

Now choose the option which usually we don't use: "find out what accesses this pointer". OK, now try first pointer and do "what access". You should have significantly less pointers So do "2 level" pointer scan with ending offsets:Īnd of course, "only paths with static address" unticked. For example, you have this "almost stable static pointer": So you know the most common ending offsets. You have found almost stable pointer ("they always 've noticed that sometimes"). But, do NOT restart the game, do NOT load checkpoints, you only move around, shoot, change locations (do NOT use "fast travel" for that), do NOT let Lara die (because it will load checkpoint). (note: staticbase can be "XXXXXXXX" or "modulename+YYYYYYYY")īut probably there are pointers of this type:īase is accessed (read or write) by some opcodes, like for example "mov eax," or something like that.ĭo "2 level" pointer scan, "only paths with static address" unticked, do many rescans. Yes, there is problem in finding pointers in this form:
