Question about tracing source code to memory

So I've been trying to figure out how this guy - [Only registered and activated users can see links. Click Here To Register...] - traced the cheat handler function from the source code to the memory. He looked at the source code and found the function that handles cheaters. I get that part. I also know how to NOP stuff in the memory using a hex editor. But how do you figure out where a specific portion of the code is in the memory?

Another related question: he said he "replaced the get damage_ property with a different one in the code." These aren't variables you know the value of in the game, so you can't just do a simple search in the memory for these values. How did he manage to find this stuff in the memory?

Here's a link to the game: [Only registered and activated users can see links. Click Here To Register...]

Quote:

---

But how do you figure out where a specific portion of the code is in the memory?

---

SWF decompiler tells you all what you need.
"Raw data" can show not only decompiled string (e.g. function names), but also binary data as-is. Example:

[Only registered and activated users can see links. Click Here To Register...]
Now you know that the "_as3_iftrue offset: 6" is "11 06 00 00". Next, use "array of byte" search in CE.

[Only registered and activated users can see links. Click Here To Register...]
(I found another function, but it's clear as example)