Cheat Engine

[razviar]

Hello! I just started hacking some x64 game with Unity/Mono, and basically what I need is to get access to it's internal data.

Currently I can't figure out how absolute memory address is getting calculated. For example, I find the function mono_get_root_domain, which should return a pointer to Mono Root Domain. There I see bytes:

mono-2.0-bdwgc.mono_get_root_domain - 48 8B 05 39AD4600 - mov rax,[mono-2.0-bdwgc.mono_internal_current_mask+49D4] { (1DDA87E2D20) }

The question is - why the address is mono-2.0-bdwgc.mono_internal_current_mask+49D4 and how CheatEngine compiles it to 1DDA87E2D20 ? Probably this sounds very dumb, but I can't figure out how just "48 8B 05 39AD4600" gets resolved as such. I need to repeat this programmatically, to get assembly and move on with data extraction. Please help.

[ParkourPenguin]

48 is a REX prefix for 64-bit code
8B is an opcode (mov r32,r/m32)
05 is a modR/M byte
39 AD 46 00 is an RIP-relative displacement (RIP + 0x46AD39)
The symbol "mono-2.0-bdwgc.mono_internal_current_mask" comes from CE's mono data collector (see CE source for more information)
"mono-2.0-bdwgc.mono_internal_current_mask+49D4" is the effective address that instruction is accessing
IIRC { (1DDA87E2D20) } is a comment specifying the value at the address "mono-2.0-bdwgc.mono_internal_current_mask+49D4" is 1DDA87E2D20