| View previous topic :: View next topic |
| Author |
Message |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Sun Mar 04, 2007 6:25 pm Post subject: I need help with multilevel pointers |
|
|
I was wondering if anyone can help me out with the multilevel pointers in tutorial.exe
Here's what I'm doing:
Value = 1580 so i scan for that and find it on first scan
Find what writes to it and change value and the code pops up
I do More Info on the code and search for the value of the pointer needed.
it finds one result, I add a pointer address manually using the search result and the offset
I have a pointer, but i need the pointer to this pointer so I right click the new pointer I found and click find what writes to this address
A window pops up saying this is a pointer "Find out what writes to this pointer" and "Find what reads from the address pointed at by this pointer" the tutorial.exe says to do exactly what I did last time so I press "Find what reads from the address pointed at by this pointer"
I click "Change Value" back in the tutorial and it finds the opcode again, but it's the same opcode as last time, doing any more info/pointer scan will only find the pointer I already have. I'm not sure what I am doing wrong as I am doing exactly what I did the first time as it says to do in the tut. Any advice? Thanks! |
|
| Back to top |
|
 |
UnXsIsT How do I cheat?
Reputation: 0
Joined: 04 Mar 2007 Posts: 1
|
Posted: Sun Mar 04, 2007 7:52 pm Post subject: |
|
|
I am also trapped in this tutorial  |
|
| Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Sun Mar 04, 2007 10:17 pm Post subject: |
|
|
That's the last part in the tutorial too =(
I passed it but by freezing the process and changing the value to 5000 after i'd changed the pointer lol, but this still doesn't teach me how to find multilevel pointers. |
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6300
|
Posted: Mon Mar 05, 2007 12:06 am Post subject: |
|
|
If you set a break on the address you find, Look at the asm instructions above the break.
You will see something that will help you.
This is why you need to understand some basic assembly.
You already know what a "address" looks like.
Dont forget about reverse byte order too.... |
|
| Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Mon Mar 05, 2007 12:25 am Post subject: |
|
|
| Labyrnth wrote: | If you set a break on the address you find, Look at the asm instructions above the break.
You will see something that will help you.
This is why you need to understand some basic assembly.
You already know what a "address" looks like.
Dont forget about reverse byte order too.... |
no idea what you just said, but I'll look into it thanks
I set a break at 00456160 which is mov [eax+18],esi
then pressed change value
the registers to the right turned red, the program stopped responding until i pressed Run, anddddd I don't know what I'm looking for. esi?? esi = 00000C6B so what do I do with that? umm sorry I am ultra confused now.
I understand the eax+18 part is the address, eax = 008F9FDC then add 18 to that and it's the address of the value, so esi should be what is being placed into eax right, but where is esi coming from, this would tell me where the next level pointer is wouldn't it? Thanks again |
|
| Back to top |
|
 |
Labyrnth Moderator
Reputation: 10
Joined: 28 Nov 2006 Posts: 6300
|
Posted: Mon Mar 05, 2007 1:23 am Post subject: |
|
|
mov [eax+18],esi
^ ok this looks right, Now look at the instructions above this one.
scroll up some in memory view and sit and stare a sec.
esi is the value of the address you set the break on. |
|
| Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Mon Mar 05, 2007 7:55 pm Post subject: |
|
|
eh... I'll just use the pointer scan feature
I stared for 10 minutes nothing happend
I learn better with hands on step by step, Im not smart enough to follow hints  |
|
| Back to top |
|
 |
stanoja Cheater
Reputation: 0
Joined: 08 Mar 2007 Posts: 33 Location: Mk.
|
Posted: Fri Mar 09, 2007 1:54 pm Post subject: |
|
|
I did the tutorial, it was really easy.
I'll explain the Multi-level pointer step, step-by-step:
1.Find the value's address
ex: 3182, add 00976CE4
2.Find out what writes to the address:
3.On the code, click extra info
you'll get:
| Code: |
address1 - code //the address you need is ADDRESS3
address2 - code //and the thing you should look up is
>>ADDRESS3 - mov [eax+18],esi //[eax+18]-the address the pointer
address4 - code //points to, and esi-the value the pointer
address5 - code //writes to [eax+18].
|
Copy memory
The value of the pinter needed to find this address is [hex value]
--------------------------------------------------------
3.In CE search for the [hex value] you found before in Extra Info
4.You'll find an Address with the value you searched.
5.Copy the address, it's the pointer's address.
6.Go to Memory Viewer.
Go to Tools->Pointer Scan Ctrl+P
7.In the Pointer Scan window goto Pointer Scanner->Scan for pointers Ctrl+p
8.Paste the address in the field.
and set the options on this case:
you know it's a level-4 pointer, so fill the bottom left field called
Max Level with "4".
9.Scan.
You got too many results,yeah?
10.In the tutorial click Change Pointer, and you got new value with new address, and the pointer has changed it's address too.
repeat steps 1,2,3,4 & 5 to find the new pointer address...
11.Goto the pointer scan results and goto Pointer Scanner->Rescan memory.....
12.Paste the new pointer address.
13.Finally, you found the ponter...
Study it, practice...
I think it'll do a good job to you![/quote] _________________
Busy thinking... |
|
| Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Sun Mar 11, 2007 5:06 am Post subject: |
|
|
| right, I know how to use the pointer scan feature that's not the problem. I don't know the sequence of events in finding a pointer to a pointer to a pointer to a pointer manually without the use of pointer scan. The instructions in the tutorial do not work. |
|
| Back to top |
|
 |
stanoja Cheater
Reputation: 0
Joined: 08 Mar 2007 Posts: 33 Location: Mk.
|
Posted: Sun Mar 11, 2007 7:09 am Post subject: |
|
|
Manually:
Not possible...Only Theoretically...
It's a little(moro than a little) confusing..
Like Watching people sending a messageone-2-anoth-2-anoth.
You'll know the end message, but where it started, and where it passed?
My word: IMPOSSIBLE _________________
Busy thinking... |
|
| Back to top |
|
 |
|