Multi-level Pointers and Base Addresses

*Many YouTubers don't mention some of my tips. Please read from top to bottom if you are new to CE. There're three types of pointer scans, the last one is time-consuming, so it's ignored.*

## Purpose and Advantage of Pointer Scanning

Dynamic addresses of 4 Byte values, such as the Sun value in Plant vs Zombies (PVZ), or the Amount of Items in Minecraft Singleplayer, are changing whenever you switch to, e.g. different worlds. You can "backtrace" to a static (they appear green) address using Pointer Scans so that even if you reload the game, the Pointer can automatically find your Sun value every time. For most Singleplayer games, Pointer Scans are super effective, including in PVZ and Minecraft (not on multiplayer).

## Techniques to Pointer Scans (YouTubers rarely teach this)

You MAY have to do multiple trial and errors when doing Pointer scanning. However, the Static Address' ending is usually the same as its "most" dynamic address' ending. E.g. if the address storing your Sun value in PVZ is 0F98EB0, then your static address or any dynamic address derived from that static address have a high chance of ending in "0". Addresses commonly end in "0", "4", "8" or "C"(12 in DEC) for some reasons.

## Base Addresses and Offsets

It's a "storage location" and each base address is unique. A base address that comes with an **offset** points to some information, such as money or player health. For now, knowing the following is enough. In the assembly language "mov edx,[eax+000098A]", eax is the base and 000098A is the offset. Note that a base address has an address, too. The "edx" above can be stored in 162D8889. You may wonder: what's the difference between that and "mov [eax],edx"? Read it as "store the value of eax at this point in Memory in edx", and it's still passing values around (we don't deal with those bases without offsets except in decryption).

## Basic Pointer Scans

Say I just found the 4 Byte value of in-game cash. Open a Notepad or Word Document. Record the base address and offset that refers to your cash value into the Notepad. Scan for the base address that you have in HEX. Suppose my base address is stored in 1111, and I have an offset of CCCC).

In complex games like Minecraft, you should see about 100 addresses. First, look for any green (aka static) addresses. Recall our "Techniques to Pointer Scans" and first look for the same address ending. If that address ending doesn't exist (rarely), look for a unique ending, e.g. if 8/100 addresses end in "0", then test out the 0s ones first. Wdym by test? Click on "Add Address Manually". Checkmark on "Pointer". Suppose that the address that stores the value of the base address (or the value of 1111) is 2222. In "Address of Pointer", put in 2222. In the "Offset (Hex), put in CCCC. If you see the new address being way off from the original value (doesn't add up in a calculator), then Pointer Scan does not work on this address (common in server-sided games). If the value stored equals the original (cash) value, it worked! If address isn't green, move on to the next section.

## Multi-level Pointer Scans

Learn basic pointer scans first cuz I'll continue from the above. Right click on pointer and select "what writes to this address". If your game runs slowly, it's common. Do something in the game (e.g. lose health, gain cash, or jump, etc). If you gained cash twice (e.g. I sold two things), then look for any offset that responds to a change in your cash value. Ignore all constantly changing values (unless in complex games). Stop the debugger. Ignore all compare values (e.g. "cmp dword ptr" or "cmp"), and look for "mov" "add" or "sub". Double click on any of those, and record each one's base and offset. Scan for your base in HEX. Look for green addresses. If there isn't any, repeat this process using techniques in "Basic Pointer Scans" until you find green ones. Again, be aware of the address endings.