| View previous topic :: View next topic |
| Author |
Message |
maxhavoc
Advanced Cheater
![]() Reputation: 1
Joined: 06 Dec 2015
Posts: 58
|
 Posted: Fri Aug 04, 2017 6:47 am Post subject: Creating pointers from aobscan result |
 |
|
So I'm doing something that I think should be really easy, but I can't figure out why I'm getting the results I am. I created a basic script that uses an aobscan and I want to get the address of the result and use that as a base pointer from which I add addresses to my table with offsets from it.
Here's my script:
| Code: | [ENABLE]
label(BasePointer)
registersymbol(BasePointer)
aobscan(AOB,F8 91 27 1A 04 00 00 00 02 00 00 00 02 00 00 00 F5 01 00 00)
AOB:
BasePointer:
[DISABLE]
unregistersymbol(BasePointer)
|
What happens when I do this is that BasePointer has the value 1A2791F8 (the first 4 bytes of my aobscan pattern in little endian). Ok, so I figure it's setting BasePointer equal to the value of AOB rather than the address. Fine. So when I change AOB: to [AOB]: I get the error "This address specifier is not valid" on that line. So how can I get BasePointer to point to the address of the aobscan result? Thanks!
|
|
| Back to top |
|
 |
panraven
Grandmaster Cheater
![]() Reputation: 55
Joined: 01 Oct 2008
Posts: 942
|
| Posted: Fri Aug 04, 2017 7:52 am Post subject: |
|
|
It is syntaxcheck error because the aobscan will not execute during syntaxcheck.
If the aob do exist, and it is 32bit process
| Code: |
[AOB]:
BasePointer:
|
will set the BasePointer as 1a2791f8 when actually activate the script.
If it is 64bit process, the BasePointer will be 41a2791f8 , for address size is 8 now.
Try ignore the syntaxcheck error, press [ok] to save the script , then activate the script to see if work or not.
_________________
- Retarded. |
|
| Back to top |
|
|
maxhavoc
Advanced Cheater
![]() Reputation: 1
Joined: 06 Dec 2015
Posts: 58
|
| Posted: Fri Aug 04, 2017 8:12 am Post subject: |
|
|
| Ok, but I don't want to set BasePointer equal to my aobscan pattern. I want it set to the ADDRESS of the aobscan pattern.
|
|
| Back to top |
|
|
mgr.inz.Player
I post too much
 Reputation: 218
Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00
|
| Posted: Fri Aug 04, 2017 9:02 am Post subject: |
|
|
| Quote: | | I want to get the address of the result and use that as a base pointer from which I add addresses to my table with offsets from it |
Maybe you want to use it as start address.
| Code: | [ENABLE]
label(StartAddress)
registersymbol(StartAddress)
aobscan(AOB,F8 91 27 1A 04 00 00 00 02 00 00 00 02 00 00 00 F5 01 00 00)
AOB:
StartAddress:
[DISABLE]
unregistersymbol(StartAddress) |
Add new addresslist entry, and use address StartAddress.
Add few new entries to above entry. And set it like this:
_________________
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
 Reputation: 140
Joined: 06 Jul 2014
Posts: 4301
|
| Posted: Fri Aug 04, 2017 9:11 am Post subject: |
|
|
| maxhavoc wrote: | | BasePointer has the value 1A2791F8 (the first 4 bytes of my aobscan pattern in little endian). Ok, so I figure it's setting BasePointer equal to the value of AOB rather than the address. |
That's incorrect. BasePointer is an address. You made that address be the same as the address of the symbol AOB (i.e. the address whose value is the aob signature). Because those two addresses are the same, it follows that the value at the address BasePointer would be the same as the value at the address AOB, which you specified must be the bytes F8 91 27 1A. Everything you've said is completely consistent with the fact that BasePointer is the address the aob signature is stored at.
If you want to add an unnecessary level of indirection, allocate some memory and store the address AOB at that address.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
maxhavoc
Advanced Cheater
![]() Reputation: 1
Joined: 06 Dec 2015
Posts: 58
|
| Posted: Fri Aug 04, 2017 12:12 pm Post subject: |
|
|
@mgr.inz.Player - Thanks. I actually figured that out this morning, but it's nice to see the detailed steps. Appreciate it.
@ParkourPenguin - You're correct. My mistake was that I was referencing the BasePointer in a pointer entry within the table rather than an address entry. Once I corrected that, I figured out how to do what I want.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
