as modifing them increased that stat for me in game.
These addresses change every time that the level restarts or the player dies.
It seems that the amount of addresses that access the instruction also changes.

<< IMAGE SIX >>

My goal is to find the player base address so I can modify the health / power / stamina / other interesting variables that may be contained in the struct.
Any push in the right direction would be greatly appreciated!

[DanyDollaro]

I would not be wrong but the player's base address is marked in the second image in the instruction:

[ParkourPenguin]

Two instructions above that is an lea that indexes into the array. Use that value of rax instead.