| View previous topic :: View next topic |
| Author |
Message |
diamondwolf.c
Newbie cheater
![]() Reputation: 1
Joined: 11 Sep 2010
Posts: 12
|
 Posted: Wed Feb 17, 2016 10:56 am Post subject: How to store a pointer into a symbol in an x64 application |
 |
|
Hello folks,
i have a problem storing an 64bit register into an registered symbol to use it as a pointer.
e.g.
| Code: |
[ENABLE]
aobscanmodule(INJECT,Tutorial-x86_64.exe,29 93 90 07 00 00)
alloc(newmem,$1000,"Tutorial-x86_64.exe"+2A8B7)
label(code)
label(return)
registersymbol(POINTER)
label(POINTER)
newmem:
POINTER:
dd 0
//dq 0
code:
mov [rbx+00000790],rax
mov [POINTER],rbx
jmp return
INJECT:
jmp code
nop
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
mov [rbx+00000790],rax
unregistersymbol(INJECT)
unregistersymbol(POINTER)
dealloc(newmem)
|
I can execute this script but when i wanna use my POINTER in a cheat table as a pointer it points to somewhere but the correct address (using the correct offset, here +790). Like an address with 16chars (64bit address?)
I also tried qword instead of dword. getAddress(), getPointer() and so on
The same procedure works flawless in an 32bit application but not with 64bit.
Do I somehow have to convert the address or what?
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4724
|
| Posted: Wed Feb 17, 2016 11:04 am Post subject: |
|
|
In 64-bit applications, memory locations take up 8 bytes of space. So use dq 0 to reserve that space.
If that doesn't work, then either that section of ASM isn't being run, or you're not adding the pointer correctly.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
diamondwolf.c
Newbie cheater
![]() Reputation: 1
Joined: 11 Sep 2010
Posts: 12
|
| Posted: Wed Feb 17, 2016 11:13 am Post subject: |
|
|
When i use dq 0 the pointer points to 00000000, using dd 0 I end up somwhere like 7909329000000790"
I'm adding a pointer the normal way through "Add Address Manually" using my symbol as the base address and adding the offset.
Like i said it works with a 32bit application just fine
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25854
Location: The netherlands
|
| Posted: Wed Feb 17, 2016 11:24 am Post subject: |
|
|
when you use dd the other 4 bytes are part of the code of the code: section
just use dq and make sure your code is executed once
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
hhhuut
Grandmaster Cheater
 Reputation: 6
Joined: 08 Feb 2015
Posts: 607
|
| Posted: Wed Feb 17, 2016 11:25 am Post subject: |
|
|
| Code: | [ENABLE]
aobscanmodule(INJECT,Tutorial-x86_64.exe,29 93 90 07 00 00)
alloc(newmem,$1000,INJECT)
label(code)
label(return)
label(POINTER)
newmem:
code:
mov [rbx+00000790],rax
mov [POINTER],rbx
jmp return
POINTER:
dq 00
INJECT:
jmp newmem
nop
return:
registersymbol(INJECT)
registersymbol(POINTER)
[DISABLE]
INJECT:
mov [rbx+00000790],rax
unregistersymbol(INJECT)
unregistersymbol(POINTER)
dealloc(newmem) |
Works fine for me ...
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 152
Joined: 06 Jul 2014
Posts: 4724
|
| Posted: Wed Feb 17, 2016 11:29 am Post subject: |
|
|
Pretty much the same exact script is working for me on step 2 of the CE tutorial (x64). The reason why it's showing you a ridiculous pointer path when using dd is because it's trying to read 8 bytes long and you only allocated 4 bytes. Hence, it's reading the ASM after that and interpreting that as a part of the pointer. Also, it will absolutely point to 0 until that section of ASM is run. So, do something that makes the application run that code, and you'll have your pointer.
Are you sure you're using CE 6.5? IIRC there was a bug in CE 6.4 where readPointer sometimes didn't work correctly in 64 bit targets.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
diamondwolf.c
Newbie cheater
![]() Reputation: 1
Joined: 11 Sep 2010
Posts: 12
|
| Posted: Wed Feb 17, 2016 1:04 pm Post subject: |
|
|
Shame on me... yeah the problem was, the code didn't get executed. I somehow thought just activating the script would be enough. And because I first used dd I didn't recognize at first that it was pointing to 0.
So i guess I have to run a small script to get the code executed as soon as I activate the script.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
