将以游戏突击立方体为例。以下是通过搜索健康价值发现的作弊引擎发现的地址。
我们有0x0050F4F4（静态本地播放器指针）指向0x00CA9000（动态播放器对象地址），
0x00C9A000 + f8 = 0x00c9a0f8将为我们提供健康的动态地址
。
class CPlayer
{
public:
char __0x0000[0xF7]; //0x0 - 0xF7
__int32 m_nHealth; //0xF8
};
#define ADDR_Player 0x0050F4F4
CPlayer* pPlayer = *(CPlayer**) ADDR_Player;
pPlayer->m_nHealth;
然后 他们是否将addr_player施放到指向Cplayer类型指针的指针？这是一个双重指针？
如果您退出 *addr_player：
0x0050f4f4-＆gt; 0x00C9A000 = 13202112（随机值）
如果您解释 *ADDR_PLAYER + OFFSET：
0x0050f4f4-＆gt; 0x00c9a00+f8 = 40（健康）
我认为这是这样的：
cplayer*pplayer =*（cplayer*）addr_player; ，但这是不正确的，我不明白为什么将正确的一个铸成双指针：
cplayer*pplayer*pplayer =*（cplayer*（cplayer*） *）addr_player;
Will be using the game Assault Cube as an example. Here are the addresses found with Cheat Engine from searching the health value.
We have 0x0050F4F4 (static local player pointer) which points to 0x00CA9000 (dynamic player object address)
Then 0x00C9A000 + F8 = 0x00C9A0F8 will give us the dynamic address of health
Here is the class:
class CPlayer
{
public:
char __0x0000[0xF7]; //0x0 - 0xF7
__int32 m_nHealth; //0xF8
};
#define ADDR_Player 0x0050F4F4
CPlayer* pPlayer = *(CPlayer**) ADDR_Player;
pPlayer->m_nHealth;
What I don’t understand is why did they cast ADDR_Player to a pointer to a pointer of type CPlayer? How is it a double pointer?
If you dereference *ADDR_Player:
0x0050F4F4 -> 0x00C9A000 = 13202112 (random value)
If you dereference *ADDR_Player + offset:
0x0050F4F4 -> 0x00C9A00+F8 = 40 (health)
I thought it would be like this:
CPlayer* pPlayer = *(CPlayer*) ADDR_Player; but this is incorrect and I don’t understand why the correct one is casted to a double pointer:
CPlayer* pPlayer = *(CPlayer**) ADDR_Player;
发布评论
评论（2）
0x0050f4f4是一个内存地址，因此保存该值的变量的类型将是“指向某物的指针”，但是指向什么？地址
0x0050f4f4的内容？另一个内存地址：0x00C9A000。由于那是一个内存地址，因此该数据的类型是“指向某物的指针”。这意味着原始变量持有0x0050f4f4的类型是“指向指针指向某物的指针”。最后，您可以查看地址
0x00C9A000的居住在什么。那是cplayer对象，因此变量持有0x00C9A000是“指向cplayer”的指针，这意味着变量持有0x0050f4f4是“指向cplayer的指针”。也就是说，您在内存中有类似的东西：
如您所见，
addr_player指向指向您cplayer对象的指针。也就是说，它是cplayer **。0x0050F4F4is a memory address, so the type of a variable holding that value would be a "pointer to something", but a pointer to what?What resides at address
0x0050F4F4? Another memory address:0x00C9A000. Since that is a memory address, the type of that data is "pointer to something". That means the type of the original variable holding0x0050F4F4is "pointer to pointer to something".Finally, you can look at what resides at address
0x00C9A000. That's aCPlayerobject, so the variable holding0x00C9A000is a "pointer toCPlayer" which means the variable holding0x0050F4F4is a "pointer to pointer toCPlayer".That is, you have something like this in memory:
As you can see,
ADDR_Playerpoints to a pointer that points to yourCPlayerobject. That is, it is aCPlayer**.您需要一个指针
cplayer*。当删除的指针是指针cplayer **时，指针将是一个指针。因此，将施放到cplayer **和DERECERCTING是获取cplayer*值的好方法。You want a pointer
CPlayer*. What will be a pointer when dereferenced is a pointer to pointerCPlayer**. So casting toCPlayer**and dereferencing is a good way to obtainCPlayer*value.