I want to make my first break points.
I have a game with value I know how to find, and this is what I want to do
1) find it every time the game is running
2) when the value equal to something, print "gotcha."
how do I do that?
my first breakpoint
Moderators: g3nuin3, SpeedWing, WhiteHat, mezzo
33 posts • Page 1 of 3 • 1, 2, 3
my first breakpoint
by Torero » Mon May 12, 2008 2:45 am
- Torero
- NULL
- Posts: 191
- Joined: Thu Jan 04, 2007 10:14 am
by L. Spiro » Mon May 12, 2008 10:28 am
Tools/Search may be of use.
Or, as I said, use scripts.
Or make a Complex Address the first time so you don’t need to keep searching for it.
L. Spiro
Or, as I said, use scripts.
Or make a Complex Address the first time so you don’t need to keep searching for it.
L. Spiro
Our songs remind you of songs you’ve never heard.
-
L. Spiro - L. Spiro
- Posts: 3129
- Joined: Mon Jul 17, 2006 10:14 pm
- Location: Tokyo, Japan
by Torero » Mon May 12, 2008 11:33 am
Complex Addresses
The term complex address actually refers to the format of a text string used to calculate addresses that are multiple pointers deep, or require other forms of extra processing. The string format allows basic math operators in conjunction with module names, which are replacements for their actual addresses, and the [ ] bracket operators, which indicate that after the value inside the brackets is determined, that value should then be considered an address inside the target process and the value at that address should be obtained. In MHS, all valid expressions can be used as complex addresses.
For example, winmine.exe+0x5334 might give us the value 0x01005334. [winmine.exe+0x5334] would be turned into [0x01005334]. Then 0x01005334 is considered an address inside the target process and the value is read from that address (in DWORD form), which might return the value 30.
Typically when writing a complex address, you want to leave off the outside brackets, because we aren’t interested in the value at that address, but the actual address itself. There may be exceptions, however, and you may use the outside brackets as needed. The Normal Address dialog reminds you to omit the outside brackets, however you may break this rule as you see fit.
ok i didn't think this would under modfications.
so the question becomes:
how do I find out how the points lead to the value from game.exe?
The term complex address actually refers to the format of a text string used to calculate addresses that are multiple pointers deep, or require other forms of extra processing. The string format allows basic math operators in conjunction with module names, which are replacements for their actual addresses, and the [ ] bracket operators, which indicate that after the value inside the brackets is determined, that value should then be considered an address inside the target process and the value at that address should be obtained. In MHS, all valid expressions can be used as complex addresses.
For example, winmine.exe+0x5334 might give us the value 0x01005334. [winmine.exe+0x5334] would be turned into [0x01005334]. Then 0x01005334 is considered an address inside the target process and the value is read from that address (in DWORD form), which might return the value 30.
Typically when writing a complex address, you want to leave off the outside brackets, because we aren’t interested in the value at that address, but the actual address itself. There may be exceptions, however, and you may use the outside brackets as needed. The Normal Address dialog reminds you to omit the outside brackets, however you may break this rule as you see fit.
ok i didn't think this would under modfications.
so the question becomes:
how do I find out how the points lead to the value from game.exe?
- Torero
- NULL
- Posts: 191
- Joined: Thu Jan 04, 2007 10:14 am
by Torero » Tue May 13, 2008 11:59 pm
Get the base address of lspiro.exe. That is 0x00400000 in this case.
How do I find my game.exe 's base address?
I found this.
Every address you see here is a lie. You always see 0x00400000 as the base address of your game, but that is not its real address.
Go to [lspiro.exe+0x2104C]. This means 0x00400000 + 0x2104C. The result is 0x0042104C.
I don't get this part - how do I find the first pointer? Or maybe the question should really be: given that I found address of the value via scanning, how do I work it backward?
Get the value at 0x0042104C. Let’s assume it is 0x004AE804.
the value of the pointer is an address of another pointer... right?
Go to the address depicted by the above value. That means we are now at address 0x004AE804. This is the structbase.
Go to [structbase+offset]. Our structbase is 0x004AE804, and the offset of our health is 0x4. 0x004AE804 + 0x4 = 0x004AE808.
0x004AE808 is the address where our health is, as shown in the above diagram. And getting the value here gives us 9,999.
It looks like overall, if I know how the first pointer is found, it will make a lot of sense
- Torero
- NULL
- Posts: 191
- Joined: Thu Jan 04, 2007 10:14 am
by L. Spiro » Tue May 13, 2008 11:59 pm
I am not even going to begin explaining such a long and complicated procedure, and may the Lord have mercy on whoever decides to try.
Such frustration and anger shall not be my reward for having created this software and site.
L. Spiro
Such frustration and anger shall not be my reward for having created this software and site.
L. Spiro
Our songs remind you of songs you’ve never heard.
-
L. Spiro - L. Spiro
- Posts: 3129
- Joined: Mon Jul 17, 2006 10:14 pm
- Location: Tokyo, Japan
by Torero » Wed May 14, 2008 12:07 am
[lspiro.exe+0x2104C]
The help file example just says the value at this address will point to the new structure base, but is it always at this address that the address of this new structure can be found?
how was this pointer's address found in the first place?
The help file example just says the value at this address will point to the new structure base, but is it always at this address that the address of this new structure can be found?
how was this pointer's address found in the first place?
- Torero
- NULL
- Posts: 191
- Joined: Thu Jan 04, 2007 10:14 am
33 posts • Page 1 of 3 • 1, 2, 3
Return to General Related Discussions
Who is online
Users browsing this forum: No registered users and 0 guests