Section: Find the instruction that changes gold.
In the previous memory lab, we found the current gold. Now we want to know:
Which instruction subtracts the price of a recruited unit?
Use the same offline Wesnoth 1.14.9 target and restore your clean V M, virtual machine, snapshot before starting. For a concrete run, suppose you start at 100 gold and recruit a unit costing 15. The expected result is 85. Use the actual price and gold shown in your match when checking the paused instruction.
Section: Attach x64dbg.
Launch Wesnoth, begin a local match, and find the gold address again. Then attach x64dbg to the running process.
The C P U, central processing unit, view contains four useful areas:
disassembly—the instructions near the current position;
registers—the C P U’s current scratch values;
dump—raw memory;
stack—return addresses and temporary data.
Attaching may pause in Windows system code. That is normal. Resume the process before triggering your experiment.
Section: Go to the gold address.
Open the dump view’s “go to expression” command and enter the address found by the memory scanner.
The bytes in the dump are little-endian. If the gold is 100, the 32-bit value shown here appears as:
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
The least-significant byte comes first.
Section: Break on writes.
Set a hardware breakpoint on write, covering four bytes at the gold address. The lesson uses x64dbg, but any debugger that can watch an address will do:
x64dbg
Select the four bytes in the dump, right-click, and choose Breakpoint, then Hardware, Write, then Dword.
WinDbg
Type ba w4 followed by the address, for example ba w4 0A3C1230, to break on a four-byte write. Then type g to let the game run.
Cheat Engine
Right-click the gold entry in the address list and choose Find out what writes to this address. Cheat Engine lists each instruction that writes it, with a count.
A hardware memory breakpoint does not replace the game’s instruction bytes. The debugger programs special C P U debug registers with an address, access type, and width. When an instruction writes across that watched range, the C P U raises a debug exception and Windows reports it to the debugger.
The width matters. Gold is believed to be a four-byte value, so watch all four bytes. Watching one byte can still trigger, but it hides whether the game wrote the complete integer or only part of it.
This breakpoint watches a data address, not one fixed instruction. If three different functions write gold, the same watch can reveal all three. A software breakpoint placed on a code address answers the opposite question: “When does this exact instruction execute?”
In brief: Watching a data address finds every writer of a value. A code breakpoint tells you when one particular instruction runs.
Resume the game and recruit one unit. The debugger should pause close to an instruction that resembles:
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Do not copy the exact register or offset from this page. Read the instruction in your own debugger. A hardware data breakpoint can report an access after the instruction has run, so the highlighted next instruction may not be the one that wrote gold. Use the breakpoint’s access information and nearby disassembly to identify the triggering write, then confirm that its calculated destination is your gold address. Builds and runs can differ.
Section: Ask the five assembly questions.
Apply the five questions to the paused instruction:
What is read? The current gold and the price in a register.
What is written? Four bytes at the gold field.
How many bytes? dword ptr means 32 bits.
Signed or unsigned? Test nearby comparisons before deciding.
Where next? The following instruction unless a branch changes the path.
Now compare the price register with the unit’s price. In the example run, it should be 15 and the destination should be the gold address that changed from 100 to 85. Matching both is stronger evidence than recognizing sub alone.
Section: Read an instruction as state transition.
For sub dword ptr [reg+offset], e a x, the complete before-and-after effect is:
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
That last line matters. Later branches may inspect zero, sign, carry, or overflow flags. Replacing the subtraction changes both the stored gold and those flags. Before a temporary patch, step forward and check whether nearby conditional jumps consume them.
The effective address calculation does not dereference reg and then add an offset to the loaded value. It adds the offset to the register first, then reads memory at the resulting address. Keep “calculate an address” separate from “read the value at that address.”
Section: Register names can select overlapping bits.
e a x, a x, a h, and a l are views of the same register family, not four independent containers. e a x selects 32 bits, a x its low 16, a h bits 15–8, and a l bits 7–0. In the course’s 32-bit target, e a x is the full-width view. The diagram also shows the wider r a x available in 64-bit mode.
In 64-bit mode, a write to e a x also clears r a x bits 63–32. Writes to a x, a h, or a l preserve bits outside the selected part. Microsoft’s x64 register reference documents this distinction. For the gold instruction, the operand width still tells us that exactly four memory bytes are changed.
In brief: A register name is a width clue. Treat an 8-bit, 16-bit, and 32-bit write as different state changes even when they belong to one register family.
Section: Read the brackets as an address calculation.
For an instruction such as:
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
read it from the inside outward:
take the address currently stored in e s i;
add hexadecimal offset hexadecimal 3 0;
treat the four bytes at that final address as the destination;
subtract the lower 32 bits of e a x from that destination;
store the result back to the same four bytes;
update C P U flags for later branches.
The bracketed expression accesses memory. Without brackets, e s i+30h would be an address calculation rather than a read or write of the bytes at that address.
Read the live value of e s i in the register panel and add hexadecimal 3 0 yourself. For example, if e s i holds this value, the destination is this value + hexadecimal 3 0 equals this value. If the sum equals the candidate gold address, this instruction writes the gold you found.
Alternative: Think of the register as where a street starts and the offset as the house number along it. Add them to find the door, then read what is inside.
Section: Test with a reversible patch.
Copy the original instruction bytes first, so you can write them back. Then temporarily replace the entire subtraction instruction with the same number of nop bytes.
Resume and recruit another unit. If gold no longer decreases, this instruction is the one that subtracts the price. Restore the original bytes immediately afterward.
Narration: A patch even one byte short leaves bytes the C P U decodes as some other instruction, which can crash the game. That is why you copy the originals first.
Section: Turn one discovery into a repeatable patch.
Our tools will not hardcode “whatever address worked once.” They will:
open the controlled process;
locate a module or scan a known pattern;
confirm the expected original bytes;
apply a temporary patch;
restore the bytes on exit.
Checking the original bytes is crucial. Refusing to patch an unknown version is safer than writing to the wrong place.
Section: Clean up.
Remove the breakpoint through x64dbg’s Breakpoints tab and confirm the original instruction is restored.
The scan gave us a candidate value; the write breakpoint gave us a specific instruction and the register values from one recruitment. The reversible patch checked its effect, but the instruction may also run for other gold-changing actions. Lesson 2.6 follows the call path to identify which event, caller, and affordability check selected this gold write.