Ghidra addresses do not align in with cheat engine (still need help)

1.1k Views Asked by At

I’m practicing a bit of reverse engineering right now, and I came across a problem. If I copy an address from Cheat Engine and then want to jump to the same place in Ghidra, I end up in a veerem place. For example, 0x00429D1F is sub [ebx+4],edi in Cheat Engine and jge LAB_00 429d2b in Ghidra. I have already heard that you can reset the base address in the Memory Map window and have tried it, but unfortunately it did not work. Besides, pattern scanning in Ghidra does not work for me. When I search a certain pattern of bytes from Cheat Engine in Ghidra, Ghidra doesn't find the pattern even though it exists. Thanks in advance for any help.

1

There are 1 best solutions below

15
On

Maybe you talking about several modules like this? CE disassembler->view->enumerate dll's and symbols If it so, then you need to import specific module (.dll, .exe, etc.) to your project and set the base address for him.