-
Notifications
You must be signed in to change notification settings - Fork 76
Find Multiple Offsets
The following guide is for finding Pointer->Offset->Offset (etc)
-
Search for value you want to modify.
-
Once you find it, right click, and press “Watch write accesses”. Go back to game and increase/decrease the value.
-
Right click on the shown instructions, press "Show in Debugger". In the example below, my address was 0x6EDD0. Place a break point on the address. NOTE: If the address is
move eax, [ESI+0x2a4]
then ESI should now be showing the address below. -
Add the ESI address to addresses table, right click, “Search Pointer to Variable” All pointers to ESI now show.
-
In the Debug window, browse above the pointer address you need to see if something like
mov esi, [ebp+0x8]
as an instructions. If it is, then you have to Debug Break thepush edp
to see what that address is. -
Add the EDP address to addresses table, right click, “Search Pointer to Variable”
-
All pointers to EDP now show.
- The final pointer->offset->offset address should look like
[[edp_pointer]+0x8]+0x2a4
- If you need to, you can continue this with [[[[pointer]+offset]+offset]+offset]+offset (etc)
Replace edp_pointer with found pointer.
Searching
- Introduction to Searching
- Data Types
- Storing All Values
- Pointers
- Search Windows
- Pausing Targets
- Web Games
Memory
Debugging
Scripting