| View previous topic :: View next topic |
| Author |
Message |
rog9001 Expert Cheater
Reputation: 2
Joined: 22 Dec 2015 Posts: 214 Location: Jupiter
|
Posted: Sun May 08, 2016 3:54 pm Post subject: What can you do with Pointer when dissecting a structure? |
|
|
As the subject says that is what I am asking.
if a pointer is on the offset of 24
and in the pointer the value I found is at 14 then how would a compare be written? Is it like this:
| Code: | cmp [eax+00000024*14],00
je example |
I have never dealt with pointers in a data structure so I don't know how to do it. |
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Sun May 08, 2016 4:16 pm Post subject: |
|
|
x86:
| Code: | newmem:
push edi //or whatever register
mov edi,[eax+24]
mov edi,[edi+14]
cmp edi,1234ABCD //or whatever value
pop edi
je cheat
jmp originalcode |
You may also need to include a check to see if the pointer data is valid in order to avoid crashes. |
|
| Back to top |
|
 |
rog9001 Expert Cheater
Reputation: 2
Joined: 22 Dec 2015 Posts: 214 Location: Jupiter
|
Posted: Sun May 08, 2016 5:45 pm Post subject: |
|
|
++METHOS Thanks a lot. Actually what does the "*" mean? like in:
| Code: | | mov eax,[ebx+00002214*4] |
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Sun May 08, 2016 6:25 pm Post subject: |
|
|
| It means multiply. 2214*4=8850 (hex) |
|
| Back to top |
|
 |
++METHOS I post too much
Reputation: 92
Joined: 29 Oct 2010 Posts: 4197
|
Posted: Sun May 08, 2016 6:50 pm Post subject: |
|
|
| And math rules still apply (i.e. multiplication performed before addition). |
|
| Back to top |
|
 |
rog9001 Expert Cheater
Reputation: 2
Joined: 22 Dec 2015 Posts: 214 Location: Jupiter
|
Posted: Mon May 09, 2016 12:35 am Post subject: |
|
|
Oh ok. Just had to confirm it. I thought it could have been something else  |
|
| Back to top |
|
 |
|