| View previous topic :: View next topic |
| Author |
Message |
KoSMoS
How do I cheat?
![]() Reputation: 0
Joined: 28 Mar 2012
Posts: 1
|
 Posted: Wed Mar 28, 2012 2:49 pm Post subject: pointer with dynamic offset help |
 |
|
Hello
im trying to find the base pointer and im stuck with this problem
that the offset is based on register value (i think)
mov eax,[esi+ebp*8+10]
ebp is part of the offset?
how to deal with this stuff?
| Code: | EAX=0B530C60
EBX=18EECD48
ECX=04325F60
EDX=00000016
ESI=191BFA30
EDI=05890000
EBP=00000000
ESP=004AE63C
EIP=6FB46A63
Probable base pointer =191BFA30
6FB46A5A - cmp edx,[edi+4C]
6FB46A5D - jne FlashPlayer_11_1_102_63_FlashPlayer+9DEFC
>>6FB46A5F - mov eax,[esi+ebp*8+10]
6FB46A63 - pop edi
6FB46A64 - pop esi
|
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 458
Joined: 09 May 2003
Posts: 25296
Location: The netherlands
|
| Posted: Wed Mar 28, 2012 3:46 pm Post subject: |
|
|
I have my doubt it's really a dynamic offset
Does it happen that ebp is ever anything else than 0?
if not, then the offset is 0*8+10 (that's 10)
In this case though, I think you can better give up trying to find a pointer and go for code injection instead and inspect the pointers data for variable names etc...
flash is an emulator, which means that the actual executed code you see is not the game's code but the emulator's code that handles everything. And from seeing the relative 2 byte jump inside a "FlashPlayer" code segment, this means that the code you're seeing isn't even JIT'ed code (automatically compiled based on the flash code) but emulated step by step
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Fresco
Grandmaster Cheater
![]() Reputation: 4
Joined: 07 Nov 2010
Posts: 600
|
| Posted: Wed Mar 28, 2012 4:53 pm Post subject: |
|
|
right... code injection is the solution
mov eax,[esi+ebp*8+10]
as you can see esi+ebp*8+10 is the value of the address;
so auto assemble, registersymbol addressx, add to the table addressx
in the auto assemble:
| Code: | push eax
mov eax,[addressx]
mov [esi+ebp*8+10],eax
pop eax |
every time the code above is executed, it will store the value of addressx (the one in your table) into the value of the address whatever
_________________
... Fresco |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
