Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


how to find where a registry is set

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
attikaintheworld
How do I cheat?
Reputation: 0

Joined: 10 Oct 2022
Posts: 3
Location: EU

PostPosted: Mon Oct 10, 2022 2:44 pm    Post subject: how to find where a registry is set Reply with quote

Hi first thank you for this amazing piece of software
1 What is the recommended way tracing back where a registry is set?
e.g. I have this
mov [rbx+60],rsi
and I'd like to know where rsi is set.
as a first check it was not in the function and caller is part of a message loop
so when I tried trace breakpoint altough I have got a lot of traces it seemed my function address was not there.

Actually the max count is for the first or last n instructions.
For me it would be good to set last n instructions. Since I want to trace in opposite direction when I hit the breakpoint set to mov instruction

So what is the recommended way of tracing, debugging backward?

In addition may I have some other basic questions:
2 how to move back to actual breaked instruction I can copy EIP and
then use it in go to address is there any more convenient way?
3 how can I create a non-breaking breakpoint with action print a register for example.
4 is it possible to run a lua script when an instruction is executed if yes how

_________________
not sure I am not too old for this
Back to top
View user's profile Send private message
Csimbi
I post too much
Reputation: 97

Joined: 14 Jul 2007
Posts: 3328

PostPosted: Tue Oct 11, 2022 7:38 am    Post subject: Reply with quote

I usually look at the code first because sometime you won't need to trace things back, the value comes from a memory (of another object) that's still valid.
From looking at the code, you can also check whether RSI gets its value in this call.
If it does, you can just run a trace in this call.
Else, look at the stack to find out what function called this one and to the same there.
Take a small step back each time you don't get the answer.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites