Assembly: HOW do you KNOW!?!?

We have a lot of guides in the Hacking section, which all explain the basics of how assembly works, and list a ton of useful offsets used by Cave Story specifically. One thing I've never heard explained satisfactorily is how did they find those offsets to begin with? I've even seen people on these forums find offsets in an amazingly short amount of time considering how large the exe file is in terms of assembly code. What am I missing here?

 

weel, once you have a few, it's really easy to expand on, but I dunno how rune found the first few ones.

 

I've heard there are programs that can systematically corrupt an exe as it runs, so once something happens (say, your hp goes over 9000) you can know the offset that controlled it. That's just hearsay though, I dont really know much about that stuff. I've found a few myself, but just by going through code I already knew the result of and stopping whenever I came across something that wasn't in the big list.

 

Hey Nox, remember when you did that hack for me involving making the game choose which of the two drowned images to display based on the Mimiga Mask instead of on the direction the player is facing? You did that in less than an hour. How did you manage to find the bit of code in question so fast?

 

well, when you drown it calls a tsc event - eve also calls a tsc event. I know how the tsc parser works, so I can find eve, search for a similar bit of code, and extrapolate that this is in fact the drowning code.

that's how'd I do it anyway.
if I didn't keep the offset on file.

 

You know, I don't exactly recall. I know that I searched for a command string in olly, but I can't really remember what. I probably looked for cmp [49e640], 0. Anyways, It was the first result that came up. That's also how I found the code to change the spawn offset of the nemesis, although in that case it was a fluke since I was searching for the firing sound by looking for
PUSH (whatever sound the gun made)
CALL 420640
and it happened to be in the same place.

 

Alright, well this kinda helps, I'll see what I can do with what y'all have said.

 

I dunno, maybe they use a debugger to step through the code as it runs?

 

Oh, yeah. I do that too sometimes, but it's really more useful for analysis than actually finding anything, since you have to know where you are when you start or else it probably won't mean anything to you.

At least, it doesn't mean anything to me usually :/