| View previous topic :: View next topic |
| Author |
Message |
2Beastmode4u Newbie cheater
Reputation: 1
Joined: 13 Dec 2010 Posts: 20
|
Posted: Mon Apr 11, 2011 5:25 pm Post subject: AoBs Help |
|
|
Can someone please help me understand how to find AoBs and how to know what to change them to? Thanks. _________________
Xx2Beast4uxX |
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25976 Location: The netherlands
|
Posted: Mon Apr 11, 2011 5:31 pm Post subject: |
|
|
you first find out the code you want to change, then when you've found it you make a aob out of that code and make sure you replace static addresses in the aob with wildcards
example: The original code before you edit it looks like this:
| Code: |
00525032 - A3 A4EF5700 - mov [0057EFA4],eax
00525037 - B8 10505200 - mov eax,00525010 : [000000C3]
0052503C - A3 A8EF5700 - mov [0057EFA8],eax
00525041 - B8 002A4000 - mov eax,00402A00 : [009D8BE8]
00525046 - A3 ACEF5700 - mov [0057EFAC],eax
0052504B - A0 40665200 - mov ax,[00526640] : [0000]
|
then the aob would then be:
a3 ** ** ** b8 ** ** ** a3 ** ** ** b8 ** ** ** a0
(probably not the best example, but you get the idea) _________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
2Beastmode4u Newbie cheater
Reputation: 1
Joined: 13 Dec 2010 Posts: 20
|
Posted: Mon Apr 11, 2011 5:47 pm Post subject: |
|
|
What are wildcards? And no i dont get it... sorry. _________________
Xx2Beast4uxX |
|
| Back to top |
|
 |
Geri Moderator
Reputation: 112
Joined: 05 Feb 2010 Posts: 5627
|
Posted: Mon Apr 11, 2011 6:47 pm Post subject: |
|
|
The wildcards are the ** charachters. Those bytes can be anything. For example if you put in
A3 * * * *
then this aobscan will scan for 5 bytes and the fist one is A3, the rest of them can be anything.
It would find
A3 A4EF5700
A3 A8EF5700
A3 ACEF5700
The first byte is the same and the rest doesn't matter. When you make an aobscan, you will in the bytes that will probably not change, like the first bytes (the instructions) and you can use * for the rest of them.
Try to make a few "Array of bytes" scan in CE and you will see. _________________
|
|
| Back to top |
|
 |
|