| View previous topic :: View next topic |
| Author |
Message |
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
 Posted: Tue Feb 07, 2017 6:31 pm Post subject: |
 |
|
Wait...I just reread your OP...so you have the address of the value already?
| Quote: | Is the any way to know the register value of an address you found in the Memory View? Break and trace instructions doesn't work because the value doesn't change normally.
For example, the assemble code is: mov rax,[rcx+000000D8] And I need to know rcx to have the exact address I need. |
Based on what you wrote, just subtract D8 from the address that you found.
Last edited by ++METHOS on Tue Feb 07, 2017 6:41 pm; edited 2 times in total |
|
| Back to top |
|
 |
Greenhouse
Cheater
 Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 6:33 pm Post subject: |
|
|
| ++METHOS wrote: |
Based on what you wrote, just add D8 to the address that you found. |
I mean the memory view address, not the RCX one. That's what I wanted to know.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Tue Feb 07, 2017 6:38 pm Post subject: |
|
|
If the address of your value is 7711111111, and your instruction is [rcx+D8], then rcx = 7711111039.
The address of your value is 7711111111, rcx is 7711111039.
7711111111 - D8 = 7711111039
Unless I am not understanding you.
|
|
| Back to top |
|
|
Greenhouse
Cheater
Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 6:43 pm Post subject: |
|
|
| ++METHOS wrote: | If the address of your value is 7711111111, and your instruction is [rcx+D8], then rcx = 7711111039.
The address of your value is 7711111111, the address of rcx is 7711111039.
Unless I am not understanding you. |
This is the function I have:
I want to know the RCX value to add the D8 and I will get the value I need.
Last edited by Greenhouse on Tue Feb 07, 2017 6:50 pm; edited 2 times in total |
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Tue Feb 07, 2017 6:47 pm Post subject: |
|
|
So, you didn't actually find the address of the value that you want to manipulate, you found the address of the instruction that accesses that value? Just to be clear...
If you're trying to find the address in order to manipulate a value (makes more sense), then I would ask how you know that you're dealing with the correct instruction. If you know, for a fact, that it's right, then you can try pausing the target at startup and setting a breakpoint before that code gets executed:
| Code: | function onOpenProcess(pid)
-- print("opened pid " .. pid)
end
shellExecute("C:\\Program Files (x86)\\Game\\Game.exe")
openProcess("Game.exe")
pause() |
Change the values above to match your game sub-folder and executable and execute that script to launch the target.
Once paused, find the instruction in memory viewer and set a breakpoint on it. Unpause the process.
If the instruction accesses multiple addresses, then you'll have to go through them all and write them down to find the address that you're looking for.
|
|
| Back to top |
|
|
Greenhouse
Cheater
Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 6:52 pm Post subject: |
|
|
| ++METHOS wrote: | So, you didn't actually find the address of the value that you want to manipulate, you found the address of the instruction that accesses that value? Just to be clear...
If you're trying to find the address in order to manipulate a value (makes more sense), then I would ask how you know that you're dealing with the correct instruction. If you know, for a fact, that it's right, then you can try pausing the target at startup and setting a breakpoint before that code gets executed:
| Code: | function onOpenProcess(pid)
-- print("opened pid " .. pid)
end
shellExecute("C:\\Program Files (x86)\\Game\\Game.exe")
openProcess("Game.exe")
pause() |
Change the values above to match your game sub-folder and executable and execute that script to launch the target.
Once paused, find the instruction in memory viewer and set a breakpoint on it. Unpause the process.
If the instruction accesses multiple addresses, then you'll have to go through them all and write them down to find the address that you're looking for. |
As I said I already did that. And I know it's the correct instruction because I'm looking at an older version and it uses the same one.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Tue Feb 07, 2017 6:54 pm Post subject: |
|
|
| Greenhouse wrote: | | As I said I already did that. And I know it's the correct instruction because I'm looking at an older version and it uses the same one. |
-In other words, you DON'T know if it's the correct instruction, you are only hoping that it is. That said, you may be wasting your time.
