| View previous topic :: View next topic |
| Author |
Message |
happyreadygo
Advanced Cheater
![]() Reputation: 1
Joined: 14 Sep 2011
Posts: 87
|
 Posted: Mon Mar 25, 2013 10:36 am Post subject: Assembly code search |
 |
|
when I want to know how many opcode can be using the function that contain an opcode which change the value. I use Search>find assembly code for "call <address>".
Here is my step.
1.find the value that you want.
2.find out what writes to this address to get the opcode.
3.move on top of the opcode until you can get the first opcode of the function(noticed by some pattern like combo of int 3)
4.search in the "find assembly code" for call <address of 1st opcode>
Is instruction "call" the only one I needs to? Is there others instruction or advance method ? Sometime I can't find any result.
|
|
| Back to top |
|
 |
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Tue Mar 26, 2013 7:38 am Post subject: Re: Assembly code search |
|
|
| happyreadygo wrote: | | Is instruction "call" the only one I needs to? Is there others instruction or advance method ? |
Well "call abcdef" can also be written: | Code: | call dword [123456] //call the function whose address is stored at 123456
123456: 00abcdef |
or:
| Code: | mov eax,abcdef
call eax |
there is also:
| Code: | mov eax,123456
call dword [eax]
123456: 00abcdef |
Plus other variants if you're looking at obfuscated code = parts of a copy protection.
When I want to find all instructions that called a given function, I:
-Note the address of the function.
-Save my CE work.
-Close cheat engine.
-Attach ollydbg 1.10 with detach plugin to my game.
-In olly, set a conditional log breakpoint at the first instruction of my function, asking to always log "dword [esp]" and never pause program.
-Resume execution (F9).
-Play a bit.
-Freeze the game (F12).
-Look at olly's log: every red line is the address just after a call to my function.
-Often do some post processing in excel to remove duplicates.
-Resume game execution.
-Detach olly (plugins->detach->detach from debugee).
-Resume working with CE.
It's quite a lot of hassle, but it will always find all calls that used your function during the time you played in step 7. Well with obfuscated protected code it might not work though...
|
|
| Back to top |
|
|
happyreadygo
Advanced Cheater
![]() Reputation: 1
Joined: 14 Sep 2011
Posts: 87
|
| Posted: Tue Mar 26, 2013 8:57 am Post subject: |
|
|
thanks , i ll try it 
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
