Here is the matter:
I need some help to better understand where i'm making mistakes:
I try to be as clear as possible, hope someone (please understand me...) can help me sort it out:
Let's say i need to find my char name at login (WoW is the game) so i can check it with my program and i can auto-login:
1) I look address (dinamic) where NOW is the name:
Code:
Search String -> ASCII -> Name
2) I go changing name and i find 2 addresses
3) i dont think to use "Pointer Search" since i read it's better to use DIS
4) Right Click "Find what accesses this Address" on 1240DBA0
5) Go back to program and I change name
6) Going to look where i find a MOV:
Code:
006A125F 8808 MOV BYTE PTR [EAX], CL 2
Code:
Address: 006A125F
EAX (after): 1240DBA0 ESP (after): 0019FBB0
ECX (after): 1240DB50 EBP (after): 0019FBB8
EDX (after): FFFFFE20 ESI (after): 1240DBA0
EBX (after): 1240D9C0 EDI (after): 1240DBA8
Move CL (Ch) to [1240DBA0h]
7) I do the same for the other address: 12409C0
8 ) I find :
Code:
006A1280 8808 MOV BYTE PTR [EAX], CL 1
Code:
Address: 006A1280
EAX (after): 1240D9C0 ESP (after): 0019F850
ECX (after): 00000050 EBP (after): 0019F858
EDX (after): FF5DFE04 ESI (after): 1240D9C0
EBX (after): 00000008 EDI (after): 119ED7C4
Move CL (Ch) to [1240D9C0h]
9) Well, i realized (i did before) that this 006A1280 remains tha same if I close program and I restart.
10) This 006A1280 I believe should be a Static Address, so i add it to Address List (Unsigned Long - Hex) and go see it:
11) This address has this value: 1284114568 or 4C8A0888h
12) Going to see "Find what accesses this Address": there's nothing in DIS and no notes:
13) So IF i'm I correct if i read the value of 006A1280 (WoW.exe + 2A1280) i should find the address pointed, that contains my data BUT i don't find it, since as in 11) the value is 4C8A0888h
14) So i go see that 4C8A0888h but.. i get an "Unobtainable" ...
So I try it but using, i.e., Auto-It, if i memoryread 006A1280 i simply get 4C8A0888h and i can't go further more
Where do I fail? I repeat, if i restart game, close and reopen MHS i always will find 006A1280 pointed by the dinamic address, but i'm not able to go back to it from here, so i can't find the way to write down a correct formula to get it always.
Another hint, the 006A1280 it's not green so probably it's not a pointer.
Hope to find a solution, and maybe this can clarify lot of things I see here and in other forums asked mainly by users.
Thanks again to everyone for the help,
Sincerely,
M.