Dark Byte Site Admin
Reputation: 471
Joined: 09 May 2003 Posts: 25855 Location: The netherlands
|
Posted: Wed Nov 14, 2012 12:40 pm Post subject: |
|
|
No, it's correct
A 64-bit process needs an address filled with the target address to be able to jump to it while a 32-bit process does not
The address of "sleep" in a 32-bit process is 75391100
The address of "sleep" in a 64-bit process is 7fefd611140
A direct call only has a max range of 32-bit , but to get to 7fefd611140 from 2eb0010 you need to go a distance bigger than a 32-bit value can specify, so an indirect call is needed
your "call sleep" gets rewritten to:
| Code: |
call [addresswithsleep]
jmp afteraddresswithsleep
addresswithsleep:
dq 7fefd611140
afteraddresswithsleep:
|
Also, if your target process is 64-bit you also must use the calling convention of 64-bit
| Code: |
push #1000
call sleep
|
is not valid for a 64-bit target
use something like this
| Code: |
sub rsp,28
mov rcx,#1000
call sleep
add rsp,28
|
Also, in 64-bit RAX, RCX, RDX, R8, R9, R10, R11 can be modified by a function call like sleep, so make sure those are not important, or store them. (make sure the stack stays aligned though)
Of course since there aren't that many 64-bit games out right now I doubt you have to worry about this much
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping
Last edited by Dark Byte on Wed Nov 14, 2012 12:55 pm; edited 1 time in total |
|