The instruction tells me to :
Which was done. I had the opcode that accessed the found address and four instructions:First find the address of the value. When you've found it use the function to find out what accesses this address.
Code: Select all
[b]10002C5A1 - 8B 00 - mov eax,[rax][/b] 10002C61C - 89 02 - mov [rdx],eax 10002C625 - 8B 00 - mov eax,[rax] 10002C659 - 8B 10 - mov edx,[rax]
The tutorial says:
So the extra info window I opened by double-clicking on the first instruction gives "the value of the pointer needed to find this address is probably 00000008".If the assembler instruction doesn't have anything between a '[' and ']' then use another item in the list. If it does it will say what it think will be the value of the pointer you need.
Which I assume it was the value "8" in hex. I noted the address of the top-most value (20CF4 in this case) as the tutorial instructs and used it as the address and used for the next step, which is:Go back to the main cheat engine window (you can keep this extra info window open if you want, but if you close it, remember what is between the [ and ] ) and do a 4 byte scan in hexadecimal for the value the extra info told you.
This next step is what stumped me. The tutorial says:Now click on manually add and select the pointer checkbox.
... Fill in as address the address you just found.
As I posted above, there is no offset to the register rax, and the address of the register was "00000008" - the value of the pointer. So I left the offset "0", but the value of the resulting address is "???". Putting "8" in the offset box doesn't work either.If the assembler instruction has a calculation (e.g: [esi+12]) at the end then type the value in that's at the end. else leave it 0. If it was a more complicated instruction look at the calculation.
I mean this is not a special case where there are offsets within the block brackets, like the tutorial described. What am I doing wrong? It might be because I'm not a native English speaker but I am rather confused by the instructions of the tutorial. Some help would be appreciated.