2

** Edit ** After some great help from @tylernygaard I have discovered that the same variable is being written to two difference places in the memory. They are both 'static' addresses. Problem solved. Original question below....

I posted a question earlier regarding "reading" a variable from an executable here (Please excuse my naivety in this area)

I simply wanted to "read" a Total variable from an executable whilst it was running.

I was recommended a program called Cheat Engine which I have downloaded, completed the tutorial and then used.

On one PC, Cheat Engine showed the variable at address "0096E0B4".

Out of curiosity I installed Cheat Engine on another PC and the variable was at address "0096E0A4"

These addresses are so close that I'm assuming this isn't just dynamically chosen at runtime (is it?). So I wondered if anyone knew why they would be different?

And whether it would still be possible to write some code to read the correct value?

2

You will know if they are static addresses if Cheat Engine shows them green on the search results screen. See pic related. enter image description here

  • That's brilliant info. Thanks. The variable is green. But then why is it a different address slightly from the other PC? Should it not be fixed every time? If you could add to your answer that would be great and I'll 'accept' it. – John T Jun 8 '17 at 5:50
  • 1
    Hmm, that's interesting. Are you sure this value is representing exactly what you want and is not a duplicate/coincidence? I only ask because I have not run into this issue yet. I would suggest browsing that memory region and also seeing if the disassembly that writes/reads that value are the same to verify. Also, if the address is found using a base pointer with module + offset, that module could possibly vary ever so slightly from your PC to the other's? Different OS, executable version, etc. – tylernygaard Jun 8 '17 at 7:02
  • 1
    Are the differing add instructions showing at the same address in the disassembler? – tylernygaard Jun 8 '17 at 7:29
  • 1
    Good to hear! If they are truly consecutive instructions, then yes, the value EAX holds is getting written to two different addresses. If they aren't actually consecutive, then it could be conditional (maybe it jumps to one or the other depending on). That should be easy to tell though! :) – tylernygaard Jun 8 '17 at 8:07
  • 1
    @tylemygaard yep definitely consecutive. This is great news for me as I've only got one address to worry about. A massive thank you for all your help. Really appreciate the time you've spent going through this with me. Cheers :-) – John T Jun 8 '17 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.