| View previous topic :: View next topic |
| Author |
Message |
idk31
Cheater
![]() Reputation: 1
Joined: 11 Jan 2016
Posts: 42
|
 Posted: Sat Sep 17, 2016 1:27 pm Post subject: Get single address when instruction accesses two? |
 |
|
I found an instruction that accesses 2 addresses. One of them I want. I know an instruction that accesses only the wrong one of these 2. Can I use this information to get the right one? Perhaps with lua? I checked the whole structure. Every instruction accesses 2 addresses. I want to write to only the right address.
_________________
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 140
Joined: 06 Jul 2014
Posts: 4302
|
| Posted: Sat Sep 17, 2016 1:55 pm Post subject: |
|
|
Sure. Use the instruction that accesses the wrong address and store that address in a registered symbol. Look up that registered symbol in the instruction that accesses both the correct address and the wrong address. If the registered symbol is 0 (uninitialized) or the address being accessed is equal to the value of that registered symbol, then don't bother executing the rest of your code.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
idk31
Cheater
![]() Reputation: 1
Joined: 11 Jan 2016
Posts: 42
|
| Posted: Sat Sep 17, 2016 3:32 pm Post subject: |
|
|
Hmm. Having trouble understanding how to script that. Both addresses are being accesses equally at the same time with a preference for the wrong one. About 80 accesses per second. When I make it a symbol, it is seen as the wrong one.
This instruction accesses 2 HUD elements on screen. I want to write to the lesser preferred address (change the width setting). The idea is I hit a button to resize it. Again to restore it. I don't know how to get at it tho.
_________________
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 140
Joined: 06 Jul 2014
Posts: 4302
|
| Posted: Sat Sep 17, 2016 3:44 pm Post subject: |
|
|
So all you need is a reference to the correct address?
Instruction that only accesses the wrong address:
| Code: | alloc(newmem,1024)
alloc(wrongAddress,4)
registersymbol(wrongAddress)
newmem:
mov [wrongAddress],ecx
//original code:
mov eax,[ecx]
... |
Instruction that accesses both the correct address and the wrong address:
| Code: | alloc(newmem,1024)
globalalloc(correctAddress,4)
newmem:
push eax
mov eax,[wrongAddress]
test eax,eax
jz exit
cmp eax,edx
je exit
mov [correctAddress],edx
exit:
pop eax
//original code:
mov [edx],ebx
... |
Once [correctAddress] is not 0, it has been assigned the correct address, and you can disable both scripts. Make sure to enable the first before the second since the second references the symbol defined in the first.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
idk31
Cheater
![]() Reputation: 1
Joined: 11 Jan 2016
Posts: 42
|
| Posted: Sat Sep 17, 2016 5:21 pm Post subject: |
|
|
I tried to translate that for my purposes in a couple different ways. All failed. Can you help using my own code?
Accesses only wrong address:
| Code: |
aobscanmodule(wrongAOB,LifeIsStrange.exe,2B 8B 10 01 00 00)
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(wrongAddress,4)
newmem:
code:
mov [wrongAddress],ebx
//original code:
sub ecx,[ebx+00000110]
jmp return
wrongAOB:
jmp code
nop
return:
registersymbol(wrongAOB)
|
Accesses both:
| Code: |
aobscanmodule(bothAOB,LifeIsStrange.exe,8B 06 89 84 24 A8 00 00 00)
alloc(newmem,$1000)
label(code)
label(return)
globalalloc(correctAddress,4)
newmem:
code:
mov [correctAddress],esi
//original code:
mov eax,[esi]
mov [esp+000000A8],eax
jmp return
bothAOB:
jmp code
nop
nop
nop
nop
return:
registersymbol(bothAOB)
|
_________________
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 140
Joined: 06 Jul 2014
Posts: 4302
|
| Posted: Sat Sep 17, 2016 5:26 pm Post subject: |
|
|
You completely ignored all of the jcc instructions in the hook of the instruction that accesses both addresses. Also, the address is [ebx+110] in your first script but [esi] in your second script. When you get around to adding those jcc instructions back in, make sure you either add 110 to ebx or subtract 110 from esi when comparing them.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
idk31
Cheater
![]() Reputation: 1
Joined: 11 Jan 2016
Posts: 42
|
| Posted: Sat Sep 17, 2016 6:15 pm Post subject: |
|
|
| ParkourPenguin wrote: | | You completely ignored all of the jcc instructions... |
I was showing you how I would make that a symbol before all of that stuff. I should have showed you what I *did* try. Sorry. My head is a little foggy today. Anyway, the crucial thing I missed was "add ebx,110" before the compare and I didn't label "exit". It works now. You came through for me again! Thanks ParkourPenguin.
_________________
|
|
| Back to top |
|
|
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sat Sep 17, 2016 6:29 pm Post subject: |
|
|
| Code: | mov [wrongAddress],ebx
add [wrongAddress],110 |
| Code: | code:
cmp [wrongAddress],esi
je @f
mov [correctAddress],esi
@@:
//original code:
mov eax,[esi]
mov [esp+000000A8],eax
jmp return |
|
|
| Back to top |
|
|
idk31
Cheater
![]() Reputation: 1
Joined: 11 Jan 2016
Posts: 42
|
| Posted: Sat Sep 17, 2016 7:11 pm Post subject: |
|
|
| Zanzer wrote: |
| Code: | code:
cmp [wrongAddress],esi
je @f
mov [correctAddress],esi
@@:
//original code:
mov eax,[esi]
mov [esp+000000A8],eax
jmp return |
|
Not exactly sure what's going on here, but I tried it and this also works. Thanks! (EDIT: read up on my Assembly and understand this now)
_________________
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
