| View previous topic :: View next topic |
| Author |
Message |
cmpxchg
How do I cheat?
![]() Reputation: 0
Joined: 09 Aug 2014
Posts: 2
|
 Posted: Sat Aug 09, 2014 9:28 pm Post subject: How does stealth edit deal with relative jumps |
 |
|
Hi,
I have a (general technical, not directly plugin related) question about the Stealth Edit plugin (I can't post links, but first on google).
My understanding of the plugin is as follows:
- User activates hack which writes to game memory
- Stealth Edit marks particular game memory page as non executable and makes executable copy
- On vectored exception (because of DEP), swaps returns from exception to copied memory
How does:
- The control flow get back to regular memory if it flows off the edges of the copied memory?
- What about relative call instructions in the copied memory?
- What about RIP-relative addressed reads and writes?
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 458
Joined: 09 May 2003
Posts: 25295
Location: The netherlands
|
| Posted: Sun Aug 10, 2014 2:52 am Post subject: |
|
|
| Quote: |
- The control flow get back to regular memory if it flows off the edges of the copied memory?
|
The stack will hold the return address. Eventually it'll encounter a ret that will cause it to return (can take multiple ret's)
| Quote: |
- What about relative call instructions in the copied memory?
|
Relative call instructions always point to an address inside the module it originates from. So if a relative jump happens in the copied memory, the destination will be in the copy at the proper relative location. (That is why the whole code section of a module is copied)
| Quote: |
- What about RIP-relative addressed reads and writes?
|
It doesn't. That's why stealthedit does not work on 64-bit targets.
For that you still need to use the old manual method of finding all integrity check routines and change their read pointer to the copy and do your changes in the original
There is also the alternate option of letting cheat engine rewrite a single page, so relative instructions get redirected to the original, with a non executable stub before and after it, but that isn't always perfect (short jumps can be messy as they could point to an instruction that overlaps the boundary of a page marked nx and normal, so the best solution would be to fully rewrite the code section)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
cmpxchg
How do I cheat?
![]() Reputation: 0
Joined: 09 Aug 2014
Posts: 2
|
| Posted: Tue Aug 12, 2014 8:18 am Post subject: |
|
|
Thanks.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
