| View previous topic :: View next topic |
| Author |
Message |
rain-13
Expert Cheater
![]() Reputation: 0
Joined: 18 Mar 2009
Posts: 110
|
 Posted: Tue Feb 05, 2013 8:38 am Post subject: How to calculate value for complex pointer offsets? |
 |
|
Hello
I would like to know how to calculate value for complex pointer offsets.
On picture it shows eax+8e8. How do I calculate such value? When I tries just 8e8 then it didn't work. sometimes I have also found something like eax+ecx*8+4. How do I calculate that?
|
|
| Back to top |
|
 |
TsTg
Master Cheater
 Reputation: 5
Joined: 12 Dec 2012
Posts: 340
Location: Somewhere....
|
| Posted: Tue Feb 05, 2013 9:31 am Post subject: |
|
|
to find how EAX value is collected here (the EAX=3A4BC798 in your picture).
you have to go through the instructions one by one in the inverse direction, in your picture, new EAX gets the value from what inside Old EAX+ 0x8E8 offset, and the OLD eax is collected from what inside the current EDI+0xF0 offset, then EDI is collected from somewhere else,.....so keep back-tracing till you find something like MOV ESI,DWORD [0x1034BAC] where the 0x1034BAC
is a static location inside your game file.
It may take a lot of instructions or a long time of finding them(depends on experience).
The same thing is applied if you trace instructions like MOV EAX,[EAX+ECX*8+4] , this type is used commonly with switchable game options for a single purpose (ex: selecting your current weapon in a game, then telling you the current ammo left for that weapon).
just here you'll find how eax and ecx values are collected.
|
|
| Back to top |
|
|
Screitor
Cheater
![]() Reputation: 1
Joined: 26 Nov 2012
Posts: 33
Location: Venezuela
|
| Posted: Tue Feb 05, 2013 10:56 am Post subject: Re: How to calculate value for complex pointer offsets? |
|
|
| rain-13 wrote: | Hello
I would like to know how to calculate value for complex pointer offsets.
On picture it shows eax+8e8. How do I calculate such value? When I tries just 8e8 then it didn't work. |
Sometimes the CE isn't very accurate with the calculations of pointers, so that's where you have to intervene and try to:
- Calculate the offset by grope: increasing or decreasing the offset by 1, and so on untill you get the offset that you're looking for. (Not recommended)
- Or simply subtract the smallest address of the bigger one, and so getting the real offset. (Recommended)
Example of recommendation:
Suppose that we have a dynamic memory address 0x11DDDB60, and its pointer 0x0035A510.
The value to which the pointer points, is: 0x11DD85E8.
Therefore, subtracting the dynamic memory address 0x11DDDB60, to the value pointed by the pointer 0x11DD85E8 what we get is the exact offset 0x5578.
0x11DDDB60 - 0x11DD85E8 = 0x5578
That's perhaps the same offset that the CE is giving us, otherwise, we would take this offset as valid.
-------------------------------------------------------------------
| rain-13 wrote: | | sometimes I have also found something like eax+ecx*8+4. How do I calculate that? |
| CE Tutorial - Step 6 wrote: | example of a more complicated instruction:
[EAX*2+EDX+00000310]
EAX = 4C.
EDX = 00801234.
In this case EDX would be the value the pointer has, and EAX*2+EDX+00000310 the offset, so the offset you'd fill in would be:
2*4C+00000310 = 3A8. (this is all in hex, use cal.exe from windows in scientific mode to calculate) |
The same principle applies to your problem.
_________________
Everybody lies.
Last edited by Screitor on Tue Feb 05, 2013 11:10 am; edited 1 time in total |
|
| Back to top |
|
|
Fresco
Grandmaster Cheater
![]() Reputation: 4
Joined: 07 Nov 2010
Posts: 600
|
|
| Back to top |
|
|
rain-13
Expert Cheater
![]() Reputation: 0
Joined: 18 Mar 2009
Posts: 110
|
| Posted: Tue Feb 05, 2013 11:41 am Post subject: |
|
|
Thanks for you reply.
| Quote: | | so keep back-tracing till you find something like MOV ESI,DWORD [0x1034BAC] where the 0x1034BAC is a static location inside your game file. |
| Quote: | | MOV ESI,DWORD [0x1034BAC] |
Why did this EDI change to ESI?
does it mean that I use 0x1034BAC as address and not as pointer or offset?
| Quote: | | Or simply subtract the smallest address of the bigger one, and so getting the real offset. (Recommended) |
If guessed value is 3A4BC798 and original address is 5Fxxxxxx then I subtract: 5Fxxxxxx - 3A4BC798 but if guessed value were 5Fxxxxxx then I would subtract: 5Fxxxxxx - 3A4BC798 ? Also does it make any difference if I have multilevel pointer?
|
|
| Back to top |
|
|
TsTg
Master Cheater
Reputation: 5
Joined: 12 Dec 2012
Posts: 340
Location: Somewhere....
|
| Posted: Tue Feb 05, 2013 3:44 pm Post subject: |
|
|
| rain-13 wrote: |
Why did this EDI change to ESI?
|
I did not mean it to be ESI or EDI exactly, this is just example, and the code may use more than these two registers to get the values of your pointer, a little example here.
| Code: |
MOV EAX,DWORD [01034BAC]
MOV ESI,[EAX+08]
LEA EDI,[ESI+A8]
MOV ECX,[EDI+20]
MOV EDI,[ECX]
MOV EAX,[EDI+F0]
MOV EAX,[EAX+8E8]
|
this is how the game gets the dynamic address every time accurately
| rain-13 wrote: |
does it mean that I use 0x1034BAC as address and not as pointer or offset?
|
when we say MOV EAX,[1034BAC] this means the game will read the value inside the STATIC address 01034BAC ,then gives the value to EAX
|
|
| Back to top |
|
|
rain-13
Expert Cheater
![]() Reputation: 0
Joined: 18 Mar 2009
Posts: 110
|
| Posted: Tue Feb 05, 2013 4:30 pm Post subject: |
|
|
| Thank you for your reply. I'll play around with it a little and write back if I need any more help.
|
|
| Back to top |
|
|
rain-13
Expert Cheater
![]() Reputation: 0
Joined: 18 Mar 2009
Posts: 110
|
| Posted: Wed Feb 06, 2013 7:07 am Post subject: |
|
|
| I tried this. I went to memory location that was marked red and started to scroll up, but I only saw this endless wall of complex offsets. Just wondering if I was doing something wrong or was it just bad luck?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
in hex