View previous topic :: View next topic |
Author |
Message |
Pingo Grandmaster Cheater
Reputation: 8
Joined: 12 Jul 2007 Posts: 571
|
Posted: Sun Feb 14, 2010 8:44 am Post subject: [C#] Converting |
|
|
Im trying to convert an address (0055E2A4) to 43 df 15 00
Just like CE memory viewer reads it.
0040035C - e9 43 df 15 00 - jmp 0055e2a4
Im able to write the bytes but cant convert it first.
I need to do this because of different versions, the address i jump to changes.
Also the app scans for the address first so i wouldnt know where to jump untill its found and converted.
Thanks if anyone can help
_________________
|
|
Back to top |
|
 |
Deltron Z Expert Cheater
Reputation: 1
Joined: 14 Jun 2009 Posts: 164
|
Posted: Mon Feb 15, 2010 2:52 am Post subject: |
|
|
Little Endian - it's actually 0x0015DF43. since a JMP is relative, add the address 0x0040035C to it plus 5 bytes. (length of a far-jump instruction)
|
|
Back to top |
|
 |
Pingo Grandmaster Cheater
Reputation: 8
Joined: 12 Jul 2007 Posts: 571
|
Posted: Mon Feb 15, 2010 7:59 am Post subject: |
|
|
I'll still need to conver it first. 0040035C is just a codecave.
Hex to array of bytes but everything i try just just seperates it.
_________________
|
|
Back to top |
|
 |
Anden100 Grandmaster Cheater
Reputation: 0
Joined: 20 Apr 2007 Posts: 668
|
Posted: Mon Feb 15, 2010 8:38 am Post subject: |
|
|
Pingo wrote: | I'll still need to conver it first. 0040035C is just a codecave.
Hex to array of bytes but everything i try just just seperates it. |
Code: | DWORD converted = (*(DWORD*)0x0040035C)+0x0040035C+5; |
or ReadProcessMemory if you would like:
Code: | DWORD converted = 0;
ReadProcessMemory(hProcess, 0x0040035C, &converted , 4, NULL);
converted += 0x0040035C + 5; |
In CE, go to the memory address in Hex View, right click-> Display Type-> 4 Byte Hex
|
|
Back to top |
|
 |
|