In the case that the newer version has disabled whatever feature/value that this instruction accesses, you may be able to force the applicable to unlock them again. You'll have to redirect code to execute that sub-routine. Find where it's getting jumped over or try to execute it manually.
|
|
| Back to top |
|
|
Greenhouse
Cheater
Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 6:56 pm Post subject: |
|
|
| ++METHOS wrote: | | Greenhouse wrote: | | As I said I already did that. And I know it's the correct instruction because I'm looking at an older version and it uses the same one. |
-In other words, you DON'T know if it's the correct instruction, you are only hoping that it is. That said, you may be wasting your time. |
It's the only possible one. There's nothing else left.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Tue Feb 07, 2017 6:57 pm Post subject: |
|
|
| I edited my post.
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Tue Feb 07, 2017 6:58 pm Post subject: |
|
|
| Load a previous version of the game, when the instruction was actually used, and find a different instruction that accesses it instead?
|
|
| Back to top |
|
|
Greenhouse
Cheater
Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 7:09 pm Post subject: |
|
|
| ++METHOS wrote: |
In the case that the newer version has disabled whatever feature/value that this instruction accesses, you may be able to force the applicable to unlock them again. You'll have to redirect code to execute that sub-routine. Find where it's getting jumped over or try to execute it manually. |
I looked that on IDA and it just sends you to an empty sub-routine.
| Zanzer wrote: | | Load a previous version of the game, when the instruction was actually used, and find a different instruction that accesses it instead? |
Take a look at that, read the descriptions.
http://imgur.com/a/kZCSh
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Tue Feb 07, 2017 7:14 pm Post subject: |
|
|
Remove 1 offset from your pointer and find out what instructions access that address.
See if any of those instructions work in the newer version.
You can then resolve that new pointer and add your +D8 offset to the result.
|
|
| Back to top |
|
|
Greenhouse
Cheater
Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 7:18 pm Post subject: |
|
|
| Zanzer wrote: | Remove 1 offset from your pointer and find out what instructions access that address.
See if any of those instructions work in the newer version.
You can then resolve that new pointer and add your +D8 offset to the result. |
When I remove an offset there's no instructions accessing it.
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4196
|
| Posted: Tue Feb 07, 2017 7:31 pm Post subject: |
|
|
| Greenhouse wrote: | | I looked that on IDA and it just sends you to an empty sub-routine. |
-Obviously, if it was disabled...but you'll jump back to whatever code you came from.
Regarding what Zanzer suggests:
I think he means, continue removing a byte (or 4 bytes) to see if anything is accessing those addresses:
7711111039
7711111038
7711111037
7711111036
7711111035
et al.
Because the address that you're looking for may not get accessed in the newer version, but one of the many addresses inside the same data structure might be getting accessed.
Furthermore, doing as Zanzer suggests and looking at other, potential injection locations from the previous version may get you somewhere.
That said, none of this may matter if the game has been re-written to disable whatever feature that the value that you're trying to manipulate is even associated with. So, I would start with that.
Last edited by ++METHOS on Tue Feb 07, 2017 7:37 pm; edited 1 time in total |
|
| Back to top |
|
|
Greenhouse
Cheater
Reputation: 0
Joined: 20 Aug 2016
Posts: 44
|
| Posted: Tue Feb 07, 2017 7:36 pm Post subject: |
|
|
| ++METHOS wrote: | -Obviously, if it was disabled...but you'll jump back to whatever code you came from.
Regarding what Zanzer suggests:
I think he means, continue removing a byte (or 4 bytes) to see if anything is accessing those addresses:
7711111039
7711111038
7711111037
7711111036
7711111035
et al.
Because the address that you're looking for may not get accessed, but one of the many addresses inside the same data structure might be getting accessed.
Furthermore, doing as Zanzer suggests and looking at other, potential injection locations from the previous version may get you somewhere.
That said, none of this may matter if the game has been re-written to disable whatever feature that the value that you're trying to manipulate is even associated with. So, I would start with that. |
That what I said. It's a function to open the console. They disabled it on the newest version. I'll try to do that later, but I don't think it's possible.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
