View previous topic :: View next topic |
Author |
Message |
vasili111 Newbie cheater
Reputation: 0
Joined: 12 Jan 2016 Posts: 12
|
Posted: Sat Jan 16, 2016 1:41 pm Post subject: I am finding string but can't find its hex representation. |
|
|
I am scanning VLC player.
When I am scanning for "00:04" (it represents current time of video file) without quotation marks of course, I am finding it. Unicode checkbox is not checked.
But if I am trying to scan for 0x30303a3034 (hex representation of "00:04") I can't find it. I use value type 4 bytes, Hex checkbox is checked.
Question: Why I can't find 0x30303a3034 when I am finding "00:04"?
|
|
Back to top |
|
 |
mgostIH Expert Cheater
Reputation: 3
Joined: 01 Jan 2016 Posts: 159
|
Posted: Sat Jan 16, 2016 1:43 pm Post subject: Re: I am finding string but can't find its hex representatio |
|
|
vasili111 wrote: | I am scanning VLC player.
When I am scanning for "00:04" (it represents current time of video file) without quotation marks of course, I am finding it. Unicode checkbox is not checked.
But if I am trying to scan for 0x30303a3034 (hex representation of "00:04") I can't find it. I use value type 4 bytes, Hex checkbox is checked.
Question: Why I can't find 0x30303a3034 when I am finding "00:04"? |
Because strings are stored in little endian inside the memory, while the 4 bytes search option scans for a big endian format (or the reverse).
Use the array of bytes type to scan for it.
_________________
|
|
Back to top |
|
 |
vasili111 Newbie cheater
Reputation: 0
Joined: 12 Jan 2016 Posts: 12
|
Posted: Sat Jan 16, 2016 2:19 pm Post subject: |
|
|
Thanks!
Array of bytes finds it.
As far as I understand in little endian I should search for 0x303A303000000034 but when scanning cant find anything.
Which hex number should I scan for when scanning for 4 byte Value type to find 00:00 representation?
|
|
Back to top |
|
 |
mgostIH Expert Cheater
Reputation: 3
Joined: 01 Jan 2016 Posts: 159
|
Posted: Sat Jan 16, 2016 2:35 pm Post subject: |
|
|
When you find the right address with the array of bytes scan, change the type of the address you got into 4 bytes and hexadecimal view.
It will say how the value is read in 4 bytes standard.
Anyway, generally, if in memory viewer the address stores something like:
the code will be represented in 4 bytes as:
_________________
|
|
Back to top |
|
 |
vasili111 Newbie cheater
Reputation: 0
Joined: 12 Jan 2016 Posts: 12
|
Posted: Sat Jan 16, 2016 3:16 pm Post subject: |
|
|
Sorry, but I can't post images, so I posted my post to pastebin: pastebin_com/YKueMPYF
Please put that text in post reply and hit preview.
|
|
Back to top |
|
 |
mgostIH Expert Cheater
Reputation: 3
Joined: 01 Jan 2016 Posts: 159
|
Posted: Sat Jan 16, 2016 3:31 pm Post subject: |
|
|
Ok, you are not searching the right value because 4byte has a limit of size that you are not considering.
First of all, there's no reason to use the 4 byte scan over the array of bytes for cases like this.
Second of all, 4 bytes, as the name suggest, can only get to a size of 4 bytes max. Inputting 5 bytes would not work.
What you can do is add an address manually, add the address you found with array of bytes, but selecting a 4 byte type for it.
Still, I consider this useless, you can't change the whole timer with a 4 byte value.
_________________
|
|
Back to top |
|
 |
vasili111 Newbie cheater
Reputation: 0
Joined: 12 Jan 2016 Posts: 12
|
Posted: Sat Jan 16, 2016 3:39 pm Post subject: |
|
|
Can you please say from screenshots which 4 bytes hex number I should scan for to find in 0x03442C5A address?
|
|
Back to top |
|
 |
mgostIH Expert Cheater
Reputation: 3
Joined: 01 Jan 2016 Posts: 159
|
Posted: Sat Jan 16, 2016 4:10 pm Post subject: |
|
|
vasili111 wrote: | Can you please say from screenshots which 4 bytes hex number I should scan for to find in 0x03442C5A address? |
Use the Add address manually button and add directly the address 03442C5A as a 4 byte.
_________________
|
|
Back to top |
|
 |
vasili111 Newbie cheater
Reputation: 0
Joined: 12 Jan 2016 Posts: 12
|
Posted: Sun Jan 17, 2016 10:25 am Post subject: |
|
|
Thank you
|
|
Back to top |
|
 |
|