| View previous topic :: View next topic |
| Author |
Message |
Loset
Cheater
![]() Reputation: 0
Joined: 18 Apr 2015
Posts: 34
|
 Posted: Sun Jun 28, 2015 12:53 pm Post subject: auto assembly and pointers.. |
 |
|
lets say I have a pointer for ammo
like [[["xx.exe+01df8ag"]+9c]+8A]+0F
how do I refrence the value of the address in assembly?
lets say I want to compare the value that this pointer holds with 0..
cmp ????,0
how do I..?
|
|
| Back to top |
|
 |
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sun Jun 28, 2015 1:27 pm Post subject: |
|
|
Change "RAX" to "EAX" if it is a 32-bit process.
| Code: | push rax
mov rax,[xx.exe+01df8ag]
mov rax,[rax+9c]
mov rax,[rax+8a]
cmp [rax+0f],0
pop rax
jne return |
|
|
| Back to top |
|
|
Loset
Cheater
![]() Reputation: 0
Joined: 18 Apr 2015
Posts: 34
|
| Posted: Sun Jun 28, 2015 5:34 pm Post subject: |
|
|
| Zanzer wrote: | Change "RAX" to "EAX" if it is a 32-bit process.
| Code: | push rax
mov rax,[xx.exe+01df8ag]
mov rax,[rax+9c]
mov rax,[rax+8a]
cmp [rax+0f],0
pop rax
jne return |
|
| Code: | mov ecx,[xxxx.exe+00623dc0]
mov ecx,[ecx+dc]
mov ecx,[ecx+4]
mov ecx,[ecx+1c8]
mov ecx,[ecx+0]
|
ecx should have been 281e13fc
but what I got in debugging was 6664616F caused a crash? what did I do wrong?
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sun Jun 28, 2015 5:50 pm Post subject: |
|
|
You'll have to tell me. I don't know what your offsets should've been. 
Trace the instruction and make sure the pointer at each hop is correct.
|
|
| Back to top |
|
|
Loset
Cheater
![]() Reputation: 0
Joined: 18 Apr 2015
Posts: 34
|
| Posted: Sun Jun 28, 2015 6:07 pm Post subject: |
|
|
| Zanzer wrote: | You'll have to tell me. I don't know what your offsets should've been.
Trace the instruction and make sure the pointer at each hop is correct. |
oops.. after tracing it I saw where was my mistake..
mov ecx,[ecx+0] at this point it already had the right address and then I fucked it up with this instruction.. I thought +0 is also offset..
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
