| View previous topic :: View next topic |
| Author |
Message |
siddharth507 How do I cheat?
Reputation: 0
Joined: 19 Oct 2014 Posts: 3
|
Posted: Sun Oct 19, 2014 2:59 am Post subject: want to know value of register in these codes..... |
|
|
want to know value of register in these codes.....can any one help
0C726948 - 55 - push ebp
0C726949 - 8B EC - mov ebp,esp
0C72694B - 57 - push edi
0C72694C - 83 EC 04 - sub esp,04
0C72694F - 8B 7D 08 - mov edi,[ebp+08]
0C726952 - 8B 4F 08 - mov ecx,[edi+08]
0C726955 - 8B 47 08 - mov eax,[edi+08]
0C726958 - C1 E0 0B - shl eax,0B
0C72695B - 33 C8 - xor ecx,eax
0C72695D - 8B 47 0C - mov eax,[edi+0C]
0C726960 - 89 47 08 - mov [edi+08],eax
0C726963 - 8B 47 10 - mov eax,[edi+10]
0C726966 - 89 47 0C - mov [edi+0C],eax
0C726969 - 8B 47 14 - mov eax,[edi+14]
0C72696C - 89 47 10 - mov [edi+10],eax
0C72696F - 8B 47 14 - mov eax,[edi+14]
0C726972 - 8B 57 14 - mov edx,[edi+14]
0C726975 - C1 EA 13 - shr edx,13
0C726978 - 33 C2 - xor eax,edx
0C72697A - 8B D1 - mov edx,ecx
0C72697C - C1 EA 08 - shr edx,08
0C72697F - 33 CA - xor ecx,edx
0C726981 - 33 C1 - xor eax,ecx
0C726983 - 8B C8 - mov ecx,eax
0C726985 - 89 4F 14 - mov [edi+14],ecx
0C726988 - 8D 65 FC - lea esp,[ebp-04]
0C72698B - 5F - pop edi
0C72698C - C9 - leave
0C72698D - C3 - ret
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Sun Oct 19, 2014 3:03 am Post subject: |
|
|
| Set a breakpoint on the instruction that you are interested in. You can see the value of any given register at that instance.
|
|
| Back to top |
|
 |
siddharth507 How do I cheat?
Reputation: 0
Joined: 19 Oct 2014 Posts: 3
|
Posted: Sun Oct 19, 2014 3:05 am Post subject: |
|
|
| tried but failed....choose a thread comes.....dont know which thread to choose
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Sun Oct 19, 2014 3:57 pm Post subject: |
|
|
Can you elaborate? You failed how? Were you able to attach the debugger and set a breakpoint?
If you are looking for a specific address, you'll have to inject some code to filter out the unwanted addresses.
|
|
| Back to top |
|
 |
siddharth507 How do I cheat?
Reputation: 0
Joined: 19 Oct 2014 Posts: 3
|
Posted: Mon Oct 20, 2014 11:23 am Post subject: |
|
|
I was able to attach debugger but i have to select a thread from listed thread....and i don't know which thread to select.
I just want to know the value in EAX after this codes get executed.
0C726948 - 55 - push ebp
0C726949 - 8B EC - mov ebp,esp
0C72694B - 57 - push edi
0C72694C - 83 EC 04 - sub esp,04
0C72694F - 8B 7D 08 - mov edi,[ebp+08]
0C726952 - 8B 4F 08 - mov ecx,[edi+08]
0C726955 - 8B 47 08 - mov eax,[edi+08]
value stored now in EAX.
|
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Mon Oct 20, 2014 11:52 am Post subject: |
|
|
Just put a breakpoint on:
0C726955 - 8B 47 08 - mov eax,[edi+08]
That should show you everything you need to get whatever information you're after. Since the value of [edi+08] is being moved in to eax, that's all you need.
|
|
| Back to top |
|
 |
nawaz50 How do I cheat?
Reputation: 0
Joined: 20 Nov 2014 Posts: 1
|
Posted: Thu Nov 20, 2014 12:20 am Post subject: nice |
|
|
there is a simple program in which you change values on the right from 0-3 and it makes a graph (caries risk). but it doesn't use simple modifiers like sum of values but something more detailed. i'd like to know values passed during changing those numbers so i could make this chart in excel. how can i do that?
in google you can search for graphics of "cariogram" software.
|
|
| Back to top |
|
 |
|