Quote:
|
Originally Posted by supercharge
Hi all,
I was reading this tutorial and had no idea how he knows it's the right address. Can some experts here point it out, please?
How about some tips on finding the locations for users only, not computer?
Here is the part:
Code:
...
ADDRESSES.... OPCODES............ ASSEMBLY LANGUAGE.........
017F:60570C50 55 PUSH EBP
017F:60570C51 8BEC MOV EBP,ESP
017F:60570C53 A1E8625E60 MOV EAX,[605E62E8]
017F:60570C58 8B08 MOV ECX,[EAX]
017F:60570C5A FF15E4625E60 CALL [605E62E4]
017F:60570C60 8B4854 MOV ECX,[EAX+54]
017F:60570C63 85C9 TEST ECX,ECX
017F:60570C65 7508 JNZ 60570C6F HOW DOES HE KNOW THIS IS THE ADDRESS OF BULLETS?
017F:60570C67 8B4508 MOV EAX,[EBP+08] <--- Address of BULLETS
017F:60570C6A 8B4D0C MOV ECX,[EBP+0C] <--- Amount of BULLETS to
decrease by.(ECX=1)
017F:60570C6D 2908 SUB [EAX],ECX <--- subtract ECX(1)from BULLETS
017F:60570C6F 5D POP EBP <--- WE LAND HERE WHEN SI POPS
017F:60570C70 C3 RET
Thanks all. |
Sheep is kinda psychic in a way when doing trainers, he just knows sometimes :P
But trial and error is helpful too, find an address? try changing the value contained in it? Did it work? If so then thats your address.
What he did was search for the address for bullets and set a breakpoint in Softice which popped in that coding. From there he knew what was going on.
You can use other debuggers also CheatEngine has a handy debugging feature as does Tsearch.