0

I have found a function with Cheat Engine that I like to show in IDA:enter image description here

enter image description here

but the function is not present in IDA.

Probably I have a bit confusion becouse I don't have experience with this tool.

Can you help me ?

Thanks !

UPDATE:

I have tryed to add image base 400000:

119EDD + 400000 = 519EDD

But 519EDD not exist to IDA:

enter image description here

There is somthing wrrong ?

0

1 Answer 1

1

Have you noted the term battlezone2.exe + before the address? That denotes the (usually random) base address of the executable.

In IDA this base address is a fixed value e.g. 0x400000. Scroll to the beginning of the IDA View and check the Imagebase value (hexadecimal). This value you have to add to every address shown in the Cheat engine.

If debugging a process directly with IDA the database is automatically relocated to the correct address so you don't have to do the math yourself.

Note: If I interpret the screen shots correctly 0x119EDD (0x519EDD) is the target address of the conditional jump command. Jump commands are used inside a sub, hence you don't leave the current sub and won't find this address in the sub list

6
  • Thanks !! I have updated question, probably there is something wrong. Commented Oct 2, 2020 at 8:32
  • @user3449922 se my updated answer (last section).
    – Robert
    Commented Oct 2, 2020 at 9:52
  • Thank you again, I have already tryied but the only sub that start with 519 on IDA is 519E0C as showed at my last screenshot that is strange. Commented Oct 2, 2020 at 10:07
  • Now I have undestand. In short the game is 32 bit but for some reason must be used in IDA PE64.dll. Now with IDA I see 519E0C and all the other functions. Many thanks again !! Commented Oct 2, 2020 at 11:14
  • If you have an address you can use Jump -> Jump to address (keycode G) to go to a specific address in an "IDA View". Then you don't have to guess which sub to go to.
    – Robert
    Commented Oct 2, 2020 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.