I have traced a static address which is using the base address and an offset.

I am interrested in this address because a 'Find out what addresses this instruction accesses' shows values, changing as a reaction to an empty slot of inventory being filled or vice-versa. The addresses I'm looking for only shows changed by my static address when I actively remove/add items from my inventory, therefore changing their respective address value.

The address goes as following:

Code: NexusTK.exe+E0820 - 66 89 48 06 - mov [eax+06],cx

When I add the address it always points to an address in the Code: 004Exxxx


However, the addresses my static address changes with its code is always in the Code: 55xxxxxx


Is it possible to reach the accessed addresses by reading memory / offset calculation or by some relation I'm not aware of?

I can link to an image of the debugger if it helps.

Bonus: when I select the whole function examine the first address and what its code changes, all inventory slot changes gets accessed by 1 address. I have also tried pointer scanning, but when filtering out the process within the old results after resetting the pointer, the search wields 0 results the second time already.

  • "When I add the address it always points to an address in the Code: 004Exxxx range." Can you clarify this part - what address are you adding, where are you adding it to, and what were you expecting it to point to? Please do link to a screenshot of the debugger. You seem to be telling us a lot about what your debugger is outputting and most of it seems normal - so what is it that you are trying to accomplish, and what is stopping you?
    – higaki
    Mar 4, 2014 at 3:00
  • 00400000+E0820=NexusTK.exe+E0820, which is why it's always 004E0820. I want to find an array of strings in a character's inventory to read through. Pointer scanning returns nothing of interrest, and when I search through the addresses manually, this is where I'm lead. Now, I can find out what the new found address changes by code, probably one of its registers and some offset calculation. i.imgur.com/gGhTCv9.png So, most likely the register on EAX + 6. Is there a way for me to read the register EAX for 004E0820 instead of reading the value with readprocessmemory()?
    – Syncretic
    Mar 4, 2014 at 9:18
  • I am certain though, there is a better way of tracing it back. When I select the whole function in my debugger, the address in the beginning also affects the inventory string address, but from another address: i.imgur.com/XSfgAl4.png
    – Syncretic
    Mar 4, 2014 at 9:19

2 Answers 2


The first instruction there (NexusTK.exe+E07E0) grabs the function's first arguement ([esp+04] often represents the function's first arguement) and places it in EAX. However, that EAX is not directly related to the EAX you see later at NexusTK.exe+E0820.

If you want to read or manipulate the inventory's contents, you will need to get a pointer to it. It's always worth it to attempt a pointer scan at this point, but for big games this tends not to be successful. Another option is to analyze the function (read from +E07E0 to +E0827) to figure out how it gets a pointer to the inventory. For example, the function in your screenshots calls another function located at NexusTK.exe+BF220, and then uses the return value (register al) as an index into the character inventory which is located at ESI+0x163C38. You can tell this by simply reading the assembly code (you can find a nice assembler tutorial here). Once you have analyzed the function, you could just hook it (replace its code with your own, see this question), or you can debug more to try and find a static pointer to it that the pointer scan missed.

Note that it is unlikely that the character inventory's contents are stored in string form - it more likely stored as an array of byte data (numbers representing the items). In fact, you can see from the assembly code in your screenshot that each inventory item seems to be represented by a structure of size 0x1F8 bytes (notice the multiplication at +E080B) and is possibly identifiable by a 2-byte ID at offsets +2 or +6 (these are the fields getting filled in at +E081C and +E0820)


Something that I have found very useful for finding inventory in a game is as following.

Clear your inventory. Search for all 0's in Cheat Engine. Put an item in inventory. Search for all > 0. Clear that slot. Search for 0. Rinse and repeat. A lot of times you can find the pointer leading to the structure that represents an item this way. Make sure you are using the same item slot each time you add and remove, preferably the first slot.

Then you can go from there to try and find the name in that data structure.

Additionally a pointer scan once you have that pointer is usually needed as it is probably dynamic memory.

Additionally if the game is updated often then a sig scan for a function that references that pointer is also useful as it will be more durable than the pointer scan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.