Search code examples
assemblycheat-engine

How to find the offset of the mov function in assembly?


I don't know how to find the original memory address altered by this code.

mov [esi+10],eax
movzx eax,byte ptr [ebp+18]

The new address obtained is the 20847BB0.

eax: 003F6C39 esi: 20847BA0 ebp: 010FF1B8

What is the previous address? Please with explanation.


Solution

  • mov [esi+10],eax

    let's look at

    esi+10

    We know esi is 20847BA0, if you add 0x10 to it, you get 20847BB0 which is your "new address"

    movzx eax,byte ptr [ebp+18]

    ebp and esp define your local stack. ebp+18 is a local stack variable

    There is no other information provided, so that's all I can tell you