Debugging assembly to find a static pointer for reference to a value in a game...

Question

I previously asked a question on here, but I was unregistered and wasn't able to edit my entry (not sure if you can) or add any information about the issue. I'm going to attempt to be more thorough this time so I can hopefully get an answer...

I'm trying to find a static pointer and a list of offsets so that I can easily find information in a game every time it's restarted. I've been successful with every piece of information but one...

Currently, I'm using CheatEngine to help me debug and find the pointer paths needed.

The address of the value I want (which changes with each game start) is currently: 849576A For reference, this is the first inventory slot of my first character. I know that each slot is offset by 20h and each character by 550h. So character two's first inventory slot is 849576A+550h. Again, these addresses change each restart, but the offsets do not.

Using CE, I can see what access this address... it returns the following opcodes:

These two are returned before doing anything in-game:

004b7ef9 - 0f bf 08 - movsx ecx,word ptr [eax]

004b542b - 0f bf 04 0a - movsx eax,word ptr [edx+ecx]

Then when shifting items in my inventory I get these:

74be5008 - 72 2a - jb memcpy+84

004bfc3a - 0f bf 4c 02 60 - movsx ecx,word ptr [edx+eax+60]

004bf43f - 8d 7d 9c - lea edi,[ebp-64]

I'm unsure of which to use, so I just pick one and set a breakpoint on one of them, I chose 004b542b, here's the complete code section:

004B53F0 | 55               | PUSH    EBP                       |
004B53F1 | 8BEC             | MOV     EBP, ESP                  |
004B53F3 | 83EC 0C          | SUB     ESP, C                    |
004B53F6 | 894D F4          | MOV     DWORD PTR [EBP-C], ECX    |
004B53F9 | C745 FC 00000000 | MOV     DWORD PTR [EBP-4], 0      |
004B5400 | 837D 08 00       | CMP     DWORD PTR [EBP+8], 0      |
004B5404 | 7F 04            | JG      004B540A                  |
004B5406 | 33C0             | XOR     EAX, EAX                  |
004B5408 | EB 43            | JMP     004B544D                  |
004B540A | C745 F8 0F000000 | MOV     DWORD PTR [EBP-8], F      |
004B5411 | EB 09            | JMP     004B541C                  |
004B5413 | 8B45 F8          | MOV     EAX, DWORD PTR [EBP-8]    |
004B5416 | 83C0 01          | ADD     EAX, 1                    |
004B5419 | 8945 F8          | MOV     DWORD PTR [EBP-8], EAX    |
004B541C | 837D F8 19       | CMP     DWORD PTR [EBP-8], 19     |
004B5420 | 7D 28            | JGE     004B544A                  |
004B5422 | 8B4D F8          | MOV     ECX, DWORD PTR [EBP-8]    |
004B5425 | C1E1 05          | SHL     ECX, 5                    |
004B5428 | 8B55 F4          | MOV     EDX, DWORD PTR [EBP-C]    |
004B542B | 0FBF040A         | MOVSX   EAX, WORD PTR [EDX+ECX]   |
004B542F | 3B45 08          | CMP     EAX, DWORD PTR [EBP+8]    |
004B5432 | 75 14            | JNZ     004B5448                  |
004B5434 | 8B4D F8          | MOV     ECX, DWORD PTR [EBP-8]    |
004B5437 | C1E1 05          | SHL     ECX, 5                    |
004B543A | 8B55 F4          | MOV     EDX, DWORD PTR [EBP-C]    |
004B543D | 0FBF440A 02      | MOVSX   EAX, WORD PTR [EDX+ECX+2] |
004B5442 | 0345 FC          | ADD     EAX, DWORD PTR [EBP-4]    |
004B5445 | 8945 FC          | MOV     DWORD PTR [EBP-4], EAX    |
004B5448 | EB C9            | JMP     004B5413                  |
004B544A | 8B45 FC          | MOV     EAX, DWORD PTR [EBP-4]    |
004B544D | 8BE5             | MOV     ESP, EBP                  |
004B544F | 5D               | POP     EBP                       |
004B5450 | C2 0400          | RETN    4                         |

I decide to set a breakpoint so I can see the register values before and after the line that supposedly accesses my value (004B542B | 0FBF040A | MOVSX EAX, WORD PTR [EDX+ECX]).

BEFORE:

EAX: 00000000
EBX: 00000000
ECX: 000001E0
EDX: 0849558C
ESI: 000000D0
EDI: 013A38A8
EBP: 00189CE0
ESP: 00189CD4
EIP: 004B542B

AFTER:

EAX: 00000DAD
EBX: 00000000
ECX: 000001E0
EDX: 0849558C
ESI: 000000D0
EDI: 013A38A8
EBP: 00189CE0
ESP: 00189CD4
EIP: 004B542F

To me, this means EDX 0849558C should be the value I'm looking to find and then apply an offset of 1E0. However. When searching memory for hex values matching EDX, I get no results which means there aren't any pointers to that address.

I've used the same methods I'm attempting to use here, to successfully gather each static address then apply the offsets. For example, here's the static address + offsets to find my health: 01263FC8 +284 +C +30 +90

Answer 1

I've finally figured it out. Unfortunately, the debugging was leading me nowhere so I started looking at the pointers I had found previously for my characters. Particularly health and mana as these were closest to the addresses I was getting for my inventory. I did some math based on the address I was trying to find and pointer closest to my health and I found an offset. Using that offset and the same static pointer I had found for my health I was able to find my inventory each time.