| View previous topic :: View next topic |
| Author |
Message |
blueBoxDiv
Newbie cheater
![]() Reputation: 0
Joined: 26 Sep 2023
Posts: 13
|
 Posted: Tue Apr 23, 2024 11:23 am Post subject: Equavilient of CTRL + F but for OpCode instructions? |
 |
|
If I know there's an instruction that contains this OpCode. How can I search for 7FF71C3BE2E0 to find that line of OpCode.
I am not asking to go to: 7FF71C3BE2E0
I am asking to go to where "jmp 7FF71C3BE2E0" is defined at, which I do by searching for 7FF71C3BE2E0 in all OpCodes. But how can I do that?
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 147
Joined: 06 Jul 2014
Posts: 4518
|
| Posted: Tue Apr 23, 2024 12:44 pm Post subject: |
|
|
"Memory Viewer -> Search -> Find assembly code" is a thing that exists, but it was damn slow last I used it years ago.
I'd recommend "Memory Viewer -> Tools -> Dissect code". If the code isn't in a module (e.g. JIT-compiled), find the relevant memory region in "Memory Viewer -> View -> Memory Regions" and set the custom start / stop range to the beginning / end of that region. Then just go to the target address and see what references are made to it. You can use Lua to filter this further:
| Code: | local t = {}
for addr,reftype in pairs(getDissectCode().getReferences'7FF71C3BE2E0') do
if reftype == jtUnconditional then -- defined in `defines.lua`
t[#t+1] = getNameFromAddress(addr)
end
end
return t |
(execute this in "Memory Viewer -> Tools -> Lua Engine" after dissecting code)
I suppose you could also make a custom type for it, but that might be a bit overkill.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
blueBoxDiv
Newbie cheater
![]() Reputation: 0
Joined: 26 Sep 2023
Posts: 13
|
| Posted: Thu Apr 25, 2024 11:20 am Post subject: |
|
|
| ParkourPenguin wrote: | "Memory Viewer -> Search -> Find assembly code" is a thing that exists, but it was damn slow last I used it years ago.
I'd recommend "Memory Viewer -> Tools -> Dissect code". If the code isn't in a module (e.g. JIT-compiled), find the relevant memory region in "Memory Viewer -> View -> Memory Regions" and set the custom start / stop range to the beginning / end of that region. Then just go to the target address and see what references are made to it. You can use Lua to filter this further:
| Code: | local t = {}
for addr,reftype in pairs(getDissectCode().getReferences'7FF71C3BE2E0') do
if reftype == jtUnconditional then -- defined in `defines.lua`
t[#t+1] = getNameFromAddress(addr)
end
end
return t |
(execute this in "Memory Viewer -> Tools -> Lua Engine" after dissecting code)
I suppose you could also make a custom type for it, but that might be a bit overkill. |
That works.
What is dissect code exactly for?
Though for a built .exe with "Release" it's still not sufficient enough to find the actual address of a function nor does breakpointing at the actual function ever trigger...
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 147
Joined: 06 Jul 2014
Posts: 4518
|
| Posted: Thu Apr 25, 2024 12:07 pm Post subject: |
|
|
Dissect code goes through assembly code and notes certain things: calls made, conditional and unconditional branches, and string references. This is a rudimentary form of common tools found in other reverse engineering software.
If you're building code in release mode, the function you want might not even exist. It was probably inlined. You'd have to tell the compiler explicitly to not inline it.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
blueBoxDiv
Newbie cheater
![]() Reputation: 0
Joined: 26 Sep 2023
Posts: 13
|
| Posted: Sat Apr 27, 2024 7:10 am Post subject: |
|
|
| ParkourPenguin wrote: | Dissect code goes through assembly code and notes certain things: calls made, conditional and unconditional branches, and string references. This is a rudimentary form of common tools found in other reverse engineering software.
If you're building code in release mode, the function you want might not even exist. It was probably inlined. You'd have to tell the compiler explicitly to not inline it. |
I made it specifically Release.
Debug works fine. This was to train myself and figure out what is possible and where one might needs to try and guess based on static addresses.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
