Finding a pointer value for a strange address..

[paultheavatar]

Hi

Im trying to find a pointer to an address (XYZ coordinates for teleport hack) which is a float value.. ive been suffering for hours and hours, please help.

I would appreciate ANY help or advice:
After finding the Z coordinate, I use cheat engine to "Find what writes to this address" and I get the following result:

EAX=4314C235
EBX=3D322F00
ECX=00000003
EDX=3D322F38
ESI=0012E13C
EDI=3D322F40
EBP=0012E0D0
ESP=0012E0A4
EIP=0099763A

Probable base pointer =00000000

00997637 - movsd
00997638 - movsd
[B]00997639 - movsd[/B]   <- This is what writes to my address?? 3D322F3C
0099763a - pop edi
0099763b - pop esi

Okay, so "movsd", which cheat engine sees as "move string data" opcode, writes to my Z coordinate address which is a FLOAT value? Cheat engine does not give any probable pointer address, so i went looking at the memory region:

00997622 - mov [ebp+60],eax
00997625 - mov eax,[ebp-1c]
00997628 - mov [ebp+64],eax
0099762B - mov eax,[ebp-18]
0099762E - mov [ebp+68],eax
00997631 - lea edi,[ebx+34]
00997634 - lea esi,[ebp+60]
00997637 - movsd
00997638 - movsd
[B]00997639 - movsd    <- this *writes* to my XYZ coordinate??? [/B]
0099763A - pop edi
0099763B - pop esi
0099763C - pop ebx
0099763D - add ebp,74
00997640 - leave
00997641 - ret 0004
00997644 - push ebp

Above is a copy of the memory region around this strange... "movsd" opcode that writes to my car's Z coordinate.
I dont know what to do or how to get a pointer in this case.

Any ideas??

[ms​]

The first movsd moves the X-coordinate from the stack to the heap, the second one the Y-coordinate and the third one the Z-coordinate. You can see that if you keep in mind that movsd copies the DWORD value stored at ESI to the DWORD value stored at EDI and then adds 4 to both registers.

Since EDI contains EBX+34 the pointer to the struct storing the coordinates probably contains the value in EBX. So in this case the pointer points to 3D322F00 and the Z-coordinate is located at 3D322F00+3C which is 3D322F3C.

[paultheavatar]

Thanks for the useful post, however, the value at EBX CONSTANTLY changes... confused yet again :/