View previous topic :: View next topic |
Author |
Message |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Tue Sep 20, 2016 9:14 pm Post subject: C++ 64bit virtual cave |
|
|
Hi guys.
How to get 8 bytes address? same like CE; 7fffffffffffffff
Code: | HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetProcId("notepad.exe"));
LPVOID pRemoteThread = VirtualAllocEx(hProcess, NULL, sizeof(void*) == 8, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
|
|
Back to top |
|
 |
STN I post too much
Reputation: 43
Joined: 09 Nov 2005 Posts: 2676
|
Posted: Wed Sep 21, 2016 11:25 am Post subject: |
|
|
WHAT ? Can you explain more
_________________
|
|
Back to top |
|
 |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Thu Sep 22, 2016 5:23 am Post subject: |
|
|
it's working but only 5 bytes addr.
OS: Win8.1
Description: |
|
Filesize: |
82.01 KB |
Viewed: |
6434 Time(s) |

|
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Thu Sep 22, 2016 2:37 pm Post subject: |
|
|
Code: | LPVOID pRemoteThread = VirtualAllocEx(hProcess, NULL, 8, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
|
|
Back to top |
|
 |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Thu Sep 22, 2016 4:43 pm Post subject: |
|
|
Zanzer wrote: | Code: | LPVOID pRemoteThread = VirtualAllocEx(hProcess, NULL, 8, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); |
|
it's same as above.
trying "JMP 97D5680000" <==== cave address
CE report;
Code: | The generated code 14 bytes long, but the slected code 5 bytes long. |
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25791 Location: The netherlands
|
Posted: Thu Sep 22, 2016 4:58 pm Post subject: |
|
|
Assemble
Jmp [rip+0]
DQ address
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
 |
Cestra Newbie cheater
Reputation: 0
Joined: 03 Jun 2016 Posts: 14
|
Posted: Thu Sep 22, 2016 8:47 pm Post subject: |
|
|
Dark Byte wrote: | Assemble
Jmp [rip+0]
DQ address |
Thanks Dark Byte. good idea
Code: | DWORD64 AllocMem = VirtualAllocEx64(hProcess, (0x7FF7BB542C42 + (INT64)pRemoteThread * 32), TEST_SIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); |
|
|
Back to top |
|
 |
|