Posted: Sat Feb 22, 2014 1:21 pm Post subject: Problems with hidden pointers (flickering)
Hey,
I'm trying to read some data from a Game.exe (only read - to have a comprehensive one page list of all relevant values etc). i first started with VALUE1 and VALUE2 and managed to get successful pointers. They are both based on the same starting point - "mdnsNSP.dll"+0001ED30 with different 5level offsets
After that, the game was updated.
Now when I try to look for a pointer to VALUE3 etc. I manage to get tons of pointers (10+mil), after second run I manage to get it 10k but after 3rd scan - it immediatelly goes to 0.
Previously found pointers work perfectly - but when I try to find them again - I get the same problem as with VALUE3 - zero results even thought previously found ones work
What is a possible cause? How to go around it? For some reason the pointers done before work perfectly?
I noticed that pointers (for VALUE1 and VALUE2) added to CE flicker - they show proper value for few seconds - then they just turn to "??" for couple seconds and back to showing proper value.
They are both based on the same starting point - "mdnsNSP.dll"+0001ED30 with different 5level offsets
mdnsNSP.dll belongs to a network service called Bonjour (by Apple) and is installed with iTunes for example. That means it's probably totally unrelated to your game so pointers with bases in that dll aren't good ones (most likely), which would explain why they are unstable ("flicker").
dpdsbd wrote:
when I try to look for a pointer to VALUE3 etc. I manage to get tons of pointers (10+mil), after second run I manage to get it 10k but after 3rd scan - it immediatelly goes to 0.
Previously found pointers work perfectly - but when I try to find them again - I get the same problem as with VALUE3 - zero results even thought previously found ones work
What is a possible cause?
Common causes are a pointer level that is too small, or an insufficient max offset.
dpdsbd wrote:
How to go around it?
Increase max offset and/or max level.
I suggest you use "pointers must end with" and input the 5th offset of the previously working pointer to decrease scan time.
The more offsets you input here the faster the scan, and the more chances you have to miss a valid pointer, so the best is to input as few offsets as possible to keep scan times bearable.
dpdsbd wrote:
For some reason the pointers done before work perfectly?
Is that a question?
Judging by what you wrote just after, they don't work perfectly: they are unstable. Finding an unstable pointer is better that nothing, but you should assume that one day they'll stop working - definitely.
If you wonder why the scanner doesn't list them anymore, that's because they were invalid at the time the scanner checked them. _________________
DO NOT PM me if you want help on making/fixing/using a hack.
I've managed to get proper pointers for VALUE1 and VALUE2 (based on your advice). It was pretty dumb of me to think mdnsNSP.dll based pointer is ok But to be sure I checked in Process Explorer and as you said, this dll has nothing to do with the process I need to read.
As for VALUE3, I'm still trying to get it as it still eludes me - will test extensively and hopefully I'll managed to get it soon. Raising pointer level above 5 seems to make CE consider tons of data - "raw" files grew from 300MB to 10+GB 0.o
Anyways - I'll test some more and let yoou know how it goes
As for VALUE3, I'm still trying to get it as it still eludes me - will test extensively and hopefully I'll managed to get it soon. Raising pointer level above 5 seems to make CE consider tons of data - "raw" files grew from 300MB to 10+GB)
Scanning speed and .ptr file size is the scanner's main problems. 10Gb isn't that much for a deep pointer... says someone who already went past 200Gb.
Anyway, I assume you've completed CE's tutorial and know the method described there to find pointers. This method is NOT recommended but you can use it to find the 1-3 topmost offsets and give them to the pointerscanner, making your searches faster and less HDD space consuming.
You can use the "Base address must be in range" option if you're absolutely certain you only want pointers that have their base - for example - in the .exe (but your game might also have its own .dll). This options will reduce hdd space consumption and probably make scans a bit faster since there will be less hdd writes (the main bottleneck atm). _________________
DO NOT PM me if you want help on making/fixing/using a hack.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum