TransWikia.com

A bit confusion with cheat engine function address and IDA subrutine

Reverse Engineering Asked on January 17, 2021

I have found a function with Cheat Engine that I like to show in IDA:enter image description here

enter image description here

but the function is not present in IDA.

Probably I have a bit confusion becouse I don’t have experience with this tool.

Can you help me ?

Thanks !

UPDATE:

I have tryed to add image base 400000:

119EDD + 400000 = 519EDD

But 519EDD not exist to IDA:

enter image description here

There is somthing wrrong ?

One Answer

Have you noted the term battlezone2.exe + before the address? That denotes the (usually random) base address of the executable.

In IDA this base address is a fixed value e.g. 0x400000. Scroll to the beginning of the IDA View and check the Imagebase value (hexadecimal). This value you have to add to every address shown in the Cheat engine.

If debugging a process directly with IDA the database is automatically relocated to the correct address so you don't have to do the math yourself.

Note: If I interpret the screen shots correctly 0x119EDD (0x519EDD) is the target address of the conditional jump command. Jump commands are used inside a sub, hence you don't leave the current sub and won't find this address in the sub list

Correct answer by Robert on January 17, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP