2

I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual memory addresses. But, after looking, I couldn't figure out how to plug the dynamic addresses in Cheat Engine and make them show up.

Improve this question

1 Answer 1

Reset to default
2

Edit -> Segment-> Rebase in IDA and input the address where it is actually loaded in CheatEngine

You will have one-to-one-correspondence.

Improve this answer
1
  • I get that the rebase will work if I know the position of the same instruction in IDA and the position of the exact same instruction line in memory. ... But Cheat Engine unfortunately does not provide a mapping of the whole binary (unless I miss something). In that regard, how to know what the lines of the memory correspond to in the binary ? I guess I could trying making a search of binary values near by copying the bytes in CE where there is the function I want to modify.. :/
    – Jeffrey Mvutu Mabilama
    Commented Aug 8, 2020 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.