title: C++ , Cheat Engine / OllyDBG finding base "static" address from multi-level pointers
body: <p>I'm back again, frustrated and desperately searching for help :D.</p>
  
  <p>I am trying to create a cheat for a simple program, it's basically going to be a .dll file which will change an integer's value from the main program when it's injected to it using its base address. The thing is, I can't find it using cheat engine mainly because there are multiple level pointers with NEGATIVE? offsets. for example:</p>
  
  <pre><code>//Starting pointer address
  0x0033FCF0 -&gt; 200
  
  //Finding second level pointer using "Find out what's accessing this address" in Cheat Engine
  **(mov eax,[ebp+08])** // **EAX=0x00000007** , **EPB=0x0033FCE8 =&gt; mov 00000007,[0033FCE8+08]**
  
  2nd Level Pointer:
  **(0033FCE8+18) -&gt; 200**
  </code></pre>
  
  <p>So I proceed to find the next pointer using "Find out what's .... " but while using T-SEARCH with the second-level pointers address and i get like 7 - 8 new static addresses.</p>
  
  <p>The thing is, I cannot tell which one is correct because cheat engine REFUSES to let me add a pointer using a NEGATIVE? offset.</p>
  
  <p>Example:</p>
  
  <pre><code>Base Pointer:
  **mov eax,[epb-18] !!!** // Notice the **MINUS**
  </code></pre>
  
  <p><em><strong>And on top of everything Cheat Engine refuses to accept a pointer with a negative offset!</em></strong></p>
  
  <p><strong>So , is there another way of finding the base address from multiple level pointers? 
  OlyDBG / Idapro solutions are welcome. Thanks alot guys!</strong></p>
  
  <p>Here's the source code of the simple program I'm trying to hack:</p>
  
  
  
  <pre class="lang-cpp prettyprint-override"><code>#include &lt;iostream&gt;
  #include &lt;conio.h&gt;
  #include &lt;windows.h&gt;
  #include &lt;stdlib.h&gt;
  
  int main(){
      int hp = 100;
      while(1){
          std::cout &lt;&lt; hp &lt;&lt; std::endl;
          Sleep(3000);
          hp += 10;
          system("cls");
      }
      return 0;
  }
  </code></pre>
  
  <p>What i am trying to do is edit the hp integer with this .dll</p>
  
  <pre><code>#include &lt;windows.h&gt;
  #define BASE    0xBASE_POINTERS_ADDRESS_WHICH_I_NEED_TO_FIND
  #define OFFSET  0xTHE_OFFSET
  #define VALUE   90
  void MainFunction()
  {
        while(1)
        {
              if (GetAsyncKeyState(VK_MENU)&amp;0x8000 &amp;&amp; GetAsyncKeyState('C')&amp;0x8000) 
              MessageBox(0,L"Alt + C was pressed!",L"MessageBox! ",0);
              *(int*)((*(int*)BASE) + OFFSET) = VALUE;
  
              Sleep(100); //Let the program rest, otherwise it hogs cpu resources.
        }
  }
  
  BOOL WINAPI DllMain(HINSTANCE MyInstance,DWORD reason_for_call,LPVOID PointerToVoid)
  {
           if (reason_for_call == DLL_PROCESS_ATTACH) CreateThread(0,0,(LPTHREAD_START_ROUTINE)&amp;MainFunction,0,0,0);
           return true;
  }
  </code></pre>
  
  <p><strong>By the way i am trying to hack the hp! ~ Oh , wait , i already said that , oh well , whatever ;)</strong></p>
  
  <p>Thank you guys, god bless you all!</p>