4

Sorry for this stupid question. It's late here and I've been kinda stuck for a while over this so I hope someone here can answer this easily.

In CheatEngine, 028FA190+374 is pointing to 028F1788. When I type in 028FA190+374 in the calculator I get 28FA504. Can someone explain me why this is different?

Picture 1

Picture 2

0

1 Answer 1

4

It's different, because it isn't just 0x28FA190 + 0x374, but it's *(0x28FA190 + 0x374).

0x28FA190 is a base address, probably of a structure, and 0x374 is an offset, when you sum these values and dereference the result, you get value of a field that's 0x374 bytes away from the beginning of this structure. This field seems to be a pointer, that's why it's value is also an address, but it could contain any value.

struct A { char padding[0x374]; // occupy the first 0x374 bytes, so that myPointer's address is address of this structure + 0x374 (i.e. (DWORD)this + 0x374) int* myPointer; }; A a; int valueOfMyPointer = **(int**)((DWORD)&a + 0x374); // valueOfMyPointer = *a.myPointer; 

You need to explicitly cast &a to DWORD (aka unsigned long), because of pointer arithmetic - if you would do &a + 0x374, the result would actually be (DWORD)&a + 0x374 * sizeof(a).

You can also write the entire expression from your screen as following:

uint32_t result = *(DWORD*)(*(DWORD*)((DWORD)GetModuleHandle("ac_client.exe") + 0x374) + 0x14);

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.