| View previous topic :: View next topic |
| Author |
Message |
SomethingRandom How do I cheat?
Reputation: 0
Joined: 02 Aug 2012 Posts: 5
|
Posted: Mon Aug 06, 2012 12:32 am Post subject: How to find address of a function? |
|
|
Hi, I'm trying to set my health in Saints Row: The Third, but its not going so well...
I found the address of the health: saintsrowthethird.exe+263B2C8
Its a float, 1=full 0=dead
The problem is something else its constantly writing to it, so if I try to change it, it instantly goes back. So I did what I thought was logical and scanned for what writes to the address and I got:
detailed:
| Code: |
EAX=00000002
EBX=0018FD60
ECX=02A3B2C0
EDX=02A3B2C0
ESI=02A3B2C0
EDI=00000001
EBP=02A3B290
ESP=0018FCE4
EIP=00E0517C
Probable base pointer =02A3B2C0
00E05175 - fld dword ptr [edi+08]
00E05178 - pop edi
00E05179 - fstp dword ptr [esi+08] <<
00E0517C - mov eax,esi
00E0517E - pop esi
|
So i'm assuming there's a function that I need to call to set the health to a param of my value I want to set it to. I'm a beginner with assembly so I wanted to know if someone can point me in the right direction of finding the address to the function to set the health.
Thanks.
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25982 Location: The netherlands
|
Posted: Mon Aug 06, 2012 4:29 am Post subject: |
|
|
Perhaps it's stored somewhere else as well, e.g: Perhaps you only found the healthbar and not the actual health
(and make sure you're not online)
This function basically copies the floatign point value stored at [edi+08] into [esi+08] (your address)
I'd suggest finding out where edi+08 get it's value from (or perhaps even changing that is enough)
---
For the more advanced users:
Ultimap can be used to find the routine that changes health.
Lose health, scan for "has been executed"
Walk arround, shoot, bump into walls, etc... "Scan for "has not been executed"
Repeat a few times , filter out for "Calls" only
And you'll have a list of functions only called when you lose health
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
SomethingRandom How do I cheat?
Reputation: 0
Joined: 02 Aug 2012 Posts: 5
|
Posted: Mon Aug 06, 2012 12:52 pm Post subject: |
|
|
Thank you for the info!
I feel really stupid though, I'm not so sure how to find edi+08, the addresses in the list say EDI=00000001, which isn't a memory address.
Thanks again.
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25982 Location: The netherlands
|
Posted: Wed Aug 08, 2012 5:14 am Post subject: |
|
|
That's because the pop edi instruction in front, which places the value stored in [esp] into that register
You could try code injection to find out where the value comes from, but that's probably too complex (you could also just switch the fstp and pop lines with eachother, as their sequence doesn't matter)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
n0 m3rcY Cheater
Reputation: 0
Joined: 18 Jun 2012 Posts: 42
|
Posted: Thu Aug 09, 2012 1:56 pm Post subject: |
|
|
Break it before the fld instruction and check its value. FSTP will also pop esi so make sure you're not bp'ing on that address.
It'd help if you showed a little bit more of the function.
|
|
| Back to top |
|
 |
|