LeFiXER Grandmaster Cheater Supreme
Reputation: 20
Joined: 02 Sep 2011 Posts: 1066 Location: 0x90
|
Posted: Sun Sep 26, 2021 3:30 pm Post subject: |
|
|
When scanning for commonalities, the address that holds the value you want to change should be set to group 1 then a handful of addresses set to group 2. Once you've assigned groups scan for commonalities. Select the register (eax/rax,ecx,rcx,edi,rdi etc...) and save the file to a location.
In the new window the far-left column will hold an offset. Look for a row where column 1 holds a value that is different to every other column. Usually it's something like 1 or 0. Take note of that offset then you can compare like this:
Code: |
aobscan(symbol, aob)
alloc(newmem,$1000,symbol)
label(code)
label(return)
label(compare)
newmem:
cmp [register+offset], value
jne compare
// code you want to execute if value matches group one
jmp return
compare:
// code you want to execute if the value matches group two
// usually it's normal code but sometimes you can do other things
jmp return
code:
// original code
jmp return
return:
registersymbol(symbol)
...
|
Obviously this isn't copy/paste code but it will give you an idea of how to achieve a comparison.
|
|