View previous topic :: View next topic |
Author |
Message |
tested05 How do I cheat? Reputation: 0
Joined: 24 Jan 2018 Posts: 3
|
Posted: Wed Jan 24, 2018 2:40 am Post subject: Finding hidden module pointer addresses |
|
|
Base address 0x00001234, the address of the pointer to this address is
test.dll + 0x1234.
However, if test.dll is hidden due to peb unlinking, the Cheat Engine will not recognize the module and will return 0x00001234 instead of the pointer address.
I'm wondering if there is a way for the cheat engine to return a pointer based on that module, even if the module is hidden.
|
|
Back to top |
|
|
atom0s Moderator Reputation: 198
Joined: 25 Jan 2006 Posts: 8517 Location: 127.0.0.1
|
Posted: Wed Jan 24, 2018 2:48 am Post subject: |
|
|
Manually find where test.dll is loaded, relink it to the PEB. Or just use the address where its properly found at.
_________________
- Retired. |
|
Back to top |
|
|
tested05 How do I cheat? Reputation: 0
Joined: 24 Jan 2018 Posts: 3
|
Posted: Wed Jan 24, 2018 3:02 am Post subject: |
|
|
atom0s wrote: | Manually find where test.dll is loaded, relink it to the PEB. Or just use the address where its properly found at. |
I dont know relink peb manually. Is it possible with cheat engine?
|
|
Back to top |
|
|
FreeER Grandmaster Cheater Supreme Reputation: 53
Joined: 09 Aug 2013 Posts: 1091
|
Posted: Wed Jan 24, 2018 6:29 am Post subject: |
|
|
google gave this for "peb relinking" (edited, oops-ing lol) https://www.unknowncheats.me/forum/c-and-c/81519-unlinking-and-relinking-loaded-dlls-peb.html
looks annoying...of course pretty much anything is possible in CE if you know what you are doing since you can execute arbitrary assembly code which is what compiled languages get compiled into.
presumably you could just do an aobscan for something in the module and subtract the offset to get the module's base address and then register the dll name as a symbol at that base address and continue on as if it was linked for most purposes in CE...
Last edited by FreeER on Wed Jan 24, 2018 7:11 am; edited 1 time in total |
|
Back to top |
|
|
tested05 How do I cheat? Reputation: 0
Joined: 24 Jan 2018 Posts: 3
|
Posted: Wed Jan 24, 2018 6:50 am Post subject: |
|
|
FreeER wrote: | google gave this for "peb relinkinking"
looks annoying...of course pretty much anything is possible in CE if you know what you are doing since you can execute arbitrary assembly code which is what compiled languages get compiled into.
presumably you could just do an aobscan for something in the module and subtract the offset to get the module's base address and then register the dll name as a symbol at that base address and continue on as if it was linked for most purposes in CE... |
I just succeeded. Thank you bro
|
|
Back to top |
|
|
atom0s Moderator Reputation: 198
Joined: 25 Jan 2006 Posts: 8517 Location: 127.0.0.1
|
Posted: Wed Jan 24, 2018 3:38 pm Post subject: |
|
|
tested05 wrote: | atom0s wrote: | Manually find where test.dll is loaded, relink it to the PEB. Or just use the address where its properly found at. |
I dont know relink peb manually. Is it possible with cheat engine? |
Yes it is entirely possible with just CE. All you are doing is writing pointers to a linked list.
_________________
- Retired. |
|
Back to top |
|
|
|