 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
h3x1c
Master Cheater
 Reputation: 17
Joined: 27 Apr 2013
Posts: 306
|
 Posted: Sun Jul 24, 2016 12:45 pm Post subject: Question for using pointer offset when comparing addresses. |
 |
|
Consider the following scenario:
You have a shared instruction that writes to many addresses. When comparing addresses, there don't appear to be any offsets that differentiate the player at all times; however, at, say, baseAddress+4, there's a pointer.
Is there anything I can do with that pointer? Not necessarily the pointer value itself, but when you expand the pointer in the dissect data/structure window and you see a bunch of other offsets, is there some sort of information down through there that I can somehow reference to differentiate the player?
I've always just skipped offsets with pointers because of their volatility, but now I'm wondering if there's some way to use them in lieu of not being able to use *anything* from any of the other offsets I'm combing through above or below the base address.
Thanks!
_________________
|
|
| Back to top |
|
 |
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4706
|
| Posted: Sun Jul 24, 2016 12:59 pm Post subject: |
|
|
Sure it's fine, but you might need to check if the pointer is valid before you dereference it. If that instruction strictly accesses data within the same type of structure, you can usually get away with checking if it's null (0). If that doesn't work out, call isBadReadPtr.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Sun Jul 24, 2016 1:17 pm Post subject: |
 |
|
Methods for finding a unique identifier:
| ++METHOS wrote: |
- You can use a pointer address for your filter, inside of your script, for the value that you are trying to manipulate.
- You can use pointer trees inside of the data structure to find something viable.
- You can shift the data structure (+ or -) and/or expand its size to find something useful.
- You can use the structure spider to find workable strings and/or for comparative analysis.
- You can check the register values by attaching the debugger or setting a breakpoint to see if something can be used for your filter.
- You can check to see if there are any instructions that are exclusive to the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can check to see if there are any instructions that are exclusive to any other address/value inside of the data structure for the address/value that you are trying to manipulate and store the address for your filter by creating a second injection point.
- You can analyze assembly code to see if an identifier is being checked or assigned somewhere.
- Et al.
|
In your case, you can use the following format:
Assuming the instruction is: mov eax,[esi+4]
Let's assume that at offset +C, a pointer tree exists. Within that pointer tree, another pointer exists at offset +40. Within that pointer tree, a unique identifier can be found at offset +8, with a hex value of DEADBEEF:
| Code: | push edi
mov edi,[esi+C]
mov edi,[edi+40]
mov edi,[edi+8]
cmp edi,DEADBEEF
pop edi
je cow_killer |
There are other ways that you can write it, but this simple format should be easy to understand. As ParkourPenguin pointed out, you may need to check if the data is valid first, to avoid crashing. There are several ways to check for validity.
|
|
| Back to top |
|
|
h3x1c
Master Cheater
Reputation: 17
Joined: 27 Apr 2013
Posts: 306
|
| Posted: Sun Jul 24, 2016 1:37 pm Post subject: |
|
|
Amazing stuff. Thank you, guys. Going to futz around with all of this right...NOW! 
_________________
|
|
| Back to top |
|
|
PinPoint
Expert Cheater
 Reputation: 10
Joined: 07 Apr 2016
Posts: 223
Location: Scotland
|
| Posted: Sun Jul 24, 2016 4:03 pm Post subject: |
|
|
I had asked about using pointer offests as a filter to write to the same pointer a few months ago. Not entirely the same as what you asked but the post may have some helpful info
http://forum.cheatengine.org/viewtopic.php?p=5668242
|
|
| Back to top |
|
|
h3x1c
Master Cheater
Reputation: 17
Joined: 27 Apr 2013
Posts: 306
|
| Posted: Fri Aug 26, 2016 9:53 am Post subject: |
|
|
| ++METHOS wrote: | In your case, you can use the following format:
Assuming the instruction is: mov eax,[esi+4]
Let's assume that at offset +C, a pointer tree exists. Within that pointer tree, another pointer exists at offset +40. Within that pointer tree, a unique identifier can be found at offset +8, with a hex value of DEADBEEF:
| Code: | push edi
mov edi,[esi+C]
mov edi,[edi+40]
mov edi,[edi+8]
cmp edi,DEADBEEF
pop edi
je cow_killer |
|
Is this a case where using Structure Spider might come in handy? I've yet to use it and, reading about it in the CE help file, I'm sitting here asking myself why the hell I haven't yet, lol. I'll be messing with it this weekend, but while I'm sitting here at work, I figured I'd ask about this particular scenario in regards to it.
Thanks again for everything else you said, ++METHOS. You gave me a lot of good stuff to go on.
_________________
|
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Fri Aug 26, 2016 9:42 pm Post subject: |
|
|
| Honestly, I don't typically use the structure spider unless I'm desperate and/or looking for some useful strings to use/compare. It has come in handy a total of one time, but to be fair, I don't usually need it.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
