Addressed changed by code from a common address

Question

I have traced a static address which is using the base address and an offset.

I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as a reaction to an empty slot of inventory being filled or vice-versa. The addresses I'm looking for only shows changed by my static address when I actively remove/add items from my inventory, therefore changing their respective address value.

The address goes as following:

Code: NexusTK.exe+E0820 - 66 89 48 06 - mov [eax+06],cx

When I add the address it always points to an address in the Code: 004Exxxx

range.

However, the addresses my static address changes with its code is always in the Code: 55xxxxxx

range.

Is it possible to reach the accessed addresses by reading memory / offset calculation or by some relation I'm not aware of?

I can link to an image of the debugger if it helps.

Bonus: when I select the whole function examine the first address and what its code changes, all inventory slot changes gets accessed by 1 address. I have also tried pointer scanning, but when filtering out the process within the old results after resetting the pointer, the search wields 0 results the second time already.

Answer 1

The first instruction there (NexusTK.exe+E07E0) grabs the function's first arguement ([esp+04] often represents the function's first arguement) and places it in EAX. However, that EAX is not directly related to the EAX you see later at NexusTK.exe+E0820.

If you want to read or manipulate the inventory's contents, you will need to get a pointer to it. It's always worth it to attempt a pointer scan at this point, but for big games this tends not to be successful. Another option is to analyze the function (read from +E07E0 to +E0827) to figure out how it gets a pointer to the inventory. For example, the function in your screenshots calls another function located at NexusTK.exe+BF220, and then uses the return value (register al) as an index into the character inventory which is located at ESI+0x163C38. You can tell this by simply reading the assembly code (you can find a nice assembler tutorial here). Once you have analyzed the function, you could just hook it (replace its code with your own, see this question), or you can debug more to try and find a static pointer to it that the pointer scan missed.

Note that it is unlikely that the character inventory's contents are stored in string form - it more likely stored as an array of byte data (numbers representing the items). In fact, you can see from the assembly code in your screenshot that each inventory item seems to be represented by a structure of size 0x1F8 bytes (notice the multiplication at +E080B) and is possibly identifiable by a 2-byte ID at offsets +2 or +6 (these are the fields getting filled in at +E081C and +E0820)

Answer 2

Something that I have found very useful for finding inventory in a game is as following.

Clear your inventory. Search for all 0's in Cheat Engine. Put an item in inventory. Search for all > 0. Clear that slot. Search for 0. Rinse and repeat. A lot of times you can find the pointer leading to the structure that represents an item this way. Make sure you are using the same item slot each time you add and remove, preferably the first slot.

Then you can go from there to try and find the name in that data structure.

Additionally a pointer scan once you have that pointer is usually needed as it is probably dynamic memory.

Additionally if the game is updated often then a sig scan for a function that references that pointer is also useful as it will be more durable than the pointer scan.