Not sure if you knew this, but here goes..
Debugging that on access gives you these:
If you then click "Show disassembler" on that first one, then navigate to its epilogue:
Then do "Find out what addresses this instructions accesses" on that RET, you get these:
If you then go to each of those functions and use the same "Find out what addresses this instructions accesses" feature on some
read_ptr opcode, you'll find that only one of them runs JUST FOR YOUR PLAYER
Now do me a favor and toggle that BYTE to
1. Tanaaaa...
As for
Player:
Code: Select all
sekiro.exe+8C0959 - 48 8B 0D 90742A03 - mov rcx,[sekiro.exe+3B67DF0] { (7FF4FAF17050) }
sekiro.exe+8C0960 - 48 85 C9 - test rcx,rcx
sekiro.exe+8C0963 - 0F84 FF010000 - je sekiro.exe+8C0B68
sekiro.exe+8C0969 - 48 8B 99 88000000 - mov rbx,[rcx+00000088]
sekiro.exe+8C0970 - 48 85 DB - test rbx,rbx
sekiro.exe+8C0973 - 0F84 F2000000 - je sekiro.exe+8C0A6B
sekiro.exe+8C0979 - 48 8B 83 F81F0000 - mov rax,[rbx+00001FF8]
sekiro.exe+8C0980 - 48 8B 48 18 - mov rcx,[rax+18]