Deathspike
How do I cheat?
![]() Reputation: 0
Joined: 28 May 2011
Posts: 7
|
 Posted: Sun May 29, 2011 2:08 pm Post subject: Library loading breakpoints? |
 |
|
First of, kudos for the VEH debugger. It's absolutely awesome and it has quickly become one of my favourite features. It doesn't get detected, at all, and works flawlessly almost all of the time.
While the pointer scanner for 64-Bit is out of commission, I tracked down the base address for a (very important, for me) double linked list through the assembly code by comparing a 64-Bit library against its 32-Bit equivalent. Now I'm facing an interesting challenge, as the following piece of code is executed..
| Code: | | 4327F758 - 48 89 9C 24 B0000000 - mov [rsp+000000B0],rbx |
Here's the interesting part, this is part of the initialization routine of the target game. This means that this code is executed once and the method in which the 'rbx' register is set is unknown to me. The same applies to 'rsp', so I was thinking about a possibility to set breakpoints prior to a module being loaded..
Think of adding a LoadLibraryA-like hook that uses the breakpoint list with modules and addresses to set breakpoints immediately after loading the library. That means some code is executed as part of the DllMain function, I don't know a way around that, but some people lurking around here might.
Sounds like an interesting feature to me. 
|
|
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25788
Location: The netherlands
|
| Posted: Mon May 30, 2011 12:51 pm Post subject: |
|
|
Only the windows debugger has a ability to cause breakpoints on LoadLibrary (add the onLoadLibrary lua event and in there cause it to break to the user interface)
You could probably set an execute breakpoint at the end of LoadLibraryA and when that is hit let a lua script handle it (lua command debugger_setBreakpoint() )
And if you don't know how to find the end you could start off with a function hook at loadLibrary (look into generateAPIHookScript and autoassemble)
where it first calls the original function, then a few nops, and then returns
Then set a breakpoint on the known address of those nops
Currently a bit busy with ce but perhaps someone can explain further or post the scripts for it. Or just ask if you have questions
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
