5

After a bit more research, and help from a friend, I figured it out. the movss and mov are opcodes and its usually in the form of a float (for movss atleast) So, hence, you CAN change its value. Simply write movss [..address..],(float)### replace ### with your number. As for my question, it works, I have disabled the entire game's health decrement. ...


4

It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374). 0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and dereference the result, you get value of a field that's 0x374 bytes away from the beginning of this structure. This field seems to be a pointer, that's why it's ...


3

That is not an error. It's a message you will receive the first time you start a pointer scan with a new address. After you've scanned once, you can save that pointermap with which to compare against the next scan related to the value you're interested in finding a persistent pointer path for. You can save each subsequent pointermap and keep comparing that ...


2

I'll start with a few minor corrections and clarifications, just to make sure we're using the right terms and exact definitions. I used Cheat engine to find the address of the variable i in A::doThing First of all, i is not a variable of method A::doThing. It is a member of the A class. Then I used the option to find what writes to that address Doing ...


2

Edit -> Segment-> Rebase in IDA and input the address where it is actually loaded in CheatEngine You will have one-to-one-correspondence.


2

Almost static address can be achieved when the developer use global or static variables. While this was somewhat popular in the old days, today it is very rare and also considered a bad practice. Furthermore, features like ASLR are used to prevent an observer to exploit known static variables by relocating the image at a random address (details omitted as ...


2

By its definition, movaps instruction can't get immediate value. It can only get another register or memory location. You can see it in its documentation. MOVAPS xmm1, xmm2/m128 Move packed single-precision floating-point values from xmm2/m128 to xmm1. MOVAPS xmm2/m128, xmm1 Move packed single-precision floating-point values from xmm1 to xmm2/m128. ...


2

Your best "crack-mes" for games are games themselves! If spending money on games is a barrier to entry you'd rather not venture, then consider the following: Demo/trial/free-to-play games on Steam. These are all freely available for you to download and work with. There are filters you can toggle to search for these types of games on Steam, so it's easy to ...


2

TL;DR: (probably) No :( I'm afraid I don't think there is some site like this, mainly because it is much harder to generate minimal example games for memory manipulation which resemble a real life scenario than in reverse engineering or debugging challenges. Games are often quiet complex and feature multi threaded gameloops and complex engines which keep ...


1

[RAX=0x33307EE0 + RCX=0x0 * 0x8] == [0x33307EE0+0x0] = 0x33307EE0 compare whatever is at Address 0x33307EE0 with r9 register [RAX=0x33307EE0 + RCX=0x377F1FD0 * 0x8] == [ 0x33307EE0 + 0x1bbf8fe80] = 0x1ef297d60 mov into rcx whatever is there at 0x1ef297d60 you really need to find some reading/viewing material on assembly it is always better to read a book on ...


1

Have you noted the term battlezone2.exe + before the address? That denotes the (usually random) base address of the executable. In IDA this base address is a fixed value e.g. 0x400000. Scroll to the beginning of the IDA View and check the Imagebase value (hexadecimal). This value you have to add to every address shown in the Cheat engine. If debugging a ...


1

Qword is 8 bytes not 4 bytes so what you show in your first screen shot as 32 bit value is not correct representation ebp-38 is an address it can point to x y z where x,y,z can be char , int , float , double , "your fancy new secret type" Qword qualifies the address with the type here it says it is a 64 bit numeric float operations opearate on float (...


1

I voted to close this question because it is, unfortunately, too broad to properly answer. One has to gain some knowledge and experience in the reverse engineering world before one can tackle some of the real-world scenarios. you may want to start with learning assembly and doing a few crackmes, which are designed to improve one's reverse engineering skills....


1

Jumping off of Igor's suggestion of a trace, have you tried a break and trace via Cheat Engine yet? If not, consider the following: Whether via byte array (requiring an AOB scan first; make sure you select read/write memory), module+offset, or symbol name (if applicable), find your way to the crc32 edi, qword ptr [rsi+rax*8] instruction in Cheat Engine's ...


1

After a lot of trial and error, and bits and pieces of the puzzle coming together from a lot of different sources and peoples' help, I'd like to answer my own questions to the extent I feel I'm able to. I hope this helps someone else down the road who runs into this issue. Question 1: What do sin/cos values tend to look like, and at what point through a ...


1

Question 3 & 4 Answer: To move the camera/player in the direction you're facing you can use this function that works on eular angles. The only addresses you need to find are your current view angles and 3d coordinates. You use it to overwrite the player/camera 3d coordinates. I do it inside of a GetaSyncKeyState call, so it acts when pressing ...


Only top voted, non community-wiki answers of a minimum length are eligible