1

I have this memory address 0F58F478 and this offset 5C. I'm using memory sharp and it works perfectly when I'm adding this number.

IntPtr address = _mSharp.Read<IntPtr>(0F58F478, false) + 0x5C;
// address output: 035F4E60

According to Cheat Engine this would be the result 035F4E60. But I've tried using a Hex Calculator and the result is by far kinda different. I'd like to know how MemorySharp or CheatEngine calculates this sum.

enter image description here

Notice that when I add 0 to a pointer this change its value, how this works? Why 0 is adding value there?

enter image description here

2
  • what are you adding ?in hex calculator ? 0F58F478 + 5c this ? >>> print(hex(0x0F58F478+0x5c)) === 0xf58f4d4 if yes then you are not dereferencing 0F58F478 is a pointer you need to read what it points to and add 0x5c to the result
    – blabb
    Dec 5, 2021 at 4:40
  • Ahhhh ok, it makes sense, thanks! just one question more, why add 0x0 to the 0F58F478 pointer changes its value? (I've updated the post with a new image) Also, is a pointer the same that memory address?
    – Sharki
    Dec 5, 2021 at 9:37

1 Answer 1

1

As I Commented if you are adding 0x5c to 0x0F58F478 and getting 0xf58f4d4
it is not what the memory sharp or cheat engine does

0x0xf58f4d4 is a pointer an address in the memory space
they dereference the pointer and add 0x5c to the result

your other query why adding 0 also falls under the same category adding 0 or 10 or 5c or 100 or 987 and dereferencing them will always provide the underlying value

also keep an eye on the square brackets [] means dereference
without square brackets means direct addition
as the first entry in your screen shot shows

&a  = 0x0F58F478                            &a = __addressof(a);
*a  = 0x3454e04                             *a = value of a
 a  + 0x5c = 0xf58f4d4                      direct addition 
[a] + 0x5c = 0x3454e04+0x5c ==  0x3454e60   dereferenced addition
[a+ 0x5c] = [f58f4d4] = *f58f4d4 = some other value that is got by 
first adding  and then  dereferencing

since this appears to be c# you should try reading about unsafe / boxing / unboxing etc as it appears you are not aware of pointers,memory ,dereferencing etc

here is a boxing example in powershell

PS C:\> $a = 123                                                                                                        
PS C:\> $b = $a     b contains what was in $a viz 123                                                                                                    
PS C:\> $a = 456    a gets a new value and a new address                                                                                                      
PS C:\> $a,$b                                                                                                            
456
123
PS C:\>  

or in c# unsafe construct

:\>dir /b
unsafe.cs

:\>type unsafe.cs
using System;
class Program
{
static unsafe void Main()
{
   int var = 32;
   int* p = &var;
   Console.WriteLine("value is 0x{0:x}" , var);
   Console.WriteLine("address is 0x{0:x}" , (int)p);
   Console.WriteLine("dereferenced is 0x{0:x}" , (*p + 0x5c));
   Console.WriteLine("undereferenced is 0x{0:x}" , ((int)p + 0x5c));
   Console.WriteLine("somegarbage  is 0x{0:x}" , *((p + 0x5c)));
}
}
:\>csc unsafe.cs /unsafe
Microsoft (R) Visual C# Compiler version 2.10.0.0 (b9fb1610)
Copyright (C) Microsoft Corporation. All rights reserved.


:\>unsafe.exe
value is 0x20
address is 0x4feac4
dereferenced is 0x7c
undereferenced is 0x4feb20
somegarbage  is 0x0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.