| View previous topic :: View next topic |
| Author |
Message |
Droppinacid
How do I cheat?
![]() Reputation: 0
Joined: 03 Aug 2012
Posts: 9
|
 Posted: Sun Aug 12, 2012 1:10 pm Post subject: Can anyone help me find my OFFSET and HEX? |
 |
|
So i kinda figured out this pointer thing, but i ran into something weird.
Can anyone tell me what is my offset and what is my hex?
(I uploaded a picture)
Appreciate it,
-Dennis
| Description: |
|
| Filesize: |
17.68 KB |
| Viewed: |
4181 Time(s) |
|
|
|
| Back to top |
|
 |
Pingo
Grandmaster Cheater
![]() Reputation: 8
Joined: 12 Jul 2007
Posts: 571
|
| Posted: Sun Aug 12, 2012 4:06 pm Post subject: |
|
|
looks like the offset is just 0
_________________
|
|
| Back to top |
|
|
Gaz
Cheater
![]() Reputation: 0
Joined: 08 Aug 2012
Posts: 40
|
| Posted: Sun Aug 12, 2012 4:53 pm Post subject: |
|
|
offset 0
hex is 6911BD4
|
|
| Back to top |
|
|
Droppinacid
How do I cheat?
![]() Reputation: 0
Joined: 03 Aug 2012
Posts: 9
|
| Posted: Sun Aug 12, 2012 7:47 pm Post subject: |
|
|
yea thats what i thought, just kinda weird, when i put the hex in and press scan, nothing comes up.
Im gonna keep trying
Thanks for you're responses
-Dennis
|
|
| Back to top |
|
|
n0 m3rcY
Cheater
![]() Reputation: 0
Joined: 18 Jun 2012
Posts: 42
|
| Posted: Mon Aug 13, 2012 1:08 am Post subject: |
|
|
What that's doing is calling what's in player.dll (most likely) setting eax to that value. the brackets [] around eax mean that the instruction is accessing the eax as a pointer, and is assigning edi to the pointer eax holds.
It's probably DMA, so what you could do is replace the call command with a jmp to your codecave, call it, and then mov eax to some location within the program that is empty, then read that address. Ie:
| Code: |
001A dec edi
001B jmp 002E
001C nop
001D nop
001E mov [eax], edi
...
MyCave:
002E call player.dll+51B0
002F mov dword ptr ds:[00400000], eax ; your mem location
003A jmp 1C
|
Last edited by n0 m3rcY on Mon Aug 13, 2012 4:29 pm; edited 2 times in total |
|
| Back to top |
|
|
Droppinacid
How do I cheat?
![]() Reputation: 0
Joined: 03 Aug 2012
Posts: 9
|
| Posted: Mon Aug 13, 2012 3:49 pm Post subject: |
|
|
I don't understand what you mean.
What you just said sounded alien to me.
Could you explain it in a little more detail? Im really slow when it comes to this.
Thanks for your answer
-Dennis
|
|
| Back to top |
|
|
n0 m3rcY
Cheater
![]() Reputation: 0
Joined: 18 Jun 2012
Posts: 42
|
| Posted: Mon Aug 13, 2012 11:47 pm Post subject: |
|
|
| Droppinacid wrote: | I don't understand what you mean.
What you just said sounded alien to me.
Could you explain it in a little more detail? Im really slow when it comes to this.
Thanks for your answer
-Dennis |
Okay, so some terms:
code cave: routing the game to a seperate location where you have empty bytes and can modify the game's routine and inject instructions
pointer: stores instead of a value such as an int or data, a memory address that has the data. Use pointers to assign value to the data.
So your instructions posted are doing (from the limited instructions I can see:)
| Code: |
001A dec edi ; can't tell from context exactly what the purpose of this is
001C call player.dll+51B0 ; calls some function, most functions will follow standard windows and set eax as a return value. in this case, it's most likely allocating memory and assigning a pointer to your value (health, ammo?)
0022 mov [eax], edi ; copies edi to the data pointed to by eax, ie if eax is 0023, it assigns edi to 0023.
0025 pop edi ; just re-assigns edi's original value from when it was push'd onto the stack
0026 mov eax, 1 ; I have no idea why that's there, but that's what makes me think it's DMA because it's not storing the pointer anywhere. If it was you'd see something like:
mov dword ptr:[0000004A], eax
memory leak much? or does it generate the same pointer each time? is it getting info from a struct? are there any "push" instructions near this call instruction?
|
After looking at it, it does look somewhat like an ammo decreasing thing. Idk why it's not storing the value in eax though. What is this for, it's intriguing me.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
