Joined: 08 Jun 2020 Posts: 122 Location: Migrating
Posted: Mon Jan 04, 2021 6:51 am Post subject: Is it possible to find an address when a value exists?
I'm no expert in lua/asm, but I'm wondering if it's possible to grab an address when a specific value is found at any time during a process' runtime?
I know for certain that, eventually, a value (eg. 1193564454) will exist in some unknown address, but if only for a frame, and at an unknown time otherwise.
I assume it's possible to have a breakpoint or similar to find any address(es) that contain a value when it pops up during runtime, but I'm completely lost.
It's not possible to automatically "detect" when that specific value is written (as far as I know).
The way to solve this problem is that you have to do some detective work and figure out how that value is being written. Maybe there is some string that is associated with the function that writes it? Use "referenced strings" as an entry point and see if you can get onto the thread that eventually writes that value. Or maybe you have some other idea about how this process works to get to the right thread.
But once you find the thread, slowly step through it and narrow down exactly when it's written. Eventually (after a lot of tedious stepping through the assembly op codes) you can figure out precisely which opcode writes it and then you can always know where it is by breaking on that opcode.
I've done this myself many times. It can take a while but you will eventually find it this way.
Ultimap/code filter can be useful when you have some kind of event that you can control in-game. Like if you fire a weapon or take damage you can use that as a condition to filter the results. It doesn't really work when you just have a one-shot event you are trying to track down.
For example, a recent game hack I was working on involved reversing the process that decrypts the save game. This is a one-time event that happens when the game is initialized. I was able to do this by finding a string that referenced where the save game was stored, and then stepping through the thread until I found where individual bytes were being decrypted. It took me two hours at most - I don't really know how ultimap/code filter could have helped me do this any faster.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum