View previous topic :: View next topic |
Author |
Message |
NanoByte Expert Cheater
Reputation: 1
Joined: 13 Sep 2013 Posts: 222
|
Posted: Sat May 31, 2014 9:32 am Post subject: Aobscanmodule - pointer |
|
|
i want to save address of [rdi+00000170] into _player so i can set offset to it later but i dont know why i get wrong address so even if i had offset it points to the wrong value
real value is 200 and i can change it
with my code i get a value of 200 but the other dosent change if i change this value
Code: | [ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"Disrupt_b64.dll"+6F1B6E)
globalalloc(_player,32)
label(returnhere)
label(originalcode)
label(exit)
label(_ntr)
registersymbol(_ntr)
aobscanmodule(ntr,Disrupt_b64.dll,8B 87 ?? ?? ?? ?? 44 89 9F ?? ?? ?? ??)
newmem:
mov [_player],r11d // not allowing me to do lea it says cant be compiled
originalcode:
mov [rdi+00000170],r11d
exit:
jmp returnhere
ntr+6:
_ntr:
jmp newmem
nop
nop
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
dealloc(_player)
_ntr:
mov [rdi+00000170],r11d
unregistersymbol(_ntr)
unregistersymbol(_player)
//Alt: db 44 89 9F 70 01 00 00 |
|
|
Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 892
|
Posted: Sat May 31, 2014 10:40 am Post subject: |
|
|
just mov [yourmem],rdi and add [yourmem]+170 to your addresslist.
_________________
A nagy kapu mellett, mindig van egy kis kapu.
----------------------
Come on... |
|
Back to top |
|
 |
NanoByte Expert Cheater
Reputation: 1
Joined: 13 Sep 2013 Posts: 222
|
Posted: Sat May 31, 2014 11:12 am Post subject: |
|
|
still wrong value
|
|
Back to top |
|
 |
Daijobu Master Cheater
Reputation: 13
Joined: 05 Feb 2013 Posts: 301 Location: the Netherlands
|
Posted: Sat May 31, 2014 12:20 pm Post subject: |
|
|
Are you using an intermediate register to use load effective address?
lea eax,[something+offset]
mov [player],eax
It's something easily forgotten as you can't load mov(e) [value],[value].
_________________
|
|
Back to top |
|
 |
NanoByte Expert Cheater
Reputation: 1
Joined: 13 Sep 2013 Posts: 222
|
Posted: Sat May 31, 2014 12:54 pm Post subject: |
|
|
Sorry i'm still newbie
intermediate register?
i was using esi
but i just changed it to eax and it now allows the lea command
output of eax is 422113736 and its suppose to be 12500
Update !!!
Woot it works if you do it with a pointer instead of saying _player+170
[X]Pointer
[170]
[_player]
whats the difference?
|
|
Back to top |
|
 |
Daijobu Master Cheater
Reputation: 13
Joined: 05 Feb 2013 Posts: 301 Location: the Netherlands
|
Posted: Sat May 31, 2014 1:56 pm Post subject: |
|
|
The pointer takes the value inside your designated variable and then you set the offset to that address.
When you set it directly without a pointer it takes the address of your variable in stead of what's inside it.
With intermediate register I meant a register you use (temporarily) in stead of directly.
lea [_player],[rdi+00000170] - directly, this will fail.
lea eax,[rdi+00000170]
mov [_player],eax - using eax as a intermediate (in between) register
I'm glad to see you've got it working, I'll add your script to the compilation table for Watch Dogs.
_________________
|
|
Back to top |
|
 |
NanoByte Expert Cheater
Reputation: 1
Joined: 13 Sep 2013 Posts: 222
|
Posted: Sat May 31, 2014 3:12 pm Post subject: |
|
|
I mean like this.
1 works but 2 dosent whats the matter isnt it basically the same thing?
Description: |
|
Filesize: |
9.96 KB |
Viewed: |
18854 Time(s) |

|
|
|
Back to top |
|
 |
Daijobu Master Cheater
Reputation: 13
Joined: 05 Feb 2013 Posts: 301 Location: the Netherlands
|
Posted: Sat May 31, 2014 4:03 pm Post subject: |
|
|
That's what I explained.
1. Takes the value of _player and uses +a8 as offset = address.
2. Uses _player itself (not the value inside it) and uses +a8 as offset = address.
Also, take a look at your other topic in this section. I believe I've got a proper God Mode working.
_________________
|
|
Back to top |
|
 |
NanoByte Expert Cheater
Reputation: 1
Joined: 13 Sep 2013 Posts: 222
|
Posted: Sat May 31, 2014 5:10 pm Post subject: |
|
|
Sorry to ask stupidly
but what u mean _player itself
just what did i store inside it address?
[eax] = value?
eax = address?
also i'm on to something big
read my next topic
|
|
Back to top |
|
 |
Daijobu Master Cheater
Reputation: 13
Joined: 05 Feb 2013 Posts: 301 Location: the Netherlands
|
Posted: Sat May 31, 2014 5:51 pm Post subject: |
|
|
Yes.
If:
EAX is 123456
and EAX contains 777777.
Then:
EAX = 123456
[EAX] = 777777
_________________
|
|
Back to top |
|
 |
Polynomial Grandmaster Cheater
Reputation: 5
Joined: 17 Feb 2008 Posts: 524 Location: Inside the Intel CET shadow stack
|
|
Back to top |
|
 |
NanoByte Expert Cheater
Reputation: 1
Joined: 13 Sep 2013 Posts: 222
|
Posted: Sat May 31, 2014 8:07 pm Post subject: |
|
|
Ohh, Thanks Guys
i really appreciate it
|
|
Back to top |
|
 |
|