I was reverse engineering a game using cheat engine and trying to trace where my health gets reduced.
Basically the health gets stored in the stack and then pops out for displaying on the screen. After it pops out I tried to modify the memory address but that didn't work. Which means we need to modify it before it gets placed into the stack. After lots of diligent scrolling back, I came across the following code.
fld qword ptr[ebp-38]
This code basically pushes my health onto the stack. However, there are a whole bunch of really odd things in this code:
- This code pushes a value into the float register. It pushes my health float value (71.70) onto the Float registers. However, it is not clear from where its getting this value from. From [EBP-38]? It can't be that because that stores the value "-2.0".
- Once the value is pushed onto the Float registers, I notice that a value has been pushed onto the first register and all other values seem to be shifted. Both of these changes happen from just 1 instruction. Please take a look at the screenshot to see what I'm talking about.
- Here's the really odd part. If I select this code in cheat engine then it shows the details of the operation on the right pane. There it shows that the value being moved is "double". However, this is supposed to be a floating point instruction. So shouldn't a float value get moved?
- Another odd thing is that after the value is moved, the float register shows that all 0s have been moved. The existing value is shifted down.
So my question is:
1) What does this instruction do exactly?
2) To change this value to a custom value, can I change the source address? (wherever that is?). Assuming that that is [EBP-38] If yes, then can I use a simple move instruction for this?
Something like mov [ebp-38], (hex value for 99 float)?