| View previous topic :: View next topic |
| Author |
Message |
LongBeardedLion Expert Cheater
Reputation: 0
Joined: 10 Apr 2020 Posts: 174
|
Posted: Sun Jul 05, 2020 7:59 pm Post subject: Address of function inside dll changes everytime |
|
|
I need to get the pointer or somehow get this address automatically.
It is a function that is inside one dll of the game.
Changes everytime the game is started so i have to open it in x32dbg, check symbols, go to the function, copy it and insert it in my hack manually.
I tried finding pointer for it. Nothing.
How should i proceed? |
|
| Back to top |
|
 |
atom0s Moderator
Reputation: 205
Joined: 25 Jan 2006 Posts: 8587 Location: 127.0.0.1
|
Posted: Sun Jul 05, 2020 10:53 pm Post subject: |
|
|
DLLs are loaded dynamically (hence the name) which means their base address can move. They can encourage the system to load them at a certain range, but there is no guarantee that will be adhered to.
To re-find your function, you just need to make an offset to it. That is done via:
Function Address - DLL Base Address = Offset
Then next time you load up the game, you can get the function via:
DLL Base Address + Offset = Function Address
Something to keep in mind though, this will break if the game updates the DLL.
It is better to use pattern scans for this instead. _________________
- Retired. |
|
| Back to top |
|
 |
LongBeardedLion Expert Cheater
Reputation: 0
Joined: 10 Apr 2020 Posts: 174
|
Posted: Mon Jul 06, 2020 12:41 pm Post subject: |
|
|
Thanks Atomos. But if the address of the DLL changes everytime how do i find it each time?
Is there something like a pointer to the DLL?
Ahh. So i got to do a pattern scan.[/quote] |
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 472
Joined: 09 May 2003 Posts: 25867 Location: The netherlands
|
Posted: Mon Jul 06, 2020 1:18 pm Post subject: |
|
|
use modulename+offset in ce _________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
atom0s Moderator
Reputation: 205
Joined: 25 Jan 2006 Posts: 8587 Location: 127.0.0.1
|
Posted: Mon Jul 06, 2020 4:46 pm Post subject: |
|
|
| LongBeardedLion wrote: | Thanks Atomos. But if the address of the DLL changes everytime how do i find it each time?
Is there something like a pointer to the DLL?
Ahh. So i got to do a pattern scan. | [/quote]
Depends on how you are using things and what you are doing. If you are just using CE, then what DarkByte said. You can get base addresses just using the module name directly in CE.
If you are in an injected DLL, you can use the 'GetModuleHandle' API call to obtain module base addresses.
If you are in an external program, you will need to enumerate the remote processes modules to obtain the base address. That can be done a number of different ways.
Most commonly via API such as:
- Tlhelp32: CreateToolhelp32Snapshot + Module32First/Module32Next
- PSAPI: EnumProcessModules / EnumProcessModulesEx _________________
- Retired. |
|
| Back to top |
|
 |
LongBeardedLion Expert Cheater
Reputation: 0
Joined: 10 Apr 2020 Posts: 174
|
Posted: Mon Jul 06, 2020 5:09 pm Post subject: |
|
|
modulename? you mean game.exe ? or the dll?
The dll changes address everytime |
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 472
Joined: 09 May 2003 Posts: 25867 Location: The netherlands
|
Posted: Mon Jul 06, 2020 5:54 pm Post subject: |
|
|
e.g if the dll is game.dll
first run game.dll is at 20000000 and the address you're interested in is at 20012345
second run game.dll is at 21000000 and the address you're interested in is now at 21012345
you can then tell CE that the address is
and CE will get you the correct address each time _________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
LongBeardedLion Expert Cheater
Reputation: 0
Joined: 10 Apr 2020 Posts: 174
|
Posted: Thu Jul 16, 2020 11:43 pm Post subject: |
|
|
| Thank you DarkByte. I came back to this post and solved my problem. |
|
| Back to top |
|
 |
|