| View previous topic :: View next topic |
| Author |
Message |
7ru3817 Newbie cheater
Reputation: 0
Joined: 21 May 2010 Posts: 14
|
Posted: Sat Jul 24, 2010 5:19 pm Post subject: Function Finding |
|
|
I need to find function that print text on the game screen when i say something. I found address where string starts and then I found what read from this address. Now I have adr that might be what I am looking for but I dont know anything about parametrs. When I noped address the game get crashed. What is the easiest way to find function like printing text and how to know what push affter call?
____
sorry about my bad english
|
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Sat Jul 24, 2010 7:02 pm Post subject: |
|
|
| The exact method passing parameters can potentially vary from one function to the next, but they are either going to be on the stack or in registers. You can look at what the calling code is doing w/ your value before the call instruction to make a determination. You can also/instead set a breakpoint and trace into the called function to see how it accesses your parameter.
|
|
| Back to top |
|
 |
zile Advanced Cheater
Reputation: 0
Joined: 11 Jul 2009 Posts: 75
|
Posted: Mon Jul 26, 2010 5:28 am Post subject: |
|
|
alright first search for any strings that are printed in the game in olly
once u've managed to find one, look below it , there should be a call a few instructions below
once u found the call, look above for all the nearest pushes , and record them down, they should look like this if the string u found is "You have been booted"
push ADDRESS1 ; ASCII "You have been booted"
push 1 ; some random numbers
call ADDRESS2
there may be more pushes as well, and if you see push eax/ebx/ecx , just breakpoint at that address to get the value of it, IF the value is an address , check if its a pointer ( changes every game )
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 474
Joined: 09 May 2003 Posts: 25952 Location: The netherlands
|
Posted: Mon Jul 26, 2010 5:42 am Post subject: |
|
|
Just a note that you don't specifically need olly to find the strings and the code that references it
in ce go to memory view and press ctrl+alt+r, then you can do a search for the text you're looking for and you'll also get to see the addresses that referenced it
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
rooski Master Cheater
Reputation: 0
Joined: 31 Oct 2007 Posts: 340 Location: Siberia
|
Posted: Mon Jul 26, 2010 1:17 pm Post subject: |
|
|
does anyone know of somewhere i can find all the shortcut keys for CE , cause what darkbyte mentioned above i had no idea about and it would have been useful.
_________________
clawtheclouds.com |
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 474
Joined: 09 May 2003 Posts: 25952 Location: The netherlands
|
Posted: Mon Jul 26, 2010 4:14 pm Post subject: |
|
|
just check the text of the shortcut after the menu item.
e.g this was just memview->view->referenced strings
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
rooski Master Cheater
Reputation: 0
Joined: 31 Oct 2007 Posts: 340 Location: Siberia
|
Posted: Mon Jul 26, 2010 11:15 pm Post subject: |
|
|
damn , i was still using an old beta that didnt even have a options bar at the top , so i downloaded the latest build.
_________________
clawtheclouds.com |
|
| Back to top |
|
 |
root426 Newbie cheater
Reputation: 0
Joined: 09 Feb 2010 Posts: 22
|
Posted: Thu Sep 30, 2010 4:39 am Post subject: |
|
|
darkbyte thx a lot for ur mention i love you really i love u and if exe packed then ce cant find string properly right?
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 474
Joined: 09 May 2003 Posts: 25952 Location: The netherlands
|
Posted: Fri Oct 01, 2010 4:50 am Post subject: |
|
|
| root426 wrote: | | if exe packed then ce cant find string properly right? |
Unless the packer extracts the exe in memory before execution not no.
Problem is that almost all exe packers decompress the exe in memory...
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
|