| View previous topic :: View next topic |
| Author |
Message |
VirtualMind Newbie cheater
Reputation: 0
Joined: 04 Apr 2015 Posts: 20
|
Posted: Wed Apr 08, 2015 4:17 pm Post subject: Pointer scan for an array of byte |
|
|
After dumping a .swf file from a flash game i decompiled the swf to see how the game functions work. and i can modify those game functions using array of byte.
like for example i have this code D2 E3 44 55 77 0F 6E
i can simply search it in array of byte and change it to what ever i want. but the problem is with finding the static address..
i triad a lot of pointer scans. all shows 0 results. i even triad level 7 and offest with 10000 which took some time and size to do. yet 0 results.
oh and i triad to attach the debugger (find what writes/read to this address) but the debugger is showing nothing
should i go for a higher level pointer scan? or is there another method?
Edit : i meant that i only get 0 results in pointer scan AFTER i rescan.
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 958
|
Posted: Wed Apr 08, 2015 5:47 pm Post subject: |
|
|
| The bytecode source in a swf is not structured by fixed offset, it has its own format. So pointer scan is not a suitable tool to modify bytecodes.
|
|
| Back to top |
|
 |
VirtualMind Newbie cheater
Reputation: 0
Joined: 04 Apr 2015 Posts: 20
|
Posted: Thu Apr 09, 2015 7:04 am Post subject: |
|
|
| panraven wrote: | | The bytecode source in a swf is not structured by fixed offset, it has its own format. So pointer scan is not a suitable tool to modify bytecodes. |
then what should i use to get base address?
i know that i can make a LUA script in CE to search array of byte and then change it by simply using Luacall function. but i'm coding a trainer to C# and there is no other way but to get base address(i guess?)
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25807 Location: The netherlands
|
Posted: Thu Apr 09, 2015 7:23 am Post subject: |
|
|
The distance from the aob and swf start is probably always the same. So try a pointerscan for that and apply the distance to the aob in the last offset
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 958
|
Posted: Thu Apr 09, 2015 4:53 pm Post subject: |
|
|
There are too many variants on reaching even the decompressed swf base address, especially different trainer user may use different browser, chrome's flash player is different from firefox's for instance.
Then a flash game may load many different swf at the same time, some as library, some as resource, so even you can get to the strong assumption that the target aob is a fixed offset from the swf base and the swf base can be ponter-wised, at least a verifying step has to make on every swf loaded.
I suggest to make a custom aobscan for your #c trainer, I know nothing about c# programming, hope this link help: http://www.pinvoke.net/search.aspx?search=readprocessmemory&namespace=[All]
|
|
| Back to top |
|
 |
VirtualMind Newbie cheater
Reputation: 0
Joined: 04 Apr 2015 Posts: 20
|
Posted: Fri Apr 10, 2015 12:34 pm Post subject: |
|
|
| panraven wrote: | There are too many variants on reaching even the decompressed swf base address, especially different trainer user may use different browser, chrome's flash player is different from firefox's for instance.
Then a flash game may load many different swf at the same time, some as library, some as resource, so even you can get to the strong assumption that the target aob is a fixed offset from the swf base and the swf base can be ponter-wised, at least a verifying step has to make on every swf loaded.
I suggest to make a custom aobscan for your #c trainer, I know nothing about c# programming, hope this link help: |
so i'm gonna have to duplicate what cheat engine does? search for aob and replace?
| Dark Byte wrote: | | The distance from the aob and swf start is probably always the same. So try a pointerscan for that and apply the distance to the aob in the last offset |
you mean the cheat engine view of the aob? i'm sorry i don't think i understand what you just said.
like original aob is D2 66 3D 24 (which is in hex) but when i convert that into decimal i get 210 102 61 36 . i did a pointer scan for that value and still got 0 results after rescanning
Edit: Sorry i guess i was drunk lol. so you mean to do a pointer scan and get the last offest. and the apply it with the original address?
|
|
| Back to top |
|
 |
|