I have been doing pointer scans on a game when new versions come out as the structure changes to update memory structure offsets. I decided to attempt to use signature scanning to attempt to make my offsets more durable to changes.When pointer scanning in the current game version 0x1034EF8 is the offset I am trying to get. I attached a debugger and funtions that read from this address and came up with a pattern that is unique. When I do the pattern scan this pattern is found and returned as expected. Where I am stuck at is turning this assembly instruction memory address 461EE300 into this offset 0x1034EF8. Cheat engine is able to do such a thing so it must be possible, the following was copy and pasted from cheat engine and it is showing me game_x64.exe + 1034EF8 for the 461EE300 address.How can I go about turning 461EE300 into game_x64.exe + 1034EF8 and extracting 1034EF8?//90 - nop//48 83 43 50 F8 - add qword ptr[rbx + 50],-08//48 8B 0D 461EE300 - mov rcx,[game_x64.exe + 1034EF8]//4C 8B 05 471EE300 - mov r8,[game_x64.exe + 1034F00]//49 3B C8 - cmp rcx, r8public static readonly Pattern MyPattern = new Pattern(new byte[]{0x90,0x48, 0x83, 0x43, 0x50, 0xF8,0x48, 0x8B, 0x0D, 0x00, 0x00, 0x00, 0x00,0x4C, 0x8B, 0x05, 0x00, 0x00, 0x00, 0x00,0x49, 0x3B, 0xC8}, xxxxxxxxx????xxx????xxx);
How to get pointer from byte code
disassembly;assembly;pointer
After some more digging and using a few new ideas from Nodwald, thank you here is the solution.//Match the pattern finding its location relative to the module start addressvar matches = MemoryTool.FindPatterns(MemoryTool.GetProcessId(), MemoryTool.Pattern);Process proc = Process.GetProcessesByName(ProcessName)[0];IntPtr startOffset = proc.MainModule.BaseAddress;var processStart = startOffset.ToInt64(); ;//use the match plus the offset to the memory location to read the address I was trying to translatevar memoryValueOffset = matches[0] + 9;//Read the value of the memory addressvar memoryValue = _poeInterface.Memory.ReadInt(processStart + memoryValueOffset);//Find the offset memory address of the next assembly functionvar nextInstructionOffset = matches[0] + 13;//find the full address value of that address in memoryvar nextAddressFull = nextInstructionOffset + processStart;//add the next address full value to the relative offset address value from earliervar nextAddressPlusOffset = nextAddressFull + memoryValue;//Win... this is our offset in memoryvar fullMemoryOffset = nextAddressPlusOffset;//This is the origional offset we were looking for - 0x1034EF8var relativeOffset = fullMemoryOffset - processStart;