Page 1 of 1

Compare the last 2 bytes of an address in a register

Posted: Sun Feb 25, 2024 11:08 am
by EyeOfTheMind86
Hello everyone, I'm learning a lot through your tutorials and posts but I'm having a hard time doing what maybe is a simple thing.
I'm playing around with Helldivers, the first game specifically and I was looking for a way to filter out the main gun ammo count from the rest of the addresses stored in the register RCX.
By using breakpoints, I realised that, to the specific ammo address in RCX, corresponds an address in RAX where the last 2 bytes are always the same: ????3E78.
Is there a way to check, in ASM, if a specific address in RAX ends with 3E78?
I hope my question makes sense, and I apologise if it was already answered somewhere.

Re: Compare the last 2 bytes of an address in a register

Posted: Sun Feb 25, 2024 11:24 am
by Messy6666
only to answer to your 2 bytes comparing:
use the 16bit part of the register, ie: AX

so: cmp AX, 3E78

Re: Compare the last 2 bytes of an address in a register

Posted: Sun Feb 25, 2024 11:28 am
by Rhark
You could also try something like this:

Code: Select all

push r15
mov r15,rcx
add r15,3e78
cmp rax,r15
jne @f
//your code here

@@:
pop r15

Re: Compare the last 2 bytes of an address in a register

Posted: Sun Feb 25, 2024 6:33 pm
by EyeOfTheMind86
Thank you both very much. I knew about the AX being useful to check half of an address, but I thought using cmp AX would compare the first 16 bit only and not the last part of the address. I guess I need to find a proper ASM manual which explains those registers more in depth, I'm learning by trial and error mostly.
I learned a new thing, thanks very much.

Re: Compare the last 2 bytes of an address in a register

Posted: Sun Feb 25, 2024 9:26 pm
by Messy6666
Nice! +rep
never stop learning (same for me).

[Link]
in your example we are talking about little-endian.

and this one explains it
[Link]

I used to have a good assembly site.. but can't find it atm.
Best to find it yourself

regards