Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[Dissemble] Help Finding functions .

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
b6ooy
Grandmaster Cheater
Reputation: 0

Joined: 21 Sep 2006
Posts: 653
PostPosted: Fri Feb 06, 2009 5:40 am    Post subject: [Dissemble] Help Finding functions . Reply with quote
I am using IDA Pro and need to find a function in the program that only use 1 parameter ( int ) .
There are over 6k of functions , Is there a way to separate those who only uses 1 parameter it will be very good .
Back to top
View user's profile Send private message
Slugsnack
Grandmaster Cheater Supreme
Reputation: 71

Joined: 24 Jan 2007
Posts: 1857
PostPosted: Fri Feb 06, 2009 5:45 am    Post subject: Reply with quote
i guess you could look for "retn 4" instructions at end of procedures ?

C2 0400
Back to top
View user's profile Send private message
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Fri Feb 06, 2009 7:56 am    Post subject: Reply with quote
Depends on what calling convention the function uses. If it's stdcall then do what Slugsnack said. Otherwise I don't know.
Back to top
View user's profile Send private message
b6ooy
Grandmaster Cheater
Reputation: 0

Joined: 21 Sep 2006
Posts: 653
PostPosted: Fri Feb 06, 2009 11:36 am    Post subject: Reply with quote
I dont think this works , already found 700 functions have retn 4h
but most have 2 parameters the first is char and the second is int ..
Back to top
View user's profile Send private message
BanMe
Master Cheater
Reputation: 0

Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
PostPosted: Fri Feb 06, 2009 12:50 pm    Post subject: Reply with quote
how do you "know" the function only takes 1 parameter?

did u disasmble the exe and find this

stdcall
Code:

mov REG,dword ptr [localvarxyz]
push REG
call DWORD
retn 0x4


cdecl
Code:

mov REG,DWORD ptr [localvarxyz]
push REG
call DWORD
add esp,0x4
ret


fastcall
Code:

mov ecx,DWORD ptr [localvarxyz]
call DWORD
retn (args-2)*4


because if you found one of these behaviors then you prolly found the function..

again if you've disasmbled the exe you're looking for a function
that excepts 1 parameter.. olly is prolly your best bet as you can directly call function passing in parameters and the like.. this is like finding a grain of sand in a pile of dust..

so many angles can be applied that would make the outcoming solution a burden for its intrinsic complexity..
regards banme
_________________
don't +rep me..i do not wish to have "status" or "recognition" from you or anyone.. thank you.
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites