koderkrazy How do I cheat? Reputation: 0
Joined: 17 Jun 2018 Posts: 1
|
Posted: Sun Jun 17, 2018 10:27 pm Post subject: help on finding static method pointer changing over versions |
|
|
I've created my first cheat table! It is for 1.56 version of a game.where I had to use pointer TelemetryManager::operator=+152164 to a static method.
This pointer changes for each game version.
Please let me know if my following method of finding the pointer is correct or is there any better way?
Existing call to the method somewhere in game code looks like this:
Code: |
TQ.exe+125A64 - 75 36 - jne TQ.exe+125A9C
TQ.exe+125A66 - 8B CE - mov ecx,esi
TQ.exe+125A68 - FF 15 945CC600 - call dword ptr [TQ.GAME::TelemetryManager::operator=+152164] { ->Game.GAME::Item::IsInDLCContent }
...
|
If I use this TQ.GAME::TelemetryManager::operator=+152164 to call the method it works for game version 1.56. But not for other versions, because the address +152164 change.
To make it work for all versions, I did AOB scan to find some existing method call. The AOB scan is for above code snippet. In scan ?? are the required address bytes.
Code: | //aob scan to read TQ.GAME::TelemetryManager::operator=+152164 function pointer.
aobscanmodule(dlcFunctionAOB,TQ.exe,75 36 8B CE FF 15 ?? ?? ?? ?? 5F 84 C0 5E 0F 94 C0)
registersymbol(dlcFunctionAOB)
alloc(dlcFunctionPTR,4)
registersymbol(dlcFunctionPTR)
dlcFunctionPTR:
readmem(dlcFunctionAOB+6,4)
registersymbol(_isDLCFunctionSet)
alloc(_isDLCFunctionSet, 4)
_isDLCFunctionSet:
db 00 00 00 00 |
Now I got the pointer in dlcFunctionPTR So here is how I used it to call the method in my cheat:
Code: |
cmp [_isDLCFunctionSet], 1 // do this conversion only once or the game crashes
je @f
mov eax,[dlcFunctionPTR]
mov eax,[eax]
mov [dlcFunctionPTR], eax
mov [_isDLCFunctionSet], 1
@@:
call dword ptr [dlcFunctionPTR] //yey!! this call works for every version now
|
Let me know if you want me to upload cheat table .ct file for more understanding.
|
|