Posted: Thu Apr 21, 2022 8:59 pm Post subject: Is there a smarter/cleaner way I could have done this?
This works as is, but I was curious if this is the most efficient way to accomplish comparing a pointer with several offsets in AA? Isn't there some way to get it working with the whole pointer on a single line, or do we have to break it up like this for these situations?
Code:
push rsi
mov esi,["WWE2K19_x64.exe"+025B6BD0]
mov esi,[esi+398]
mov esi,[esi+B8]
mov esi,[esi+238]
mov esi,[esi+1AC]
cmp esi,#3212836864
pop rsi
jne exit
But this instruction assembles down to something like this:
Code:
cmp [741C5948AE58],#3212836864
The address in square brackets (e.g. 741C5948AE58) is the pointed-to address.
Obviously if any node in the pointer path changes this address becomes invalid and that instruction may crash the process. Even if it doesn't change, there's no guarantee the pointed-to address would be within 2 GiB for RIP-relative addressing, meaning you can't do that in a single instruction.
One alternative is to do an injection copy to get the pointed-to address. _________________
I don't know where I'm going, but I'll figure it out when I get there.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum