I'm going to share a little bit of my frustration with backtracing for this game and hitting a point where I don't know what to do. Hopefully this helps people learn or somebody can tell me where I'm messing up.
So I want to find a unique non-shared instruction for Attack and Resistances items give (Fire, Ether, Poison Attack/Defense) so I can make a AOB lookup script to point at it.
Okay so I locate the address of one, Fire Attack. Find out what accesses this address:
So I used the first instruction "movsd xmm0,[ebx]" because it's constantly updating in the Stickers Screen in-game.
I know from my other scripts this first one is shared with all the attack and resistance effects, as seen with "What addresses this instruction accesses" in memory view. (Also outside the sticker screen it goes nuts with tons of other stuff).
4E9A0F40 is Fire Attack, the others I know what they all are. So I begin my backtrace of the first instruction with the conditional "EBX==0x4E9A0F40" so it only filters out when Fire Attack is going through the instructions, as seen on the side with EBX 4E9A0F40 :
I find the return to "02C53876 - add esp,0C" and go to it in Memory View:
I see the "Call 02C34F20" above "add esp,0C", I do some back traces further up but none of them have EBX=4E9A0F40 or anything close. So I keep going back down towards the call until I'm at "Push [esp+18]" above the call and it's still no good. So it must be in that call that changed something to EBX=4E9A0F40 eventually. So I follow the "Call 02C34F20":
So I end up on "sub esp,08" do a backtrace there and nothing. It must be further down when EBX=4E9A0F40. I won't go into detail here, but I had to going into each of those jump "je" or "jne" and such to see if anything was happening in there for EBX=4E9A0F40, and coming back out when there was nothing. But eventually I found inside of a call where EBX=4E9A0F40. So I started to go backwards from the "ret" command of the call I was in to see when EBX did not equal 4E9A0F40, so I can see where EBX got it from so hopefully can follow back to a unique non-shared code:
I got up to here when things started to change for EBX=4E9A0F40, all since the "ret" it was EBX=4E9A0F40 (well 4E9A2760 which is one of the other attack & resistance addresses). On the "02C35305 - mov [esp+10], ebx" it was still EBX=4E9A2760, but then....
...on "02C35302 - add ebx, [esi+04]" EBX changed to 20. On this instruction it still actually EBX=4E9AF40, but shows 20 because the line above it made 20, then 2 before that, and 0 before that.
So this tells me around this code is where ebx got the addresses for attack and resistances. It's the "add ebx,[esi+04]" instruction getting it somehow.
In memory view I do a "what addresses this instruction accesses" and get this (which I changed to show values in hex):
Those values are two of the attack & resistance addresses. However I should note one time I did it, it showed one wrong (not attack & resistance address) and one right address. Also when I leave the sticker screen in-game, I get a ton of "wrong" shared addresses using the instruction:
So this is where I hit a dead end and I'm stuck. I don't know how to go any further back for where the attack & resistances addresses are. The "add ebx,[esi+04]" is somehow getting it, but how do I follow that backwards? I can't use the "add ebx,[esi+04]" instruction because it's too shared.
The only other thing I can do is backtrace different instructions from the start, but that's starting over again.
EDIT: Backtraced another instruction (this time when attacking with your sword), ended up the same. Got stuck while chasing EDX, and got to an instruction of "add edx,[ecx+eax*8+04]". I can't do anything with that.