| View previous topic :: View next topic |
| Author |
Message |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Tue Sep 20, 2016 9:14 pm Post subject: C++ 64bit virtual cave |
|
|
Hi guys.
How to get 8 bytes address? same like CE; 7fffffffffffffff
| Code: | HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetProcId("notepad.exe"));
LPVOID pRemoteThread = VirtualAllocEx(hProcess, NULL, sizeof(void*) == 8, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
|
|
| Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Wed Sep 21, 2016 11:25 am Post subject: |
|
|
WHAT ? Can you explain more
_________________
|
|
| Back to top |
|
 |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Thu Sep 22, 2016 5:23 am Post subject: |
|
|
it's working but only 5 bytes addr.
OS: Win8.1
| Description: |
|
| Filesize: |
82.01 KB |
| Viewed: |
6463 Time(s) |

|
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Sep 22, 2016 2:37 pm Post subject: |
|
|
| Code: | | LPVOID pRemoteThread = VirtualAllocEx(hProcess, NULL, 8, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
|
|
| Back to top |
|
 |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Thu Sep 22, 2016 4:43 pm Post subject: |
|
|
| Zanzer wrote: | | Code: | | LPVOID pRemoteThread = VirtualAllocEx(hProcess, NULL, 8, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
|
it's same as above.
trying "JMP 97D5680000" <==== cave address
CE report;
| Code: | | The generated code 14 bytes long, but the slected code 5 bytes long. |
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25808 Location: The netherlands
|
Posted: Thu Sep 22, 2016 4:58 pm Post subject: |
|
|
Assemble
Jmp [rip+0]
DQ address
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Thu Sep 22, 2016 8:47 pm Post subject: |
|
|
| Dark Byte wrote: | Assemble
Jmp [rip+0]
DQ address |
Thanks Dark Byte. good idea
| Code: | | DWORD64 AllocMem = VirtualAllocEx64(hProcess, (0x7FF7BB542C42 + (INT64)pRemoteThread * 32), TEST_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); |
|
|
| Back to top |
|
 |
|