| View previous topic :: View next topic |
| Author |
Message |
guy960915 Expert Cheater
Reputation: 2
Joined: 17 Sep 2007 Posts: 169
|
Posted: Fri May 30, 2008 7:56 pm Post subject: problem with looping pointer (i think?) |
|
|
i have a problem with this pointer, at level 3 , the address seems to be looping with each other , i tick it with "find out what access this addres" gives me three addres always with 4 byte offset.
a15ac38
a15ac3c
a15ac40
then, the 2nd and 3rd add nothing happened, the 1st add will give this add.
27742a0
27742a4
27742a8
then, the 1st and 3rd add. nothing, the 2nd add will give give this add 27742a0 then this add will point me to this add a15ac38 then this will loop ove and over,
why is this , did someone encounter this, what did you do?
|
|
| Back to top |
|
 |
Twilly Grandmaster Cheater Supreme
Reputation: 0
Joined: 05 Dec 2007 Posts: 1645 Location: Singapore
|
Posted: Fri May 30, 2008 11:23 pm Post subject: |
|
|
No, I don't have this problem when I tried it out. You are using CE 5.4 right?
_________________
|
|
| Back to top |
|
 |
guy960915 Expert Cheater
Reputation: 2
Joined: 17 Sep 2007 Posts: 169
|
Posted: Sat May 31, 2008 6:25 am Post subject: |
|
|
| yup i'm using 5.4
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 26004 Location: The netherlands
|
Posted: Sat May 31, 2008 6:40 am Post subject: |
|
|
when you're using the option to find what accesses or writes, keep in mind that the state of the registers is AFTER it has been executed.
So when picking an instruction, do not pick one that writes to a register used in the calculation.
e.g if you can pick between:
mov eax,[eax+104]
and
mov eax,[ebx+104]
pick the one with mov eax,[ebx+104]
else you could temporarily change to "exceptions" instead of debug reghisters. But it isn't threadsafe for the game so high chance you'll crash after using it (but might get you at least one or 2 addresses)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
guy960915 Expert Cheater
Reputation: 2
Joined: 17 Sep 2007 Posts: 169
|
Posted: Sun Jun 01, 2008 5:32 am Post subject: |
|
|
i'm messing with my old games, now i'm working on BF1942 v1.61b SP only
e.g if you can pick between:
mov eax,[eax+104]
and
mov eax,[ebx+104]
pick the one with mov eax,[ebx+104]
could you elaborate, why this
i tried the debug register the game keep crashing,
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 26004 Location: The netherlands
|
Posted: Sun Jun 01, 2008 8:18 am Post subject: |
|
|
the state of the registers are shows AFTER it has been executed
mov eax,[eax+104] will overwrite the EAX register with the value stored at [eax+104] )
and if there's really no other instruction to choose then try doing a code injection where you temporarily swap the registers.
e.g:
| Code: |
alloc(newmem,2048)
label(returnhere)
addressx:
//original mov eax,[eax+104]
jmp newmem
returnhere:
newmem:
push ebx
mov ebx,[eax+104] //now find out what accesses this address will show this line, leaving EAX intact
mov eax,ebx
pop ebx
jmp returnhere
|
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
guy960915 Expert Cheater
Reputation: 2
Joined: 17 Sep 2007 Posts: 169
|
Posted: Sun Jun 01, 2008 8:32 pm Post subject: |
|
|
okay, i'll try that,
thanks
|
|
| Back to top |
|
 |
|