Modify registers of a static address with c++ & assembly

Question

1.00/5 (1 vote)

See more:

Hello,
I want to know if it's possible to modify the registers of an address from c++ or asm.
I have a static address ....: "44AFE2E4 and ECX = 00000002". How can i modify only this ECX ?
Any idea,link,documentation will be much appreciated.

Thank you,

edit:
I think i didn't asked correctly. I have a game. I'm using Cheat Engine to find an address to modify a value. At this address "base.dll+22E2D8"(static), from CE, i can edit the registers.Changing the value of ECX it's all i need.
I already have the function "CreateToolhelp32Snapshot" to get the base address of that "base.dll", and what is missing is the function to change the ECX value without using CE.
Tried few codes with c++ and inline asm, but no success.
I am novice and don't really understand what Assembly language is doing.

Thank you and sorry for not being specific.

edit 2:
44A94AB7 - 89 8F 64030000 - mov [edi+00000364],ecx <<

EAX=58BD5794
EBX=05F5E5DB
ECX=00000001 ---> this value i can modify using CE.
EDX=0012D7C0
ESI=06DAC7DD
EDI=3ABE6000
ESP=0012D870
EBP=00000000

Anyway, i saw now that CE is opening the VEH debugger before modifying anything. This means that i need a function to do that, not only just few lines of asm (mov ecx,00000002).

Posted 12-Jul-13 8:40am

vmvictor

Updated 12-Jul-13 21:09pm

v5

Add a Solution

Comments

nv3 12-Jul-13 19:12pm

I don't see the connection between an address and a register. There is no such thing as the "registers of an address". Probably a language problem. Could you try to describe your problam in another way. Perhaps that will make it clear what you are looking for.

Sergey Alexandrovich Kryukov 12-Jul-13 19:17pm

Exactly. It could be

mov ECX, something...

—SA

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

**`Randor`** · Answer 1 · 2013-07-12T15:15:00

Hi,

I suspect that you want to modify the ECX register when the execution flow has reached address 44AFE2E4.

You can do this with structured/vectored exception handling and utilizing hardware breakpoints (setting DR0-DR3 registers).

Here is an example:

http://www.codereversing.com/blog/?p=76[^]

Best Wishes,
-David Delaune

_Asif_ · Answer 2 · 2013-07-13T01:41:00

Solution 2

MOV EAX, [44AFE2E4]
MOV BYTE PTR [EAX] = <new value="">

Similar is the case for 0x00002 value in ECX.

Check this link also

http://en.wikibooks.org/wiki/X86_Disassembly/Variables[^]

Posted 13-Jul-13 1:41am

_Asif_